refactor(audit): extract audit domain into self-contained module

Move the entire audit subsystem (system audit, API audit, import audit, user lifecycle audit, frontend telemetry) from core into modules/audit/. Core decoupling via interface-based injection: - AuditRecorderInterface replaces SystemAuditService in 10+ core services - UserLifecycleAuditInterface / ImportAuditInterface for specialized flows - NullAuditRecorder fallback when audit module is disabled - ApiBootstrap/ApiResponse use null-safe callable resolvers Module structure (modules/audit/): - Manifest with routes, permissions, scheduler jobs, authorization policy - 9 services, 8 repositories, 6 domain enums, 4 job handlers - 33 page files, 4 JS files, 8 test files, migration scripts, i18n Core cleanup: - OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService surgically cleaned of audit-specific constants - Sidebar template cleared of hardcoded audit navigation - AuditModuleIsolationContractTest ensures no future core→module coupling All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5 clean, architecture contracts verified. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 21:12:49 +01:00
parent 12a837bda9
commit 0c351f6aff
176 changed files with 2157 additions and 834 deletions
--- a/lib/Service/Access/AccessGatewayFactory.php
+++ b/lib/Service/Access/AccessGatewayFactory.php
@@ -3,7 +3,7 @@
 namespace MintyPHP\Service\Access;

 use MintyPHP\Http\SessionStoreInterface;
-use MintyPHP\Service\Audit\AuditServicesFactory;
+use MintyPHP\Service\Audit\AuditRecorderInterface;

 class AccessGatewayFactory
 {
@@ -11,7 +11,7 @@ class AccessGatewayFactory

    public function __construct(
        private readonly AccessRepositoryFactory $accessRepositoryFactory,
-        private readonly AuditServicesFactory $auditServicesFactory,
+        private readonly AuditRecorderInterface $auditRecorder,
        private readonly SessionStoreInterface $sessionStore
    ) {
    }
@@ -22,7 +22,7 @@ class AccessGatewayFactory
            $this->accessRepositoryFactory->createPermissionRepository(),
            $this->accessRepositoryFactory->createRolePermissionRepository(),
            $this->accessRepositoryFactory->createUserRoleRepository(),
-            $this->auditServicesFactory->createSystemAuditService(),
+            $this->auditRecorder,
            $this->sessionStore
        );
    }
--- a/lib/Service/Access/AssignableRoleService.php
+++ b/lib/Service/Access/AssignableRoleService.php
@@ -5,7 +5,7 @@ namespace MintyPHP\Service\Access;
 use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
 use MintyPHP\Repository\Access\RoleRepositoryInterface;
 use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
-use MintyPHP\Service\Audit\SystemAuditService;
+use MintyPHP\Service\Audit\AuditRecorderInterface;

 class AssignableRoleService
 {
@@ -14,7 +14,7 @@ class AssignableRoleService
        private readonly UserRoleRepositoryInterface $userRoleRepository,
        private readonly PermissionService $permissionService,
        private readonly RoleRepositoryInterface $roleRepository,
-        private readonly SystemAuditService $systemAuditService
+        private readonly AuditRecorderInterface $systemAuditService
    ) {
    }

--- a/lib/Service/Access/OperationsAuthorizationPolicy.php
+++ b/lib/Service/Access/OperationsAuthorizationPolicy.php
@@ -4,13 +4,7 @@ namespace MintyPHP\Service\Access;

 final class OperationsAuthorizationPolicy implements AuthorizationPolicyInterface
 {
-    public const ABILITY_ADMIN_USER_LIFECYCLE_AUDIT_VIEW = 'ops.admin.user_lifecycle_audit.view';
-    public const ABILITY_ADMIN_USERS_LIFECYCLE_RESTORE = 'ops.admin.users.lifecycle_restore';
-    public const ABILITY_ADMIN_API_AUDIT_VIEW = 'ops.admin.api_audit.view';
-    public const ABILITY_ADMIN_SYSTEM_AUDIT_VIEW = 'ops.admin.system_audit.view';
-    public const ABILITY_ADMIN_SYSTEM_AUDIT_PURGE = 'ops.admin.system_audit.purge';
    public const ABILITY_ADMIN_DOCS_VIEW = 'ops.admin.docs.view';
-    public const ABILITY_ADMIN_IMPORTS_AUDIT_VIEW = 'ops.admin.imports_audit.view';
    public const ABILITY_ADMIN_IMPORTS_VIEW = 'ops.admin.imports.view';
    public const ABILITY_ADMIN_JOBS_RUN_NOW = 'ops.admin.jobs.run_now';
    public const ABILITY_ADMIN_JOBS_VIEW = 'ops.admin.jobs.view';
@@ -49,13 +43,7 @@ final class OperationsAuthorizationPolicy implements AuthorizationPolicyInterfac
    public function supports(string $ability): bool
    {
        return in_array($ability, [
-            self::ABILITY_ADMIN_USER_LIFECYCLE_AUDIT_VIEW,
-            self::ABILITY_ADMIN_USERS_LIFECYCLE_RESTORE,
-            self::ABILITY_ADMIN_API_AUDIT_VIEW,
-            self::ABILITY_ADMIN_SYSTEM_AUDIT_VIEW,
-            self::ABILITY_ADMIN_SYSTEM_AUDIT_PURGE,
            self::ABILITY_ADMIN_DOCS_VIEW,
-            self::ABILITY_ADMIN_IMPORTS_AUDIT_VIEW,
            self::ABILITY_ADMIN_IMPORTS_VIEW,
            self::ABILITY_ADMIN_JOBS_RUN_NOW,
            self::ABILITY_ADMIN_JOBS_VIEW,
@@ -98,13 +86,7 @@ final class OperationsAuthorizationPolicy implements AuthorizationPolicyInterfac
        return match ($ability) {
            self::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS => $this->authorizeUsersCreateCustomFields($actorUserId),
            self::ABILITY_API_TOKENS_SELF_MANAGE => $this->authorizeApiTokensSelfManage($actorUserId),
-            self::ABILITY_ADMIN_USER_LIFECYCLE_AUDIT_VIEW => $this->allowIfHas($actorUserId, PermissionService::USER_LIFECYCLE_AUDIT_VIEW),
-            self::ABILITY_ADMIN_USERS_LIFECYCLE_RESTORE => $this->allowIfHas($actorUserId, PermissionService::USERS_LIFECYCLE_RESTORE),
-            self::ABILITY_ADMIN_API_AUDIT_VIEW => $this->allowIfHas($actorUserId, PermissionService::API_AUDIT_VIEW),
-            self::ABILITY_ADMIN_SYSTEM_AUDIT_VIEW => $this->allowIfHas($actorUserId, PermissionService::SYSTEM_AUDIT_VIEW),
-            self::ABILITY_ADMIN_SYSTEM_AUDIT_PURGE => $this->allowIfHas($actorUserId, PermissionService::SYSTEM_AUDIT_PURGE),
            self::ABILITY_ADMIN_DOCS_VIEW => $this->allowIfHas($actorUserId, PermissionService::DOCS_VIEW),
-            self::ABILITY_ADMIN_IMPORTS_AUDIT_VIEW => $this->allowIfHas($actorUserId, PermissionService::IMPORTS_AUDIT_VIEW),
            self::ABILITY_ADMIN_IMPORTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::IMPORTS_VIEW),
            self::ABILITY_ADMIN_JOBS_RUN_NOW => $this->allowIfHas($actorUserId, PermissionService::JOBS_RUN_NOW),
            self::ABILITY_ADMIN_JOBS_VIEW => $this->allowIfHas($actorUserId, PermissionService::JOBS_VIEW),
--- a/lib/Service/Access/PermissionService.php
+++ b/lib/Service/Access/PermissionService.php
@@ -6,7 +6,7 @@ use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Repository\Access\PermissionRepositoryInterface;
 use MintyPHP\Repository\Access\RolePermissionRepositoryInterface;
 use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
-use MintyPHP\Service\Audit\SystemAuditService;
+use MintyPHP\Service\Audit\AuditRecorderInterface;

 /**
 * Central RBAC permission service — resolves and caches permission keys for users.
@@ -28,7 +28,7 @@ class PermissionService
        private readonly PermissionRepositoryInterface $permissionRepository,
        private readonly RolePermissionRepositoryInterface $rolePermissionRepository,
        private readonly UserRoleRepositoryInterface $userRoleRepository,
-        private readonly SystemAuditService $systemAuditService,
+        private readonly AuditRecorderInterface $systemAuditService,
        private readonly SessionStoreInterface $sessionStore
    ) {
    }
@@ -65,22 +65,16 @@ class PermissionService
    public const SETTINGS_UPDATE = 'settings.update';
    public const TENANT_SCOPE_GLOBAL = 'tenant.scope.global';
    public const IMPORTS_VIEW = 'imports.view';
-    public const IMPORTS_AUDIT_VIEW = 'imports.audit.view';
    public const JOBS_VIEW = 'jobs.view';
    public const JOBS_MANAGE = 'jobs.manage';
    public const JOBS_RUN_NOW = 'jobs.run_now';
-    public const USER_LIFECYCLE_AUDIT_VIEW = 'user_lifecycle_audit.view';
    public const USERS_IMPORT = 'users.import';
    public const USERS_IMPORT_ASSIGNMENTS = 'users.import_assignments';
-    public const USERS_LIFECYCLE_RESTORE = 'users.lifecycle_restore';
    public const CUSTOM_FIELDS_MANAGE = 'custom_fields.manage';
    public const CUSTOM_FIELDS_EDIT_VALUES = 'custom_fields.edit_values';
    public const API_DOCS_VIEW = 'api_docs.view';
    public const DOCS_VIEW = 'docs.view';
    public const MAIL_LOG_VIEW = 'mail_log.view';
-    public const API_AUDIT_VIEW = 'api_audit.view';
-    public const SYSTEM_AUDIT_VIEW = 'system_audit.view';
-    public const SYSTEM_AUDIT_PURGE = 'system_audit.purge';
    public const STATS_VIEW = 'stats.view';
    public const SYSTEM_INFO_VIEW = 'system_info.view';
    public const API_TOKENS_MANAGE = 'api_tokens.manage';
--- a/lib/Service/Access/RoleService.php
+++ b/lib/Service/Access/RoleService.php
@@ -3,7 +3,7 @@
 namespace MintyPHP\Service\Access;

 use MintyPHP\Repository\Access\RoleRepositoryInterface;
-use MintyPHP\Service\Audit\SystemAuditService;
+use MintyPHP\Service\Audit\AuditRecorderInterface;
 use MintyPHP\Service\Directory\DirectorySettingsGateway;

 class RoleService
@@ -11,7 +11,7 @@ class RoleService
    public function __construct(
        private readonly RoleRepositoryInterface $roleRepository,
        private readonly DirectorySettingsGateway $settingsGateway,
-        private readonly SystemAuditService $systemAuditService
+        private readonly AuditRecorderInterface $systemAuditService
    ) {
    }

--- a/lib/Service/Access/UiCapabilityMap.php
+++ b/lib/Service/Access/UiCapabilityMap.php
@@ -24,10 +24,6 @@ final class UiCapabilityMap
        'can_view_api_docs' => OperationsAuthorizationPolicy::ABILITY_ADMIN_API_DOCS_VIEW,
        'can_view_docs' => OperationsAuthorizationPolicy::ABILITY_ADMIN_DOCS_VIEW,
        'can_view_mail_log' => OperationsAuthorizationPolicy::ABILITY_ADMIN_MAIL_LOG_VIEW,
-        'can_view_api_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_API_AUDIT_VIEW,
-        'can_view_system_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_SYSTEM_AUDIT_VIEW,
-        'can_view_imports_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_IMPORTS_AUDIT_VIEW,
-        'can_view_user_lifecycle_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_USER_LIFECYCLE_AUDIT_VIEW,
        'can_view_stats' => OperationsAuthorizationPolicy::ABILITY_ADMIN_STATS_VIEW,
        'can_view_system_info' => OperationsAuthorizationPolicy::ABILITY_ADMIN_SYSTEM_INFO_VIEW,
    ];
@@ -57,29 +53,13 @@ final class UiCapabilityMap
        'can_view_mail_log' => OperationsAuthorizationPolicy::ABILITY_ADMIN_MAIL_LOG_VIEW,
        'can_view_users' => UserAuthorizationPolicy::ABILITY_ADMIN_USERS_VIEW,
        'can_view_tenants' => TenantAuthorizationPolicy::ABILITY_ADMIN_TENANTS_VIEW,
-        'can_view_imports_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_IMPORTS_AUDIT_VIEW,
-        'can_view_system_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_SYSTEM_AUDIT_VIEW,
-        'can_view_user_lifecycle_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_USER_LIFECYCLE_AUDIT_VIEW,
    ];

    /**
     * @var array<string, string>
     */
-    public const PAGE_AUDIT_PURGE = [
+    public const PAGE_JOBS_PURGE = [
        'can_purge' => SettingsAuthorizationPolicy::ABILITY_ADMIN_SETTINGS_UPDATE,
    ];

-    /**
-     * @var array<string, string>
-     */
-    public const PAGE_SYSTEM_AUDIT = [
-        'can_purge_system_audit' => OperationsAuthorizationPolicy::ABILITY_ADMIN_SYSTEM_AUDIT_PURGE,
-    ];
-
-    /**
-     * @var array<string, string>
-     */
-    public const PAGE_USER_LIFECYCLE_VIEW = [
-        'can_restore' => OperationsAuthorizationPolicy::ABILITY_ADMIN_USERS_LIFECYCLE_RESTORE,
-    ];
 }