89 lines
3.0 KiB
PL/PgSQL
89 lines
3.0 KiB
PL/PgSQL
-- Audit log table
|
|
CREATE TABLE app.audit_log (
|
|
audit_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
table_name TEXT NOT NULL,
|
|
record_id TEXT NOT NULL,
|
|
action TEXT NOT NULL, -- 'INSERT', 'UPDATE', 'DELETE'
|
|
user_id UUID, -- from session variable, nullable for system actions
|
|
changed_fields JSONB, -- UPDATE: {field: {old, new}}; INSERT: full row; DELETE: full row
|
|
occurred_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
CREATE INDEX idx_audit_log_table_record ON app.audit_log(table_name, record_id);
|
|
CREATE INDEX idx_audit_log_user ON app.audit_log(user_id);
|
|
CREATE INDEX idx_audit_log_occurred ON app.audit_log(occurred_at);
|
|
|
|
-- Generic trigger function
|
|
CREATE OR REPLACE FUNCTION app.audit_trigger_func() RETURNS TRIGGER AS $$
|
|
DECLARE
|
|
_user_id UUID;
|
|
_record_id TEXT;
|
|
_changed JSONB;
|
|
_old JSONB;
|
|
_new JSONB;
|
|
_key TEXT;
|
|
BEGIN
|
|
-- Get current user from session variable (set per-request by app)
|
|
BEGIN
|
|
_user_id := current_setting('app.current_user_id', true)::UUID;
|
|
EXCEPTION WHEN OTHERS THEN
|
|
_user_id := NULL;
|
|
END;
|
|
|
|
IF TG_OP = 'DELETE' THEN
|
|
_record_id := (row_to_json(OLD) ->> TG_ARGV[0])::TEXT;
|
|
INSERT INTO app.audit_log (table_name, record_id, action, user_id, changed_fields)
|
|
VALUES (TG_TABLE_NAME, _record_id, 'DELETE', _user_id, row_to_json(OLD)::JSONB);
|
|
RETURN OLD;
|
|
|
|
ELSIF TG_OP = 'INSERT' THEN
|
|
_record_id := (row_to_json(NEW) ->> TG_ARGV[0])::TEXT;
|
|
INSERT INTO app.audit_log (table_name, record_id, action, user_id, changed_fields)
|
|
VALUES (TG_TABLE_NAME, _record_id, 'INSERT', _user_id, row_to_json(NEW)::JSONB);
|
|
RETURN NEW;
|
|
|
|
ELSIF TG_OP = 'UPDATE' THEN
|
|
_record_id := (row_to_json(NEW) ->> TG_ARGV[0])::TEXT;
|
|
_old := row_to_json(OLD)::JSONB;
|
|
_new := row_to_json(NEW)::JSONB;
|
|
_changed := '{}'::JSONB;
|
|
|
|
FOR _key IN SELECT jsonb_object_keys(_new)
|
|
LOOP
|
|
IF _key IN ('updated_at', 'created_at') THEN CONTINUE; END IF;
|
|
IF (_old ->> _key) IS DISTINCT FROM (_new ->> _key) THEN
|
|
_changed := _changed || jsonb_build_object(
|
|
_key, jsonb_build_object('old', _old -> _key, 'new', _new -> _key)
|
|
);
|
|
END IF;
|
|
END LOOP;
|
|
|
|
-- Skip if nothing actually changed
|
|
IF _changed = '{}'::JSONB THEN RETURN NEW; END IF;
|
|
|
|
INSERT INTO app.audit_log (table_name, record_id, action, user_id, changed_fields)
|
|
VALUES (TG_TABLE_NAME, _record_id, 'UPDATE', _user_id, _changed);
|
|
RETURN NEW;
|
|
END IF;
|
|
|
|
RETURN NULL;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
|
|
-- Helper to attach audit trigger to a table
|
|
CREATE OR REPLACE FUNCTION app.enable_audit(target_table TEXT, pk_column TEXT DEFAULT 'id') RETURNS VOID AS $$
|
|
DECLARE
|
|
trigger_name TEXT;
|
|
BEGIN
|
|
trigger_name := 'audit_' || replace(target_table, '"', '');
|
|
EXECUTE format(
|
|
'CREATE TRIGGER %I AFTER INSERT OR UPDATE OR DELETE ON app.%s FOR EACH ROW EXECUTE FUNCTION app.audit_trigger_func(%L)',
|
|
trigger_name, target_table, pk_column
|
|
);
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
|
|
-- Enable audit on existing tables
|
|
SELECT app.enable_audit('"user"', 'user_id');
|
|
SELECT app.enable_audit('user_profile', 'profile_id');
|