AUDIT-61: Create the REST APIs for the Security Audit Logging

api/src/main/java/org/openmrs/module/auditlogweb/api/AuditService.java

@@ -334,10 +334,20 @@ void logSecurityEvent(AuditSecurityEventType eventType, String username, String
 	 * Retrieves the most recent N security events from the same session (for related activity).
 	 *
 	 * @param sessionId the session ID to filter by
-	 * @param limit the maximum number of events to return
+	 * @param page defines the particular page in a paginated view
+	 * @param size defines how many logs want in one go
 	 * @return a list of {@link AuditSecurityEvent} ordered by eventTime descending
 	 */
 	@Authorized(AuditLogConstants.VIEW_SECURITY_AUDIT_LOGS)
-	List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int limit);
+	List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int page, int size);
+
+	/**
+	 * Counts the related security audit events with session ID filter.
+	 *
+	 * @param sessionId the session ID to filter by
+	 * @return the number of logs found
+	 */
+	@Authorized(AuditLogConstants.VIEW_SECURITY_AUDIT_LOGS)
+	long countRelatedSecurityEvents(String sessionId);
 
 }

api/src/main/java/org/openmrs/module/auditlogweb/api/dao/AuditDao.java

@@ -714,14 +714,30 @@ public AuditSecurityEvent getSecurityEventById(Integer eventId) {
 	 * Retrieves the most recent N security events from the same session (for related activity).
 	 *
 	 * @param sessionId the session ID to filter by
-	 * @param limit the maximum number of events to return
+	 * @param page defines the particular page in a paginated view
+	 * @param size defines how many logs want in one go
 	 * @return a list of {@link AuditSecurityEvent} ordered by eventTime descending
 	 */
-	public List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int limit) {
+	public List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int page, int size) {
 		Query<AuditSecurityEvent> query = sessionFactory.getCurrentSession().createQuery(
 		    "from AuditSecurityEvent e where e.sessionId = :sessionId order by e.eventTime desc", AuditSecurityEvent.class);
 		query.setParameter("sessionId", sessionId);
-		query.setMaxResults(limit);
+		query.setFirstResult(page * size);
+		query.setMaxResults(size);
 		return query.getResultList();
 	}
+
+	/**
+	 * Returns the count for all related security events for the given session ID
+	 *
+	 * @param sessionId the session ID to filter by
+	 * @return the count of logs found
+	 */
+	public long countRelatedSecurityEvents(String sessionId) {
+		Query<Long> query = sessionFactory.getCurrentSession()
+		        .createQuery("select count(e) from AuditSecurityEvent e where e.sessionId = :sessionId", Long.class);
+		query.setParameter("sessionId", sessionId);
+		Long result = query.uniqueResult();
+		return result != null ? result : 0L;
+	}
 }

api/src/main/java/org/openmrs/module/auditlogweb/api/dto/SecurityAuditLogDTO.java

@@ -0,0 +1,40 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at http://mozilla.org/MPL/2.0/. OpenMRS is also distributed under
+ * the terms of the Healthcare Disclaimer located at http://openmrs.org/license.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+package org.openmrs.module.auditlogweb.api.dto;
+
+import lombok.Builder;
+import lombok.Data;
+import org.openmrs.module.auditlogweb.api.utils.AuditSecurityEventType;
+
+import java.util.Date;
+
+@Data
+@Builder
+public class SecurityAuditLogDTO {
+
+	private Integer id;
+
+	private AuditSecurityEventType eventType;
+
+	private String username;
+
+	private String userUuid;
+
+	private Date eventTime;
+
+	private String ipAddress;
+
+	private String userAgent;
+
+	private String sessionId;
+
+	private String details;
+
+}

api/src/main/java/org/openmrs/module/auditlogweb/api/dto/SecurityLogResponseDTO.java

@@ -0,0 +1,31 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at http://mozilla.org/MPL/2.0/. OpenMRS is also distributed under
+ * the terms of the Healthcare Disclaimer located at http://openmrs.org/license.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+package org.openmrs.module.auditlogweb.api.dto;
+
+import lombok.Builder;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+@Builder
+public class SecurityLogResponseDTO {
+
+	private long totalLogs;
+
+	private int currentLogs;
+
+	private int totalPages;
+
+	private int currentPage;
+
+	private List<SecurityAuditLogDTO> securityAuditLogs;
+
+}

api/src/main/java/org/openmrs/module/auditlogweb/api/impl/AuditServiceImpl.java

@@ -387,8 +387,13 @@ public AuditSecurityEvent getSecurityEventById(Integer eventId) {
 	}
 
 	@Override
-	public List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int limit) {
-		return auditDao.getRelatedSecurityEvents(sessionId, limit);
+	public List<AuditSecurityEvent> getRelatedSecurityEvents(String sessionId, int page, int size) {
+		return auditDao.getRelatedSecurityEvents(sessionId, page, size);
+	}
+
+	@Override
+	public long countRelatedSecurityEvents(String sessionId) {
+		return auditDao.countRelatedSecurityEvents(sessionId);
 	}
 
 	private Object fetchPreviousRevision(AuditEntity<?> entity, Object currentEntity) {

api/src/test/java/org/openmrs/module/auditlogweb/api/dao/AuditDaoTest.java

@@ -580,30 +580,45 @@ void shouldReturnRelatedSecurityEvents_WhenSessionIdProvided() {
 
 		when(session.createQuery(anyString(), eq(AuditSecurityEvent.class))).thenReturn(securityEventQuery);
 		when(securityEventQuery.setParameter("sessionId", sessionId)).thenReturn(securityEventQuery);
-		when(securityEventQuery.setMaxResults(5)).thenReturn(securityEventQuery);
+		when(securityEventQuery.setFirstResult(30)).thenReturn(securityEventQuery);
+		when(securityEventQuery.setMaxResults(2)).thenReturn(securityEventQuery);
 		when(securityEventQuery.getResultList()).thenReturn(Arrays.asList(e1, e2));
 
-		List<AuditSecurityEvent> result = auditDao.getRelatedSecurityEvents(sessionId, 5);
+		List<AuditSecurityEvent> result = auditDao.getRelatedSecurityEvents(sessionId, 15, 2);
 
 		assertNotNull(result);
 		assertThat(result, hasSize(2));
 		verify(securityEventQuery).setParameter("sessionId", sessionId);
-		verify(securityEventQuery).setMaxResults(5);
+		verify(securityEventQuery).setFirstResult(30);
+		verify(securityEventQuery).setMaxResults(2);
 	}
 
 	@Test
 	void shouldReturnEmptyList_WhenNoRelatedSecurityEventsFound() {
 		when(session.createQuery(anyString(), eq(AuditSecurityEvent.class))).thenReturn(securityEventQuery);
 		when(securityEventQuery.setParameter(anyString(), anyString())).thenReturn(securityEventQuery);
+		when(securityEventQuery.setFirstResult(0)).thenReturn(securityEventQuery);
 		when(securityEventQuery.setMaxResults(anyInt())).thenReturn(securityEventQuery);
 		when(securityEventQuery.getResultList()).thenReturn(Collections.emptyList());
 
-		List<AuditSecurityEvent> result = auditDao.getRelatedSecurityEvents("sess-ghost", 10);
+		List<AuditSecurityEvent> result = auditDao.getRelatedSecurityEvents("sess-ghost", 0, 10);
 
 		assertNotNull(result);
 		assertThat(result, empty());
 	}
 
+	@Test
+	void shouldReturnRelatedSecurityEventsCount() {
+		when(session.createQuery(anyString(), eq(Long.class))).thenReturn(countQuery);
+		when(countQuery.setParameter(eq("sessionId"), eq("session-123"))).thenReturn(countQuery);
+		when(countQuery.uniqueResult()).thenReturn(10L);
+
+		long count = auditDao.countRelatedSecurityEvents("session-123");
+
+		assertThat(count, is(10L));
+		verify(countQuery).setParameter("sessionId", "session-123");
+	}
+
 	@Test
 	void shouldBindUnknownEventType_WhenGivenSecurityEventIsInvalid() {
 		when(session.createQuery(anyString(), eq(AuditSecurityEvent.class))).thenReturn(securityEventQuery);

api/src/test/java/org/openmrs/module/auditlogweb/api/impl/AuditServiceImplTest.java

@@ -397,17 +397,25 @@ void shouldReturnRelatedSecurityEvents() {
 		AuditSecurityEvent relatedSecurityEvent2 = AuditSecurityEvent.builder()
 		        .eventType(AuditSecurityEventType.LOGIN_SUCCESS).eventTime(new Date()).sessionId("session-123").build();
 
-		when(auditDao.getRelatedSecurityEvents("session-123", 2))
+		when(auditDao.getRelatedSecurityEvents("session-123", 0, 2))
 		        .thenReturn(Arrays.asList(relatedSecurityEvent1, relatedSecurityEvent2));
 
-		List<AuditSecurityEvent> result = auditService.getRelatedSecurityEvents("session-123", 2);
+		List<AuditSecurityEvent> result = auditService.getRelatedSecurityEvents("session-123", 0, 2);
 
 		assertNotNull(result);
 		assertEquals(2, result.size());
 		assertEquals(relatedSecurityEvent1, result.get(0));
 		assertEquals(relatedSecurityEvent2, result.get(1));
 	}
 
+	@Test
+	void shouldCountRelatedSecurityEvents() {
+		when(auditDao.countRelatedSecurityEvents("session-123")).thenReturn(10L);
+
+		long count = auditService.countRelatedSecurityEvents("session-123");
+		assertEquals(10L, count);
+	}
+
 	public static class TestEntity {
 
 		private Integer id;

omod/src/main/java/org/openmrs/module/auditlogweb/rest/ReadAuditRestController.java

@@ -81,7 +81,7 @@ public ReadAuditLogResponseDTO fetchReadAudits(@RequestParam(value = "logId", re
 
 	}
 
-	@GetMapping("/releatedAudits")
+	@GetMapping("/relatedAudits")
 	public ReadAuditLogResponseDTO fetchRelatedAudits(@RequestParam(value = "sessionId") String sessionId,
 	        @RequestParam(value = "page", defaultValue = "0") int page,
 	        @RequestParam(value = "size", defaultValue = "15") int size) {

omod/src/main/java/org/openmrs/module/auditlogweb/rest/SecurityAuditRestController.java

@@ -0,0 +1,135 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at http://mozilla.org/MPL/2.0/. OpenMRS is also distributed under
+ * the terms of the Healthcare Disclaimer located at http://openmrs.org/license.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+package org.openmrs.module.auditlogweb.rest;
+
+import lombok.RequiredArgsConstructor;
+import org.openmrs.module.auditlogweb.AuditSecurityEvent;
+import org.openmrs.module.auditlogweb.api.AuditService;
+import org.openmrs.module.auditlogweb.api.dto.SecurityAuditLogDTO;
+import org.openmrs.module.auditlogweb.api.dto.SecurityLogResponseDTO;
+import org.openmrs.module.auditlogweb.api.utils.AuditSecurityEventType;
+import org.openmrs.module.auditlogweb.api.utils.UtilClass;
+import org.openmrs.module.webservices.rest.web.RestConstants;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+
+@RestController
+@RequestMapping("/rest/" + RestConstants.VERSION_1 + "/securityauditlogs")
+@RequiredArgsConstructor
+public class SecurityAuditRestController {
+
+	private final AuditService auditService;
+
+	@GetMapping
+	public SecurityLogResponseDTO fetchSecurityAudits(@RequestParam(value = "logId", required = false) Integer logId,
+	        @RequestParam(value = "eventType", required = false) String eventType,
+	        @RequestParam(value = "username", required = false) String username,
+	        @RequestParam(value = "startDate", required = false) String startDate,
+	        @RequestParam(value = "endDate", required = false) String endDate,
+	        @RequestParam(value = "page", defaultValue = "0") int page,
+	        @RequestParam(value = "size", defaultValue = "15") int size) {
+
+		if (logId != null && logId <= 0) {
+			throw new IllegalArgumentException("Please provide a valid log ID");
+		}
+
+		if (eventType != null && !eventType.trim().isEmpty()) {
+			AuditSecurityEventType parsed = AuditSecurityEventType.fromName(eventType);
+			if (parsed == null || parsed == AuditSecurityEventType.UNKNOWN) {
+				throw new IllegalArgumentException("Invalid eventType " + eventType);
+			}
+		}
+
+		if (logId != null) {
+			AuditSecurityEvent securityEvent = auditService.getSecurityEventById(logId);
+			if (securityEvent == null) {
+				throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No log found for this logId");
+			}
+			List<SecurityAuditLogDTO> securityAuditLogsDTO = mapToDTOs(Collections.singletonList(securityEvent));
+			return SecurityLogResponseDTO.builder().totalLogs(1).currentLogs(1).securityAuditLogs(securityAuditLogsDTO)
+			        .totalPages(1).currentPage(0).build();
+		}
+
+		if (page < 0) {
+			page = 0;
+		}
+		if (size <= 0) {
+			size = 15;
+		}
+
+		Date start = UtilClass.parseDate(startDate, false);
+		Date end = UtilClass.parseDate(endDate, true);
+
+		List<AuditSecurityEvent> securityEvents = auditService.getSecurityEvents(eventType, username, start, end, page,
+		    size);
+		long totalCount = auditService.countSecurityEvents(eventType, username, start, end);
+		int totalPages = UtilClass.computeTotalPages(totalCount, size);
+
+		List<SecurityAuditLogDTO> securityAuditLogsDTO = mapToDTOs(securityEvents);
+
+		return SecurityLogResponseDTO.builder().totalLogs(totalCount).currentLogs(securityAuditLogsDTO.size())
+		        .totalPages(totalPages).currentPage(page).securityAuditLogs(securityAuditLogsDTO).build();
+	}
+
+	@GetMapping("/relatedAudits")
+	public SecurityLogResponseDTO fetchRelatedAudits(@RequestParam(value = "sessionId") String sessionId,
+	        @RequestParam(value = "page", defaultValue = "0") int page,
+	        @RequestParam(value = "size", defaultValue = "15") int size) {
+
+		if (sessionId == null || sessionId.isEmpty()) {
+			throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid session id");
+		}
+
+		if (page < 0) {
+			page = 0;
+		}
+		if (size <= 0) {
+			size = 15;
+		}
+
+		List<AuditSecurityEvent> allRelated = auditService.getRelatedSecurityEvents(sessionId, page, size);
+		long totalCount = auditService.countRelatedSecurityEvents(sessionId);
+		int totalPages = UtilClass.computeTotalPages(totalCount, size);
+
+		List<SecurityAuditLogDTO> securityAuditLogsDTO = mapToDTOs(allRelated);
+
+		return SecurityLogResponseDTO.builder().totalLogs(totalCount).currentLogs(securityAuditLogsDTO.size())
+		        .totalPages(totalPages).currentPage(page).securityAuditLogs(securityAuditLogsDTO).build();
+	}
+
+	private SecurityAuditLogDTO mapToDTO(AuditSecurityEvent event) {
+		if (event == null) {
+			return null;
+		}
+		return SecurityAuditLogDTO.builder().id(event.getId()).eventType(event.getEventType()).username(event.getUsername())
+		        .userUuid(event.getUserUuid()).eventTime(event.getEventTime()).ipAddress(event.getIpAddress())
+		        .userAgent(event.getUserAgent()).sessionId(event.getSessionId()).details(event.getDetails()).build();
+	}
+
+	private List<SecurityAuditLogDTO> mapToDTOs(List<AuditSecurityEvent> events) {
+		if (events == null) {
+			return Collections.emptyList();
+		}
+		List<SecurityAuditLogDTO> dtos = new ArrayList<>(events.size());
+		for (AuditSecurityEvent event : events) {
+			dtos.add(mapToDTO(event));
+		}
+		return dtos;
+	}
+}

omod/src/main/java/org/openmrs/module/auditlogweb/rest/exceptions/RestExceptionHandler.java

@@ -10,6 +10,8 @@
 package org.openmrs.module.auditlogweb.rest.exceptions;
 
 import org.hibernate.ObjectNotFoundException;
+import org.openmrs.api.APIAuthenticationException;
+import org.openmrs.api.context.Context;
 import org.openmrs.module.auditlogweb.api.exception.AuditLogUnavailableException;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -84,6 +86,14 @@ public ResponseEntity<Map<String, String>> handleAuditLogUnavailable(AuditLogUna
 		return buildResponseEntity("Audit Log Unavailable", ex.getMessage(), HttpStatus.SERVICE_UNAVAILABLE);
 	}
 
+	@ExceptionHandler(APIAuthenticationException.class)
+	public ResponseEntity<Map<String, String>> handleAPIAuthException(APIAuthenticationException ex) {
+		if (Context.isAuthenticated()) {
+			return buildResponseEntity("Forbidden", ex.getMessage(), HttpStatus.FORBIDDEN);
+		}
+		return buildResponseEntity("Unauthorized", ex.getMessage(), HttpStatus.UNAUTHORIZED);
+	}
+
 	@ExceptionHandler(Exception.class)
 	public ResponseEntity<Map<String, String>> handleGeneralError(Exception ex) {
 		return buildResponseEntity("Internal Server Error", "An unexpected error occurred",