Add audit log entries for project-role-changed and group-role-changed

GitOrigin-RevId: 4c326dd922bede6f218a6d89e4f18c312a9abf98

services/web/test/unit/src/Collaborators/CollaboratorsHandler.test.mjs

@@ -104,6 +104,17 @@ describe('CollaboratorsHandler', function () {
       })
     )
 
+    ctx.ProjectAuditLogHandler = {
+      addEntryInBackground: sinon.stub(),
+    }
+
+    vi.doMock(
+      '../../../../app/src/Features/Project/ProjectAuditLogHandler',
+      () => ({
+        default: ctx.ProjectAuditLogHandler,
+      })
+    )
+
     ctx.CollaboratorsHandler = (await import(MODULE_PATH)).default
   })
 
@@ -812,5 +823,29 @@ describe('CollaboratorsHandler', function () {
         )
       ).to.be.rejectedWith(Errors.NotFoundError)
     })
+
+    it('should write a project audit log', async function (ctx) {
+      ctx.ProjectMock.expects('updateOne')
+        .chain('exec')
+        .resolves({ matchedCount: 1 })
+      const auditInfo = {
+        initiatorId: new ObjectId(),
+        ipAddress: '192.168.1.1',
+      }
+      await ctx.CollaboratorsHandler.promises.setCollaboratorPrivilegeLevel(
+        ctx.project._id,
+        ctx.userId,
+        'readOnly',
+        {},
+        auditInfo
+      )
+      ctx.ProjectAuditLogHandler.addEntryInBackground.should.have.been.calledWith(
+        ctx.project._id,
+        'project-role-changed',
+        auditInfo.initiatorId,
+        auditInfo.ipAddress,
+        { userId: ctx.userId, role: 'Viewer' }
+      )
+    })
   })
 })

services/web/test/unit/src/UserMembership/UserMembershipController.test.mjs

@@ -27,6 +27,7 @@ describe('UserMembershipController', () => {
     recurlySubscriptionId = 'mock-recurly-subscription-id'
     ctx.req = new MockRequest(vi)
     ctx.req.params.id = 'mock-entity-id'
+    ctx.req.ip = '1.2.3.4'
     ctx.user = { _id: 'mock-user-id' }
     ctx.newUser = { _id: 'mock-new-user-id', email: 'new-user-email@foo.bar' }
     ctx.subscription = {
@@ -495,7 +496,8 @@ describe('UserMembershipController', () => {
                 write: 'manager_ids',
               },
             },
-            newUser.email
+            newUser.email,
+            { initiatorId: 'mock-user-id', ipAddress: '1.2.3.4' }
           )
         },
       })
@@ -613,7 +615,8 @@ describe('UserMembershipController', () => {
                 write: 'manager_ids',
               },
             },
-            newUser._id
+            newUser._id,
+            { initiatorId: 'mock-user-id', ipAddress: '1.2.3.4' }
           )
         },
       })

services/web/test/unit/src/UserMembership/UserMembershipHandler.test.mjs

@@ -35,6 +35,9 @@ describe('UserMembershipHandler', function () {
       update: vi.fn().mockReturnValue({
         exec: vi.fn().mockResolvedValue(),
       }),
+      updateOne: vi.fn().mockReturnValue({
+        exec: vi.fn().mockResolvedValue(),
+      }),
     }
     ctx.institution = {
       _id: 'mock-institution-id',
@@ -83,6 +86,21 @@ describe('UserMembershipHandler', function () {
       }),
     }
 
+    ctx.Modules = {
+      promises: {
+        hooks: {
+          fire: vi.fn().mockResolvedValue(),
+        },
+      },
+    }
+
+    ctx.mongoose = {
+      startSession: vi.fn().mockResolvedValue({
+        withTransaction: vi.fn(async callback => await callback()),
+        endSession: vi.fn().mockResolvedValue(),
+      }),
+    }
+
     vi.doMock('mongodb-legacy', () => ({
       default: { ObjectId },
     }))
@@ -110,6 +128,14 @@ describe('UserMembershipHandler', function () {
       Publisher: ctx.Publisher,
     }))
 
+    vi.doMock('../../../../app/src/infrastructure/Modules', () => ({
+      default: ctx.Modules,
+    }))
+
+    vi.doMock('../../../../app/src/infrastructure/Mongoose', () => ({
+      default: ctx.mongoose,
+    }))
+
     ctx.UserMembershipHandler = (await import(modulePath)).default
   })
 
@@ -254,6 +280,66 @@ describe('UserMembershipHandler', function () {
         expect(user).to.equal(ctx.newUser)
       })
     })
+
+    describe('group managers', function () {
+      it('add user to group managers', async function (ctx) {
+        await ctx.UserMembershipHandler.promises.addUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.email
+        )
+        expect(ctx.subscription.updateOne).toHaveBeenCalledWith({
+          $addToSet: { manager_ids: ctx.newUser._id },
+        })
+      })
+
+      it('should write a group audit log when subscription has managed users enabled', async function (ctx) {
+        ctx.subscription.managedUsersEnabled = true
+        const auditInfo = {
+          initiatorId: new ObjectId(),
+          ipAddress: '192.168.1.1',
+        }
+
+        await ctx.UserMembershipHandler.promises.addUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.email,
+          auditInfo
+        )
+
+        expect(ctx.Modules.promises.hooks.fire).toHaveBeenCalledWith(
+          'addGroupAuditLogEntry',
+          {
+            groupId: ctx.subscription._id,
+            operation: 'group-role-changed',
+            initiatorId: auditInfo.initiatorId,
+            ipAddress: auditInfo.ipAddress,
+            info: {
+              userId: ctx.newUser._id,
+              role: 'manager',
+            },
+          },
+          expect.anything() // session object
+        )
+      })
+
+      it('should not write a group audit log when subscription does not have managed users enabled', async function (ctx) {
+        ctx.subscription.managedUsersEnabled = false
+        const auditInfo = {
+          initiatorId: new ObjectId(),
+          ipAddress: '192.168.1.1',
+        }
+
+        await ctx.UserMembershipHandler.promises.addUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.email,
+          auditInfo
+        )
+
+        expect(ctx.Modules.promises.hooks.fire).not.toHaveBeenCalled()
+      })
+    })
   })
 
   describe('removeUser', function () {
@@ -283,5 +369,64 @@ describe('UserMembershipHandler', function () {
         }
       })
     })
+
+    describe('group managers', function () {
+      it('remove user from group managers', async function (ctx) {
+        await ctx.UserMembershipHandler.promises.removeUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.newUser._id
+        )
+        expect(ctx.subscription.updateOne).toHaveBeenCalledWith({
+          $pull: { manager_ids: ctx.newUser._id },
+        })
+      })
+
+      it('should write a group audit log when subscription has managed users enabled', async function (ctx) {
+        ctx.subscription.managedUsersEnabled = true
+        const auditInfo = {
+          initiatorId: new ObjectId(),
+          ipAddress: '192.168.1.1',
+        }
+
+        await ctx.UserMembershipHandler.promises.removeUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.newUser._id,
+          auditInfo
+        )
+
+        expect(ctx.Modules.promises.hooks.fire).toHaveBeenCalledWith(
+          'addGroupAuditLogEntry',
+          {
+            groupId: ctx.subscription._id,
+            operation: 'group-role-changed',
+            initiatorId: auditInfo.initiatorId,
+            ipAddress: auditInfo.ipAddress,
+            info: {
+              userId: ctx.newUser._id,
+              role: 'member',
+            },
+          }
+        )
+      })
+
+      it('should not write a group audit log when subscription does not have managed users enabled', async function (ctx) {
+        ctx.subscription.managedUsersEnabled = false
+        const auditInfo = {
+          initiatorId: new ObjectId(),
+          ipAddress: '192.168.1.1',
+        }
+
+        await ctx.UserMembershipHandler.promises.removeUser(
+          ctx.subscription,
+          EntityConfigs.groupManagers,
+          ctx.newUser._id,
+          auditInfo
+        )
+
+        expect(ctx.Modules.promises.hooks.fire).not.toHaveBeenCalled()
+      })
+    })
   })
 })