Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction

shopdb/core/api/auditlogs.py

@@ -4,7 +4,8 @@ from flask import Blueprint, request
 from flask_jwt_extended import jwt_required
 
 from shopdb.core.models import AuditLog
-from shopdb.utils.responses import success_response
+from shopdb.extensions import db
+from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_permission
 
 auditlogs_bp = Blueprint('auditlogs', __name__)
@@ -194,3 +195,74 @@ def db_func_count_by(column):
     ).group_by(column).all()
 
     return {r[0]: r[1] for r in results}
+
+
+@auditlogs_bp.route('/retention', methods=['GET'])
+@jwt_required()
+@require_permission('audit.view')
+def get_retention():
+    """Size of the log and what the configured retention would remove.
+
+    Drives the Site & Facility card: an admin should see the number of entries a
+    purge deletes BEFORE pressing anything.
+    """
+    from shopdb.core.services import auditretention
+    days = auditretention.configureddays()
+    return success_response(auditretention.stats(days or None))
+
+
+@auditlogs_bp.route('/purge', methods=['POST'])
+@jwt_required()
+@require_permission('audit.purge')
+def purge_auditlogs():
+    """Delete entries older than the retention window.
+
+    Separate permission from audit.view: reading the log and destroying it are
+    not the same act, and plenty of people need the first.
+
+    Batch-capped, because this runs inside a request that a proxy will time out.
+    An incomplete purge returns complete=false and the number still to go rather
+    than reporting a finished job - the caller re-posts, or runs
+    `flask audit purge --apply` on the server, which has no cap.
+    """
+    from flask import request as flask_request
+    from shopdb.core.services import auditretention
+
+    body = flask_request.get_json(silent=True) or {}
+    days = body.get('days')
+    if days is None:
+        days = auditretention.configureddays()
+    try:
+        days = int(days)
+    except (TypeError, ValueError):
+        days = 0
+    if days <= 0:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'No retention period is configured. Set one in Site & Facility '
+            'settings before purging.')
+
+    dryrun = bool(body.get('dryrun'))
+    result = auditretention.purge(
+        days, dryrun=dryrun,
+        maxbatches=None if dryrun else auditretention.MAXBATCHES_REQUEST)
+
+    if dryrun:
+        message = '{:,} entry(s) would be deleted'.format(result['matched'])
+    elif result['complete']:
+        message = 'Deleted {:,} entry(s)'.format(result['deleted'])
+    else:
+        message = ('Deleted {:,} entry(s); {:,} still older than the cutoff. '
+                   'Run it again to continue.').format(
+                       result['deleted'], result['remaining'])
+
+    # The purge is itself an audited act, and this row postdates the cutoff so
+    # it survives the purge that created it.
+    if not dryrun and result['deleted']:
+        from shopdb.api import audit_log
+        audit_log(action='deleted', entitytype='AuditLog',
+                  entityname='purge older than {} days'.format(days),
+                  changes={'deleted': result['deleted'],
+                           'cutoff': result['cutoff']})
+
+    return success_response(result, message=message)