Auditoria funcionando

backend/app/api/schemas/audit.py

@@ -0,0 +1,109 @@
+"""
+Audit Schemas - ServiceManagerWeb
+
+Schemas Pydantic para endpoints de auditoría
+"""
+
+from pydantic import BaseModel, Field, UUID4
+from typing import Optional, Dict, Any
+from datetime import datetime
+
+
+class AuditLogBase(BaseModel):
+    """Schema base para audit logs."""
+    action: str = Field(..., description="Acción realizada (ej: ticket.create)")
+    resource_type: str = Field(..., description="Tipo de recurso (ticket, user, etc.)")
+    resource_id: Optional[UUID4] = Field(None, description="ID del recurso afectado")
+    extra_metadata: Optional[Dict[str, Any]] = Field(None, description="Metadata adicional", alias="metadata")
+
+
+class AuditLogResponse(AuditLogBase):
+    """
+    Schema de respuesta para audit logs.
+    
+    Incluye toda la información del log con datos del usuario.
+    """
+    id: UUID4
+    tenant_id: UUID4
+    user_id: Optional[UUID4]
+    
+    # Información del usuario (si existe)
+    user_email: Optional[str] = None
+    user_name: Optional[str] = None
+    user_role: Optional[str] = None
+    
+    # Contexto de la acción
+    ip_address: Optional[str]
+    user_agent: Optional[str]
+    correlation_id: Optional[UUID4]
+    
+    # Cambios realizados
+    old_values: Optional[Dict[str, Any]]
+    new_values: Optional[Dict[str, Any]]
+    
+    # Timestamp
+    created_at: datetime
+    
+    # Display friendly
+    action_display: str = Field(description="Acción en formato amigable")
+    
+    class Config:
+        from_attributes = True
+
+
+class AuditLogFilters(BaseModel):
+    """
+    Filtros para consulta de audit logs.
+    
+    Permite filtrar por múltiples criterios.
+    """
+    # Paginación
+    page: int = Field(default=1, ge=1, description="Número de página")
+    per_page: int = Field(default=50, ge=1, le=100, description="Elementos por página")
+    
+    # Filtros
+    user_id: Optional[UUID4] = Field(None, description="Filtrar por usuario")
+    action: Optional[str] = Field(None, description="Filtrar por acción específica")
+    resource_type: Optional[str] = Field(None, description="Filtrar por tipo de recurso")
+    resource_id: Optional[UUID4] = Field(None, description="Filtrar por ID de recurso")
+    
+    # Rango de fechas
+    date_from: Optional[datetime] = Field(None, description="Fecha inicio (ISO 8601)")
+    date_to: Optional[datetime] = Field(None, description="Fecha fin (ISO 8601)")
+    
+    # Búsqueda
+    search: Optional[str] = Field(None, description="Búsqueda en acciones o recursos")
+
+
+class AuditLogStats(BaseModel):
+    """
+    Estadísticas de auditoría.
+    
+    Resumen de actividad del sistema.
+    """
+    total_actions: int = Field(description="Total de acciones registradas")
+    actions_today: int = Field(description="Acciones en las últimas 24 horas")
+    actions_this_week: int = Field(description="Acciones en los últimos 7 días")
+    
+    # Top acciones
+    top_actions: Dict[str, int] = Field(description="Acciones más frecuentes")
+    
+    # Top usuarios
+    top_users: Dict[str, int] = Field(description="Usuarios más activos")
+    
+    # Actividad por tipo de recurso
+    by_resource_type: Dict[str, int] = Field(description="Acciones por tipo de recurso")
+
+
+class AuditLogListResponse(BaseModel):
+    """
+    Respuesta paginada de audit logs.
+    """
+    logs: list[AuditLogResponse]
+    total: int = Field(description="Total de registros")
+    page: int = Field(description="Página actual")
+    per_page: int = Field(description="Registros por página")
+    total_pages: int = Field(description="Total de páginas")
+    
+    class Config:
+        from_attributes = True

backend/app/api/v1/endpoints/audit.py

@@ -0,0 +1,338 @@
+"""
+Audit Endpoints - ServiceManagerWeb
+
+Endpoints para consulta de logs de auditoría.
+Solo accesible por roles: ADMIN, SUPPORT_MANAGER, AUDITOR
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, func, and_, or_, desc
+from sqlalchemy.orm import selectinload
+from typing import Optional, List
+from datetime import datetime, timedelta
+import uuid
+import structlog
+
+from app.core.database import get_db
+from app.api.deps import get_current_user, get_current_tenant
+from app.models.user import User, UserRole
+from app.models.tenant import Tenant
+from app.models.audit import AuditLog
+from app.api.schemas.audit import (
+    AuditLogResponse,
+    AuditLogListResponse,
+    AuditLogFilters,
+    AuditLogStats
+)
+
+router = APIRouter()
+logger = structlog.get_logger(__name__)
+
+
+def require_auditor_role(current_user: User = Depends(get_current_user)) -> User:
+    """
+    Dependency que verifica que el usuario tenga rol de auditor.
+    
+    Solo ADMIN, SUPPORT_MANAGER y AUDITOR pueden ver logs de auditoría.
+    """
+    allowed_roles = [UserRole.ADMIN, UserRole.SUPPORT_MANAGER, UserRole.AUDITOR]
+    
+    if current_user.role not in allowed_roles:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Solo usuarios con rol ADMIN, SUPPORT_MANAGER o AUDITOR pueden acceder a logs de auditoría"
+        )
+    
+    return current_user
+
+
+@router.get("/", response_model=AuditLogListResponse)
+async def get_audit_logs(
+    # Paginación
+    page: int = Query(default=1, ge=1, description="Número de página"),
+    per_page: int = Query(default=50, ge=1, le=100, description="Registros por página"),
+    
+    # Filtros
+    user_id: Optional[uuid.UUID] = Query(None, description="Filtrar por usuario"),
+    action: Optional[str] = Query(None, description="Filtrar por acción"),
+    resource_type: Optional[str] = Query(None, description="Filtrar por tipo de recurso"),
+    resource_id: Optional[uuid.UUID] = Query(None, description="Filtrar por ID de recurso"),
+    date_from: Optional[datetime] = Query(None, description="Fecha desde"),
+    date_to: Optional[datetime] = Query(None, description="Fecha hasta"),
+    search: Optional[str] = Query(None, description="Búsqueda en acción o email"),
+    
+    # Dependencies
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener logs de auditoría con filtros y paginación.
+    
+    **Permisos**: ADMIN, SUPPORT_MANAGER, AUDITOR
+    
+    **Filtros disponibles**:
+    - `user_id`: Acciones de un usuario específico
+    - `action`: Tipo de acción (ej: "ticket.create")
+    - `resource_type`: Tipo de recurso (ej: "ticket")
+    - `resource_id`: ID de recurso específico
+    - `date_from`, `date_to`: Rango de fechas
+    - `search`: Búsqueda en acciones
+    
+    **Retorna**: Lista paginada de audit logs
+    """
+    logger.info(
+        "Fetching audit logs",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        filters={
+            "user_id": str(user_id) if user_id else None,
+            "action": action,
+            "resource_type": resource_type,
+            "page": page
+        }
+    )
+    
+    # Query base - solo logs del tenant actual
+    # Usar selectinload para cargar la relación user (eager loading para async)
+    query = (
+        select(AuditLog)
+        .where(AuditLog.tenant_id == current_tenant.id)
+        .options(selectinload(AuditLog.user))
+    )
+    
+    # Aplicar filtros
+    if user_id:
+        query = query.where(AuditLog.user_id == user_id)
+    
+    if action:
+        query = query.where(AuditLog.action == action)
+    
+    if resource_type:
+        query = query.where(AuditLog.resource_type == resource_type)
+    
+    if resource_id:
+        query = query.where(AuditLog.resource_id == resource_id)
+    
+    if date_from:
+        query = query.where(AuditLog.created_at >= date_from)
+    
+    if date_to:
+        # Agregar 1 día para incluir todo el día
+        date_to_end = date_to + timedelta(days=1)
+        query = query.where(AuditLog.created_at < date_to_end)
+    
+    if search:
+        # Búsqueda en action
+        search_filter = AuditLog.action.ilike(f"%{search}%")
+        query = query.where(search_filter)
+    
+    # Ordenar por fecha descendente (más recientes primero)
+    query = query.order_by(desc(AuditLog.created_at))
+    
+    # Contar total antes de paginar
+    count_query = select(func.count()).select_from(query.subquery())
+    total_result = await db.execute(count_query)
+    total = total_result.scalar() or 0
+    
+    # Aplicar paginación
+    offset = (page - 1) * per_page
+    query = query.offset(offset).limit(per_page)
+    
+    # Ejecutar query
+    result = await db.execute(query)
+    logs = result.scalars().all()
+    
+    # Calcular total de páginas
+    total_pages = (total + per_page - 1) // per_page
+    
+    # Convertir a response schema (agregar info del usuario)
+    logs_response = []
+    for log in logs:
+        log_dict = {
+            "id": log.id,
+            "tenant_id": log.tenant_id,
+            "user_id": log.user_id,
+            "action": log.action,
+            "resource_type": log.resource_type,
+            "resource_id": log.resource_id,
+            "ip_address": str(log.ip_address) if log.ip_address else None,
+            "user_agent": log.user_agent,
+            "correlation_id": log.correlation_id,
+            "old_values": log.old_values,
+            "new_values": log.new_values,
+            "metadata": log.extra_metadata,
+            "created_at": log.created_at,
+            "action_display": log.action_display,
+            "user_email": None,
+            "user_name": None
+        }
+        
+        # Agregar info del usuario si existe
+        if log.user:
+            log_dict["user_email"] = log.user.email
+            log_dict["user_name"] = log.user.full_name
+            log_dict["user_role"] = log.user.role.value if hasattr(log.user.role, 'value') else str(log.user.role)
+        
+        logs_response.append(AuditLogResponse(**log_dict))
+    
+    return AuditLogListResponse(
+        logs=logs_response,
+        total=total,
+        page=page,
+        per_page=per_page,
+        total_pages=total_pages
+    )
+
+
+@router.get("/stats", response_model=AuditLogStats)
+async def get_audit_stats(
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener estadísticas de auditoría del tenant.
+    
+    **Permisos**: ADMIN, SUPPORT_MANAGER, AUDITOR
+    
+    **Retorna**: Estadísticas de actividad
+    """
+    logger.info(
+        "Fetching audit stats",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id)
+    )
+    
+    now = datetime.utcnow()
+    
+    # Total de acciones
+    total_query = select(func.count()).select_from(AuditLog).where(
+        AuditLog.tenant_id == current_tenant.id
+    )
+    total_result = await db.execute(total_query)
+    total_actions = total_result.scalar() or 0
+    
+    # Acciones hoy (últimas 24 horas)
+    today_start = now - timedelta(days=1)
+    today_query = select(func.count()).select_from(AuditLog).where(
+        and_(
+            AuditLog.tenant_id == current_tenant.id,
+            AuditLog.created_at >= today_start
+        )
+    )
+    today_result = await db.execute(today_query)
+    actions_today = today_result.scalar() or 0
+    
+    # Acciones esta semana (últimos 7 días)
+    week_start = now - timedelta(days=7)
+    week_query = select(func.count()).select_from(AuditLog).where(
+        and_(
+            AuditLog.tenant_id == current_tenant.id,
+            AuditLog.created_at >= week_start
+        )
+    )
+    week_result = await db.execute(week_query)
+    actions_this_week = week_result.scalar() or 0
+    
+    # Top 5 acciones más frecuentes
+    top_actions_query = select(
+        AuditLog.action,
+        func.count(AuditLog.id).label('count')
+    ).where(
+        AuditLog.tenant_id == current_tenant.id
+    ).group_by(
+        AuditLog.action
+    ).order_by(
+        desc('count')
+    ).limit(5)
+    
+    top_actions_result = await db.execute(top_actions_query)
+    top_actions = {row.action: row.count for row in top_actions_result}
+    
+    # Acciones por tipo de recurso
+    by_resource_query = select(
+        AuditLog.resource_type,
+        func.count(AuditLog.id).label('count')
+    ).where(
+        AuditLog.tenant_id == current_tenant.id
+    ).group_by(
+        AuditLog.resource_type
+    ).order_by(
+        desc('count')
+    )
+    
+    by_resource_result = await db.execute(by_resource_query)
+    by_resource_type = {row.resource_type: row.count for row in by_resource_result}
+    
+    # Top usuarios (necesitamos hacer join - simplificado por ahora)
+    # En producción podrías hacer un join con users para obtener nombres
+    top_users = {}  # Placeholder - implementar con join si es necesario
+    
+    return AuditLogStats(
+        total_actions=total_actions,
+        actions_today=actions_today,
+        actions_this_week=actions_this_week,
+        top_actions=top_actions,
+        top_users=top_users,
+        by_resource_type=by_resource_type
+    )
+
+
+@router.get("/{log_id}", response_model=AuditLogResponse)
+async def get_audit_log_detail(
+    log_id: uuid.UUID,
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener detalle de un audit log específico.
+    
+    **Permisos**: ADMIN, SUPPORT_MANAGER, AUDITOR
+    
+    **Retorna**: Detalle completo del audit log
+    """
+    # Buscar el log
+    query = select(AuditLog).where(
+        and_(
+            AuditLog.id == log_id,
+            AuditLog.tenant_id == current_tenant.id
+        )
+    )
+    
+    result = await db.execute(query)
+    log = result.scalar_one_or_none()
+    
+    if not log:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Audit log {log_id} no encontrado"
+        )
+    
+    # Convertir a response
+    log_dict = {
+        "id": log.id,
+        "tenant_id": log.tenant_id,
+        "user_id": log.user_id,
+        "action": log.action,
+        "resource_type": log.resource_type,
+        "resource_id": log.resource_id,
+        "ip_address": str(log.ip_address) if log.ip_address else None,
+        "user_agent": log.user_agent,
+        "correlation_id": log.correlation_id,
+        "old_values": log.old_values,
+        "new_values": log.new_values,
+        "metadata": log.extra_metadata,
+        "created_at": log.created_at,
+        "action_display": log.action_display,
+        "user_email": None,
+        "user_name": None
+    }
+    
+    if log.user:
+        log_dict["user_email"] = log.user.email
+        log_dict["user_name"] = log.user.full_name
+    
+    return AuditLogResponse(**log_dict)

backend/app/api/v1/endpoints/auth.py

@@ -4,13 +4,14 @@ Authentication Endpoints - ServiceManagerWeb
 Endpoints para autenticación y autorización
 """
 
-from fastapi import APIRouter, HTTPException, status, Depends
+from fastapi import APIRouter, HTTPException, status, Depends, Request
 from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 from sqlalchemy.orm import selectinload
 from pydantic import BaseModel, EmailStr
 from typing import Optional
+from datetime import datetime  # Para actualizar last_login
 import structlog
 
 from app.core.database import get_db
@@ -18,6 +19,8 @@ from app.core.security import security
 from app.core.config import get_settings
 from app.models.user import User
 from app.models.tenant import Tenant
+from app.services.audit_service import AuditService  # Servicio de auditoría
+from app.services.token_service import TokenService  # Servicio de tokens
 
 router = APIRouter()
 logger = structlog.get_logger(__name__)
@@ -67,13 +70,17 @@ class TokenResponse(BaseModel):
 @router.post("/login", response_model=LoginResponse)
 async def login(
     login_data: LoginRequest,
+    request: Request,  # Agregar Request para capturar IP y user agent
     db: AsyncSession = Depends(get_db)
 ):
     """
     Authenticate user and return access/refresh tokens.
     
+    **Auditoría**: Registra login exitoso y fallido en audit_logs
+    
     Args:
         login_data: Login credentials
+        request: FastAPI Request (para auditoría)
         db: Database session
         
     Returns:
@@ -99,6 +106,24 @@ async def login(
             "Login failed - invalid credentials",
             email=login_data.email
         )
+        
+        # 🔍 AUDITORÍA: Registrar intento fallido
+        if user:  # Solo si el usuario existe (password incorrecto)
+            await AuditService.log(
+                db=db,
+                tenant_id=user.tenant_id,
+                user_id=None,  # NULL porque aún no autenticado
+                action="user.login_failed",
+                resource_type="user",
+                resource_id=user.id,
+                metadata={
+                    "email": login_data.email,
+                    "reason": "invalid_password"
+                },
+                request=request
+            )
+            await db.commit()  # Commit del audit log
+        
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Credenciales inválidas"
@@ -110,11 +135,31 @@ async def login(
             "Login failed - user inactive",
             email=login_data.email
         )
+        
+        # 🔍 AUDITORÍA: Registrar intento con usuario inactivo
+        await AuditService.log(
+            db=db,
+            tenant_id=user.tenant_id,
+            user_id=None,
+            action="user.login_failed",
+            resource_type="user",
+            resource_id=user.id,
+            metadata={
+                "email": login_data.email,
+                "reason": "user_inactive"
+            },
+            request=request
+        )
+        await db.commit()
+        
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Usuario inactivo"
         )
     
+    # Actualizar último login
+    user.last_login = datetime.utcnow()
+    
     # Create tokens
     token_data = {
         "sub": str(user.id),
@@ -126,6 +171,62 @@ async def login(
     access_token = security.create_access_token(token_data)
     refresh_token = security.create_refresh_token(token_data)
     
+    # Extraer información del dispositivo para rastreo
+    user_agent = request.headers.get("user-agent")
+    client_ip = request.client.host if request.client else None
+    
+    # device_id: El frontend puede enviarlo en el futuro como header
+    device_id = request.headers.get("x-device-id")  # Opcional
+    
+    # device_name: Simplificado del user-agent (ej: "Chrome en Windows")
+    device_name = None
+    if user_agent:
+        # Parseo básico para obtener un nombre legible
+        if "Chrome" in user_agent:
+            device_name = "Chrome"
+        elif "Firefox" in user_agent:
+            device_name = "Firefox"
+        elif "Safari" in user_agent:
+            device_name = "Safari"
+        elif "Edge" in user_agent:
+            device_name = "Edge"
+        else:
+            device_name = "Unknown Browser"
+            
+        # Agregar OS
+        if "Windows" in user_agent:
+            device_name += " en Windows"
+        elif "Macintosh" in user_agent or "Mac OS" in user_agent:
+            device_name += " en macOS"
+        elif "Linux" in user_agent:
+            device_name += " en Linux"
+        elif "Android" in user_agent:
+            device_name += " en Android"
+        elif "iPhone" in user_agent or "iPad" in user_agent:
+            device_name += " en iOS"
+    
+    # Persistir refresh token en BD con tracking completo
+    await TokenService.create_refresh_token(
+        db=db,
+        user=user,
+        refresh_token=refresh_token,
+        device_id=device_id,
+        device_name=device_name,
+        user_agent=user_agent,
+        ip_address=client_ip
+    )
+    
+    # 🔍 AUDITORÍA: Registrar login exitoso
+    await AuditService.log_login(
+        db=db,
+        user=user,
+        request=request,
+        success=True
+    )
+    
+    # Commit de todos los cambios (last_login + refresh token + audit log)
+    await db.commit()
+    
     logger.info(
         "Login successful",
         email=login_data.email,
@@ -159,6 +260,9 @@ async def refresh_token(
     """
     Refresh access token using refresh token.
     
+    Verifica el JWT, valida en BD que no esté revocado/expirado,
+    actualiza estadísticas de uso y genera nuevo access token.
+    
     Args:
         refresh_data: Refresh token data
         db: Database session
@@ -171,18 +275,26 @@ async def refresh_token(
     """
     logger.info("Token refresh attempt")
     
-    # Verify refresh token
+    # 1. Verify refresh token JWT signature
     payload = security.verify_token(refresh_data.refresh_token)
     if not payload or payload.get("type") != "refresh":
-        logger.warning("Token refresh failed - invalid token")
+        logger.warning("Token refresh failed - invalid JWT")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid refresh token"
         )
     
-    # TODO: Check if refresh token exists in database and is not revoked
+    # 2. Verificar que el token exista en BD y no esté revocado/expirado
+    #    También actualiza last_used_at y usage_count automáticamente
+    db_token = await TokenService.verify_refresh_token(db, refresh_data.refresh_token)
+    if not db_token:
+        logger.warning("Token refresh failed - token not found, revoked or expired")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or revoked refresh token"
+        )
     
-    # Create new access token
+    # 3. Create new access token
     token_data = {
         "sub": payload["sub"],
         "email": payload["email"],
@@ -192,7 +304,15 @@ async def refresh_token(
     
     access_token = security.create_access_token(token_data)
     
-    logger.info("Token refresh successful", user_id=payload["sub"])
+    # 4. Commit actualización de estadísticas de uso
+    await db.commit()
+    
+    logger.info(
+        "Token refresh successful",
+        user_id=payload["sub"],
+        token_id=str(db_token.id),
+        usage_count=db_token.usage_count
+    )
     
     return TokenResponse(
         access_token=access_token,
@@ -206,14 +326,17 @@ async def logout(
     db: AsyncSession = Depends(get_db)
 ):
     """
-    Logout user and revoke refresh token.
+    Logout user and revoke all refresh tokens.
+    
+    Revoca todos los tokens del usuario (logout en todos los dispositivos)
+    y registra quién ejecutó la revocación para auditoría.
     
     Args:
         token: Access token
         db: Database session
         
     Returns:
-        Success message
+        Success message with count of revoked tokens
     """
     logger.info("Logout attempt")
     
@@ -225,11 +348,31 @@ async def logout(
             detail="Invalid token"
         )
     
-    # TODO: Revoke refresh token in database
+    # Extraer user_id del token
+    user_id_str = payload.get("sub")
+    if not user_id_str:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token payload"
+        )
     
-    logger.info("Logout successful", user_id=payload["sub"])
+    user_id = uuid.UUID(user_id_str)
     
-    return {"message": "Successfully logged out"}
+    # Revocar todos los tokens del usuario con auditoría de quién lo revocó
+    count = await TokenService.revoke_all_user_tokens(
+        db=db,
+        user_id=user_id,
+        revoked_by_user_id=user_id  # El usuario se revoca a sí mismo
+    )
+    
+    await db.commit()
+    
+    logger.info("Logout successful", user_id=str(user_id), tokens_revoked=count)
+    
+    return {
+        "message": "Successfully logged out from all devices",
+        "tokens_revoked": count
+    }
 
 
 @router.get("/me")

backend/app/api/v1/router.py

@@ -6,7 +6,7 @@ Router principal para la API v1
 
 from fastapi import APIRouter
 
-from app.api.v1.endpoints import auth, health, tenants, users, systems, categories, tickets, client_profile
+from app.api.v1.endpoints import auth, health, tenants, users, systems, categories, tickets, client_profile, audit
 
 api_router = APIRouter()
 
@@ -23,6 +23,13 @@ api_router.include_router(
     tags=["authentication"]
 )
 
+# Audit routes (antes de otros para logging)
+api_router.include_router(
+    audit.router,
+    prefix="/audit",
+    tags=["audit"]
+)
+
 api_router.include_router(
     tenants.router,
     prefix="/tenants",