feat(logs): admin changes and logins are recorded on the Logs page

The Logs page shows who added, changed or deleted a compute, from web
or API, and every login, failed login, lockout and logout, with the
client address and a Result column (Done, Failed, Unknown for older
rows). A failed change is recorded with its reason and the error still
reaches the user; a refused one is recorded too.

- logs.audit.write saves each row in its own savepoint and never
  raises, so a log write cannot break or undo the action it records.
  The audit() context manager writes one row when the change ends.
- Logs gains success and ip; user, host and instance are wider and
  date is indexed. The page orders by date then id.
- A compute edit names the changed fields; an edit that changes
  nothing writes no row, and an empty password field is no change.
- A compute's VMs leaving the panel get a system row each: owners
  kept on the Removed VMs page, moved to another compute, restored,
  left without owners, or the removed record expired.
- Job rows carry the result. A job's log entry that cannot be
  computed is logged and skipped instead of rolling back the finish
  (test_service.py changes this on purpose).
- Logins are recorded by signal receivers; CustomLoginView is removed
  and the plain LoginView is used. A wrong OTP code is a failed login,
  counted by django-axes toward the lockout.

Panel records and host-side objects follow in the next layers.

computes/api/viewsets.py

@@ -2,6 +2,7 @@ from admin.permissions import IsSuperUser
 from computes.models import Compute
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema
+from logs.audit import audit, changed_fields, snapshot
 from rest_framework import viewsets
 from rest_framework.response import Response
 from vrtManager.create import wvmCreate
@@ -19,6 +20,25 @@ class ComputeViewSet(viewsets.ModelViewSet):
     serializer_class = ComputeSerializer
     permission_classes = [IsSuperUser]
 
+    def perform_create(self, serializer):
+        data = serializer.validated_data
+        with audit(self.request, data["name"], f"Compute {data['name']} ({data['hostname']})", "add"):
+            serializer.save()
+
+    def perform_update(self, serializer):
+        compute = serializer.instance
+        subject = f"Compute {compute.name} ({compute.hostname})"
+        before = snapshot(compute)
+        with audit(self.request, compute, subject, "change") as entry:
+            serializer.save()
+            fields = changed_fields(before, snapshot(compute))
+            entry.action = "change " + ", ".join(fields)
+            entry.skip = not fields
+
+    def perform_destroy(self, instance):
+        with audit(self.request, instance, f"Compute {instance.name} ({instance.hostname})", "delete"):
+            instance.delete()
+
 
 class ComputeArchitecturesView(viewsets.ViewSet):
     permission_classes = [IsSuperUser]

computes/tests/test_audit_rows.py

@@ -0,0 +1,69 @@
+"""Adding, changing and deleting a compute, on the web and on the API, each write one audit row."""
+
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+from django.urls import reverse
+from logs.models import Logs
+from operations import claims
+from operations.models import Claim
+from operations.utils import busy_message
+
+from computes.models import Compute
+
+
+class ComputeAuditRowTests(TestCase):
+    def setUp(self):
+        self.admin = get_user_model().objects.create_superuser("audit-admin", "audit@example.com", "pw")
+        self.client.force_login(self.admin)
+        Logs.objects.all().delete()  # the login's row
+
+    def messages(self):
+        return list(Logs.objects.order_by("id").values_list("message", flat=True))
+
+    def form_data(self, hostname):
+        return {"name": "c1", "hostname": hostname, "login": "admin", "password": "", "details": "", "type": 1}
+
+    def test_add_change_delete_write_rows(self):
+        self.client.post(reverse("add_tcp_host"), {**self.form_data("192.0.2.5"), "password": "secret"})
+        row = Logs.objects.get()
+        self.assertEqual(
+            (row.message, row.success, row.host, row.ip, row.user),
+            ("Compute c1 (192.0.2.5): add", True, "c1", "127.0.0.1", "audit-admin"),
+        )
+
+        compute = Compute.objects.get()
+        self.client.post(reverse("compute_update", args=[compute.id]), self.form_data("192.0.2.6"))
+        self.assertEqual(self.messages()[1], "Compute c1 (192.0.2.5): change hostname")
+
+        self.client.post(reverse("compute_delete", args=[compute.id]))
+        self.assertEqual(self.messages()[2], "Compute c1 (192.0.2.6): delete")
+        self.assertFalse(Compute.objects.exists())
+
+    def test_an_edit_that_changes_nothing_writes_nothing(self):
+        compute = Compute.objects.create(name="c1", hostname="192.0.2.5", login="admin", password="secret", type=1)
+        self.client.post(reverse("compute_update", args=[compute.id]), self.form_data("192.0.2.5"))
+        self.assertFalse(Logs.objects.exists())
+
+    def test_a_busy_delete_writes_a_failed_row(self):
+        compute = Compute.objects.create(name="c1", hostname="192.0.2.5", login="admin", password="secret", type=1)
+        busy = claims.Busy(None)
+        claims.admit({claims.compute_key(compute.id): Claim.SHARED}, holder="192.0.2.30:1:1")
+        self.client.post(reverse("compute_delete", args=[compute.id]))
+        row = Logs.objects.get()
+        self.assertEqual(row.message, f"Compute c1 (192.0.2.5): delete: {busy_message(busy, self.admin)}")
+        self.assertFalse(row.success)
+        self.assertTrue(Compute.objects.exists())
+
+    def test_the_api_writes_the_same_rows(self):
+        data = {"name": "c1", "hostname": "192.0.2.5", "login": "admin", "password": "secret", "type": 1}
+        res = self.client.post("/api/v1/computes/", data, content_type="application/json")
+        self.assertEqual(res.status_code, 201)
+        pk = res.json()["id"]
+        res = self.client.patch(f"/api/v1/computes/{pk}/", {"hostname": "192.0.2.6"}, content_type="application/json")
+        self.assertEqual(res.status_code, 200)
+        res = self.client.delete(f"/api/v1/computes/{pk}/")
+        self.assertEqual(res.status_code, 204)
+        self.assertEqual(
+            self.messages(),
+            ["Compute c1 (192.0.2.5): add", "Compute c1 (192.0.2.5): change hostname", "Compute c1 (192.0.2.6): delete"],
+        )

computes/tests/test_ownership.py

@@ -11,6 +11,7 @@ from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.utils import timezone
 from instances.models import Instance, InstanceTombstone
+from logs.models import Logs
 from operations import claims
 from operations.models import Claim
 from rest_framework.test import APIClient
@@ -54,6 +55,9 @@ class OwnershipTestCase(TestCase):
         vm = Instance.objects.get(compute=compute, uuid=UUID)
         return vm.is_template, [(ui.user, ui.is_change, ui.is_delete, ui.is_vnc) for ui in vm.userinstance_set.all()]
 
+    def rows(self):
+        return list(Logs.objects.order_by("id").values_list("user", "host", "message"))
+
     def test_vm_that_disappears_and_returns_keeps_its_owners(self):
         self.owned_vm(self.host_a)
         refresh_instance_database(self.host_a)  # undefined for a while
@@ -64,6 +68,15 @@ class OwnershipTestCase(TestCase):
 
         self.assertEqual(self.ownership(self.host_a), (True, [(self.owner, True, False, True)]))
         self.assertFalse(InstanceTombstone.objects.exists())
+        self.assertEqual(self.rows(), [
+            ("-", "host-a", f"VM vm ({UUID}): owners kept on the Removed VMs page"),
+            ("-", "host-a", f"VM vm ({UUID}): owners restored"),
+        ])
+
+    def test_an_ownerless_vm_leaves_a_row(self):
+        Instance.objects.create(compute=self.host_a, name="vm", uuid=UUID)
+        refresh_instance_database(self.host_a)
+        self.assertEqual(self.rows(), [("-", "host-a", f"VM vm ({UUID}): left the panel (no owners)")])
 
     def test_move_seen_on_the_new_host_first(self):
         self.owned_vm(self.host_a)
@@ -75,6 +88,7 @@ class OwnershipTestCase(TestCase):
 
         self.assertEqual(self.ownership(self.host_b), (True, [(self.owner, True, False, True)]))
         self.assertFalse(Instance.objects.filter(compute=self.host_a).exists())
+        self.assertEqual(self.rows(), [("-", "host-a", f"VM vm ({UUID}): owners moved to host-b")])
 
     def test_move_seen_on_the_old_host_first(self):
         self.owned_vm(self.host_a)
@@ -105,6 +119,7 @@ class OwnershipTestCase(TestCase):
 
         self.assertEqual(self.ownership(self.host_a), (False, []))
         self.assertFalse(InstanceTombstone.objects.exists())
+        self.assertIn(("-", "-", f"VM vm ({UUID}): removed record expired"), self.rows())
 
     def test_deleted_users_are_skipped(self):
         self.owned_vm(self.host_a)
@@ -128,6 +143,11 @@ class OwnershipTestCase(TestCase):
         self.owned_vm(self.host_a)
         self.delete(self.host_a)
         self.assertEqual(InstanceTombstone.objects.get().owners[0]["user"], self.owner.id)
+        self.assertEqual(self.rows(), [
+            ("cd-admin", "-", "Login"),
+            ("-", "host-a", f"VM vm ({UUID}): owners kept on the Removed VMs page"),
+            ("cd-admin", "host-a", "Compute host-a (host-a.example): delete"),
+        ])
 
         again = self.compute("host-a-again")
         self.on(again, [("vm", UUID)])

computes/utils.py

@@ -9,6 +9,7 @@ from django.db import transaction
 from django.utils import timezone
 from computes.models import Compute
 from instances.models import Instance, InstanceTombstone
+from logs.audit import write
 from operations import claims
 from operations.models import Claim
 
@@ -45,6 +46,10 @@ def libvirt_instance_lock(instance):
         yield
 
 
+def _log(inst, what):
+    write("-", inst.compute.name, "", f"VM {inst.name} ({inst.uuid}): {what}", True)
+
+
 def _move_ownership(source, target):
     """Give target the owners and template flag of source; a user's rights are merged."""
     for ui in UserInstance.objects.filter(instance=source):
@@ -70,6 +75,7 @@ def forget(inst):
     elsewhere = Instance.objects.filter(uuid=inst.uuid).exclude(compute_id=inst.compute_id).first()
     if elsewhere:
         _move_ownership(inst, elsewhere)
+        _log(inst, f"owners moved to {elsewhere.compute.name}")
     else:
         _bury(inst)
     inst.delete()
@@ -82,7 +88,9 @@ def _bury(inst):
     ]
     if owners or inst.is_template:
         InstanceTombstone.objects.create(uuid=inst.uuid, name=inst.name, is_template=inst.is_template, owners=owners)
-        logger.info("Instance %s (%s) disappeared; ownership kept", inst.name, inst.uuid)
+        _log(inst, "owners kept on the Removed VMs page")
+    else:
+        _log(inst, "left the panel (no owners)")
 
 
 def _restore(inst):
@@ -103,7 +111,7 @@ def _restore(inst):
         inst.is_template = True
         inst.save(update_fields=["is_template"])
     InstanceTombstone.objects.filter(uuid=inst.uuid).delete()
-    logger.info("Instance %s (%s) is back; ownership restored", inst.name, inst.uuid)
+    _log(inst, "owners restored")
 
 
 def refresh_instance_database(compute):
@@ -187,7 +195,10 @@ def refresh_instance_database(compute):
                 #    compute is a copy and gets no owners; otherwise a tombstone's
                 #    ownership is restored.
                 retention = getattr(settings, "INSTANCE_OWNERSHIP_RETENTION_DAYS", 30)
-                InstanceTombstone.objects.filter(removed__lt=timezone.now() - timedelta(days=retention)).delete()
+                expired = InstanceTombstone.objects.filter(removed__lt=timezone.now() - timedelta(days=retention))
+                for t in expired:
+                    write("-", "-", "", f"VM {t.name} ({t.uuid}): removed record expired", True)
+                expired.delete()
                 for uuid, name in host_domains.items():
                     if uuid not in db_uuids:
                         inst, created = Instance.objects.get_or_create(

computes/views.py

@@ -10,6 +10,7 @@ from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from instances.models import Instance
 from libvirt import libvirtError
+from logs.audit import audit, changed_fields, snapshot
 from operations import claims
 from vrtManager.connection import wvmConnect
 from vrtManager.hostdetails import wvmHostDetails
@@ -92,7 +93,9 @@ def instances(request, compute_id):
 def compute_create(request, FormClass):
     form = FormClass(request.POST or None)
     if form.is_valid():
-        form.save()
+        compute = form.instance
+        with audit(request, compute, f"Compute {compute.name} ({compute.hostname})", "add"):
+            form.save()
         return redirect(reverse("computes"))
 
     return render(request, "computes/form.html", {"form": form})
@@ -111,9 +114,15 @@ def compute_update(request, compute_id):
     elif compute.type == 4:
         FormClass = SocketComputeForm
 
+    subject = f"Compute {compute.name} ({compute.hostname})"
+    before = snapshot(compute)
     form = FormClass(request.POST or None, instance=compute)
     if form.is_valid():
-        form.save()
+        with audit(request, compute, subject, "change") as entry:
+            form.save()
+            fields = changed_fields(before, snapshot(compute))
+            entry.action = "change " + ", ".join(fields)
+            entry.skip = not fields
         return redirect(reverse("computes"))
 
     return render(request, "computes/form.html", {"form": form})
@@ -123,7 +132,8 @@ def compute_update(request, compute_id):
 def compute_delete(request, compute_id):
     compute = get_object_or_404(Compute, pk=compute_id)
     if request.method == "POST":
-        compute.delete()
+        with audit(request, compute, f"Compute {compute.name} ({compute.hostname})", "delete"):
+            compute.delete()
         return redirect("computes")
 
     return render(