feat(auditlog): write organization events to audit_log

pkg/account/api/account.go

@@ -95,6 +95,7 @@ func (s *AccountService) CreateAccountV2(
 				CreatedAt:        account.CreatedAt,
 				UpdatedAt:        account.UpdatedAt,
 			},
+			account.OrganizationId,
 			account,
 			nil,
 		)
@@ -105,7 +106,7 @@ func (s *AccountService) CreateAccountV2(
 		if err != nil {
 			return err
 		}
-		return s.adminAuditLogStorage.CreateAdminAuditLog(
+		return s.auditLogStorage.CreateAuditLog(
 			contextWithTx,
 			domainauditlog.NewAuditLog(createAccountEvent, storage.AdminEnvironmentID),
 		)
@@ -515,6 +516,7 @@ func (s *AccountService) updateAccountV2NoCommandMysql(
 				Email:          updated.Email,
 				OrganizationId: updated.OrganizationId,
 			},
+			updated.OrganizationId,
 			updated,
 			account,
 		)
@@ -526,7 +528,7 @@ func (s *AccountService) updateAccountV2NoCommandMysql(
 		if err != nil {
 			return err
 		}
-		return s.adminAuditLogStorage.CreateAdminAuditLog(
+		return s.auditLogStorage.CreateAuditLog(
 			contextWithTx,
 			domainauditlog.NewAuditLog(updateAccountV2Event, storage.AdminEnvironmentID),
 		)
@@ -585,6 +587,7 @@ func (s *AccountService) DeleteAccountV2(
 				Email:          account.Email,
 				OrganizationId: account.OrganizationId,
 			},
+			account.OrganizationId,
 			nil,     // Current state: entity no longer exists
 			account, // Previous state: what was deleted
 		)

pkg/account/api/account_test.go

@@ -206,7 +206,7 @@ func TestCreateAccountV2MySQL(t *testing.T) {
 					gomock.Any(), gomock.Any(),
 				).Return(nil)
 
-				s.adminAuditLogStorage.(*alstoragemock.MockAdminAuditLogStorage).EXPECT().CreateAdminAuditLog(
+				s.auditLogStorage.(*alstoragemock.MockAuditLogStorage).EXPECT().CreateAuditLog(
 					gomock.Any(), gomock.Any(),
 				).Return(nil)
 
@@ -467,7 +467,7 @@ func TestUpdateAccountV2MySQL(t *testing.T) {
 					require.NoError(t, err)
 				}).Return(nil)
 
-				s.adminAuditLogStorage.(*alstoragemock.MockAdminAuditLogStorage).EXPECT().CreateAdminAuditLog(
+				s.auditLogStorage.(*alstoragemock.MockAuditLogStorage).EXPECT().CreateAuditLog(
 					gomock.Any(), gomock.Any(),
 				).Return(nil)
 			},
@@ -651,7 +651,7 @@ func TestEnableAccountV2MySQL(t *testing.T) {
 					require.NoError(t, err)
 				}).Return(nil)
 
-				s.adminAuditLogStorage.(*alstoragemock.MockAdminAuditLogStorage).EXPECT().CreateAdminAuditLog(
+				s.auditLogStorage.(*alstoragemock.MockAuditLogStorage).EXPECT().CreateAuditLog(
 					gomock.Any(), gomock.Any(),
 				).Return(nil)
 			},
@@ -839,7 +839,7 @@ func TestDisableAccountV2MySQL(t *testing.T) {
 					require.NoError(t, err)
 				}).Return(nil)
 
-				s.adminAuditLogStorage.(*alstoragemock.MockAdminAuditLogStorage).EXPECT().CreateAdminAuditLog(
+				s.auditLogStorage.(*alstoragemock.MockAuditLogStorage).EXPECT().CreateAuditLog(
 					gomock.Any(), gomock.Any(),
 				).Return(nil)
 			},

pkg/account/api/api.go

@@ -59,15 +59,15 @@ func WithLogger(logger *zap.Logger) Option {
 }
 
 type AccountService struct {
-	environmentClient    environmentclient.Client
-	dbClient             database.Client
-	accountStorage       v2.AccountStorage
-	tagStorage           tagstorage.TagStorage
-	teamStorage          teamstorage.TeamStorage
-	adminAuditLogStorage auditlogstorage.AdminAuditLogStorage
-	publisher            publisher.Publisher
-	opts                 *options
-	logger               *zap.Logger
+	environmentClient environmentclient.Client
+	dbClient          database.Client
+	accountStorage    v2.AccountStorage
+	tagStorage        tagstorage.TagStorage
+	teamStorage       teamstorage.TeamStorage
+	auditLogStorage   auditlogstorage.AuditLogStorage
+	publisher         publisher.Publisher
+	opts              *options
+	logger            *zap.Logger
 }
 
 func NewAccountService(
@@ -76,7 +76,7 @@ func NewAccountService(
 	accountStorage v2.AccountStorage,
 	tagStorage tagstorage.TagStorage,
 	teamStorage teamstorage.TeamStorage,
-	adminAuditLogStorage auditlogstorage.AdminAuditLogStorage,
+	auditLogStorage auditlogstorage.AuditLogStorage,
 	publisher publisher.Publisher,
 	opts ...Option,
 ) *AccountService {
@@ -85,15 +85,15 @@ func NewAccountService(
 		opt(&options)
 	}
 	return &AccountService{
-		environmentClient:    e,
-		dbClient:             dbClient,
-		accountStorage:       accountStorage,
-		tagStorage:           tagStorage,
-		teamStorage:          teamStorage,
-		adminAuditLogStorage: adminAuditLogStorage,
-		publisher:            publisher,
-		opts:                 &options,
-		logger:               options.logger.Named("api"),
+		environmentClient: e,
+		dbClient:          dbClient,
+		accountStorage:    accountStorage,
+		tagStorage:        tagStorage,
+		teamStorage:       teamStorage,
+		auditLogStorage:   auditLogStorage,
+		publisher:         publisher,
+		opts:              &options,
+		logger:            options.logger.Named("api"),
 	}
 }
 

pkg/account/api/api_test.go

@@ -56,13 +56,13 @@ func createAccountService(t *testing.T, mockController *gomock.Controller, db st
 	t.Helper()
 	logger := zap.NewNop()
 	return &AccountService{
-		environmentClient:    ecmock.NewMockClient(mockController),
-		dbClient:             dbmock.NewMockClient(mockController),
-		accountStorage:       storagemock.NewMockAccountStorage(mockController),
-		teamStorage:          teamstoragemock.NewMockTeamStorage(mockController),
-		adminAuditLogStorage: auditlogstoragemock.NewMockAdminAuditLogStorage(mockController),
-		publisher:            publishermock.NewMockPublisher(mockController),
-		logger:               logger.Named("api"),
+		environmentClient: ecmock.NewMockClient(mockController),
+		dbClient:          dbmock.NewMockClient(mockController),
+		accountStorage:    storagemock.NewMockAccountStorage(mockController),
+		teamStorage:       teamstoragemock.NewMockTeamStorage(mockController),
+		auditLogStorage:   auditlogstoragemock.NewMockAuditLogStorage(mockController),
+		publisher:         publishermock.NewMockPublisher(mockController),
+		logger:            logger.Named("api"),
 	}
 }
 

pkg/account/command/account_v2.go

@@ -166,6 +166,7 @@ func (h *accountV2CommandHandler) send(
 		h.account.Email,
 		eventType,
 		event,
+		h.account.OrganizationId,
 		h.account.AccountV2,
 		prev,
 	)

pkg/auditlog/domain/auditlog.go

@@ -21,7 +21,8 @@ import (
 
 type AuditLog struct {
 	*proto.AuditLog
-	EnvironmentId string
+	EnvironmentId  string
+	OrganizationId string
 }
 
 func NewAuditLog(event *domainevent.Event, environmentId string) *AuditLog {
@@ -38,7 +39,8 @@ func NewAuditLog(event *domainevent.Event, environmentId string) *AuditLog {
 			PreviousEntityData: event.PreviousEntityData,
 			Options:            event.Options,
 		},
-		EnvironmentId: environmentId,
+		EnvironmentId:  environmentId,
+		OrganizationId: event.OrganizationId,
 	}
 	// On failure the affected field is left empty rather than persisting a raw key.
 	_ = ObfuscateAPIKey(auditlog.AuditLog)

pkg/auditlog/storage/v2/mysql/audit_log.go

@@ -93,7 +93,7 @@ func (s *auditLogStorage) CreateAuditLogs(ctx context.Context, auditLogs []*doma
 		} else {
 			query.WriteString(insertAuditLogsV2SQL)
 		}
-		query.WriteString(" (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")
+		query.WriteString(" (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")
 		args = append(
 			args,
 			al.Id,
@@ -105,6 +105,7 @@ func (s *auditLogStorage) CreateAuditLogs(ctx context.Context, auditLogs []*doma
 			mysqlstorage.JSONObject{Val: al.Editor},
 			mysqlstorage.JSONObject{Val: al.Options},
 			al.EnvironmentId,
+			al.OrganizationId,
 			al.EntityData,
 			al.PreviousEntityData,
 		)
@@ -132,6 +133,7 @@ func (s *auditLogStorage) CreateAuditLog(ctx context.Context, auditLog *domain.A
 		mysqlstorage.JSONObject{Val: auditLog.Editor},
 		mysqlstorage.JSONObject{Val: auditLog.Options},
 		auditLog.EnvironmentId,
+		auditLog.OrganizationId,
 		auditLog.EntityData,
 		auditLog.PreviousEntityData,
 	)

pkg/auditlog/storage/v2/mysql/sql/auditlog/insert_audit_log_v2.sql

@@ -8,6 +8,7 @@ INSERT INTO audit_log (
     editor,
     options,
     environment_id,
+    organization_id,
     entity_data,
     previous_entity_data
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)

pkg/auditlog/storage/v2/mysql/sql/auditlog/insert_audit_logs_v2.sql

@@ -8,6 +8,7 @@ INSERT INTO audit_log (
     editor,
     options,
     environment_id,
+    organization_id,
     entity_data,
     previous_entity_data
 ) VALUES

pkg/auditlog/storage/v2/postgres/audit_log.go

@@ -89,16 +89,16 @@ func (s *auditLogStorage) CreateAuditLogs(ctx context.Context, auditLogs []*doma
 	var query strings.Builder
 	args := []interface{}{}
 	query.WriteString(insertAuditLogsV2SQL)
-	colsPerRow := 11
+	colsPerRow := 12
 	for i, al := range auditLogs {
 		if i != 0 {
 			query.WriteString(",")
 		}
 		base := i*colsPerRow + 1
 		query.WriteString(fmt.Sprintf(
-			" ($%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d)",
+			" ($%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d, $%d)",
 			base, base+1, base+2, base+3, base+4,
-			base+5, base+6, base+7, base+8, base+9, base+10,
+			base+5, base+6, base+7, base+8, base+9, base+10, base+11,
 		))
 		args = append(
 			args,
@@ -111,6 +111,7 @@ func (s *auditLogStorage) CreateAuditLogs(ctx context.Context, auditLogs []*doma
 			pgstorage.JSONObject{Val: al.Editor},
 			pgstorage.JSONObject{Val: al.Options},
 			al.EnvironmentId,
+			al.OrganizationId,
 			al.EntityData,
 			al.PreviousEntityData,
 		)
@@ -138,6 +139,7 @@ func (s *auditLogStorage) CreateAuditLog(ctx context.Context, auditLog *domain.A
 		pgstorage.JSONObject{Val: auditLog.Editor},
 		pgstorage.JSONObject{Val: auditLog.Options},
 		auditLog.EnvironmentId,
+		auditLog.OrganizationId,
 		auditLog.EntityData,
 		auditLog.PreviousEntityData,
 	)

pkg/auditlog/storage/v2/postgres/sql/auditlog/insert_audit_log_v2.sql

@@ -8,6 +8,7 @@ INSERT INTO audit_log (
     editor,
     options,
     environment_id,
+    organization_id,
     entity_data,
     previous_entity_data
-) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)

pkg/auditlog/storage/v2/postgres/sql/auditlog/insert_audit_logs_v2.sql

@@ -8,6 +8,7 @@ INSERT INTO audit_log (
     editor,
     options,
     environment_id,
+    organization_id,
     entity_data,
     previous_entity_data
 ) VALUES

pkg/domainevent/domain/event.go

@@ -52,21 +52,26 @@ func NewEvent(
 ) (*domain.Event, error) {
 	return newEvent(
 		editor, entityType, entityID, eventType, event,
-		environmentID, false, entityData, previousEntityData, opts...)
+		environmentID, "", false, entityData, previousEntityData, opts...)
 }
 
+// NewAdminEvent creates an organization-level event. It is stored in the
+// audit_log table with an empty environment id, scoped by organizationID.
+// System-level entities that belong to no organization pass an empty
+// organizationID.
 func NewAdminEvent(
 	editor *domain.Editor,
 	entityType domain.Event_EntityType,
 	entityID string,
 	eventType domain.Event_Type,
 	event pb.Message,
+	organizationID string,
 	entityData, previousEntityData interface{},
 	opts ...Option,
 ) (*domain.Event, error) {
 	return newEvent(
 		editor, entityType, entityID, eventType, event,
-		storage.AdminEnvironmentID, true, entityData, previousEntityData, opts...)
+		storage.AdminEnvironmentID, organizationID, true, entityData, previousEntityData, opts...)
 }
 
 func newEvent(
@@ -76,6 +81,7 @@ func newEvent(
 	eventType domain.Event_Type,
 	event pb.Message,
 	environmentID string,
+	organizationID string,
 	isAdminEvent bool,
 	entity, previousEntity interface{},
 	opts ...Option,
@@ -117,6 +123,7 @@ func newEvent(
 		Editor:             editor,
 		Data:               buf,
 		EnvironmentId:      environmentID,
+		OrganizationId:     organizationID,
 		IsAdminEvent:       isAdminEvent,
 		EntityData:         string(entityData),
 		PreviousEntityData: string(prevEntityData),

pkg/environment/api/environment_v2.go

@@ -183,6 +183,7 @@ func (s *EnvironmentService) CreateEnvironmentV2(
 				CreatedAt:      newEnvironment.CreatedAt,
 				UpdatedAt:      newEnvironment.UpdatedAt,
 			},
+			newEnvironment.OrganizationId,
 			newEnvironment.EnvironmentV2,
 			nil,
 		)
@@ -288,6 +289,7 @@ func (s *EnvironmentService) UpdateEnvironmentV2(
 				Description:    req.Description,
 				RequireComment: req.RequireComment,
 			},
+			environment.OrganizationId,
 			updated,
 			environment,
 		)
@@ -400,6 +402,7 @@ func (s *EnvironmentService) ArchiveEnvironmentV2(
 				Name:      environment.Name,
 				ProjectId: environment.ProjectId,
 			},
+			environment.OrganizationId,
 			environment,
 			prev,
 		)
@@ -469,6 +472,7 @@ func (s *EnvironmentService) UnarchiveEnvironmentV2(
 				Name:      environment.Name,
 				ProjectId: environment.ProjectId,
 			},
+			environment.OrganizationId,
 			environment,
 			prev,
 		)