Release 2.8.0

test/audit-log-settings.test.js

@@ -0,0 +1,47 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+require('../src/common');
+
+const { recordRequestAuditEvent } = require('../src/data/audit-log');
+
+function createPool(settings) {
+  const inserts = [];
+  return {
+    inserts,
+    async query(sql, params) {
+      if (String(sql).includes('SELECT id, setting_key, setting_value FROM o_app_settings')) {
+        return [[
+          { setting_key: 'audit.enabled', setting_value: JSON.stringify(settings.enabled) },
+          { setting_key: 'audit.categories', setting_value: JSON.stringify(settings.categories) },
+          { setting_key: 'audit.include_request_metadata', setting_value: JSON.stringify(settings.includeMetadata) }
+        ]];
+      }
+      if (String(sql).includes('INSERT INTO o_audit_events')) {
+        inserts.push(params);
+      }
+      return [[]];
+    }
+  };
+}
+
+const request = {
+  ip: '192.0.2.10',
+  headers: {
+    'user-agent': 'audit-test'
+  }
+};
+
+test('audit writer skips disabled categories', async () => {
+  const pool = createPool({ enabled: true, categories: ['security'], includeMetadata: true });
+  await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
+  assert.equal(pool.inserts.length, 0);
+});
+
+test('audit writer omits request metadata when disabled', async () => {
+  const pool = createPool({ enabled: true, categories: ['authentication'], includeMetadata: false });
+  await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
+  assert.equal(pool.inserts.length, 1);
+  assert.equal(pool.inserts[0][6], null);
+  assert.equal(pool.inserts[0][7], null);
+});