feat(logs): admin changes and logins are recorded on the Logs page

The Logs page shows who added, changed or deleted a compute, from web
or API, and every login, failed login, lockout and logout, with the
client address and a Result column (Done, Failed, Unknown for older
rows). A failed change is recorded with its reason and the error still
reaches the user; a refused one is recorded too.

- logs.audit.write saves each row in its own savepoint and never
  raises, so a log write cannot break or undo the action it records.
  The audit() context manager writes one row when the change ends.
- Logs gains success and ip; user, host and instance are wider and
  date is indexed. The page orders by date then id.
- A compute edit names the changed fields; an edit that changes
  nothing writes no row, and an empty password field is no change.
- A compute's VMs leaving the panel get a system row each: owners
  kept on the Removed VMs page, moved to another compute, restored,
  left without owners, or the removed record expired.
- Job rows carry the result. A job's log entry that cannot be
  computed is logged and skipped instead of rolling back the finish
  (test_service.py changes this on purpose).
- Logins are recorded by signal receivers; CustomLoginView is removed
  and the plain LoginView is used. A wrong OTP code is a failed login,
  counted by django-axes toward the lockout.

Panel records and host-side objects follow in the next layers.

operations/jobs.py

@@ -14,7 +14,7 @@ from django.db.models import F, Value
 from django.db.models.functions import Coalesce
 from django.utils import timezone
 
-from logs.models import Logs
+from logs.audit import write
 from vrtManager.util import OperationError
 
 from . import claims, utils
@@ -195,8 +195,8 @@ def cancel(op_id, user):
         if op.state == Operation.QUEUED:
             Operation.objects.filter(pk=op.pk).update(state=Operation.CANCELLED, finished_at=timezone.now())
             Claim.objects.filter(operation=op).delete()
-            if (entry := get_kind(op.kind).log_entry(op, Operation.CANCELLED)) is not None:
-                _log(op.username, *entry)
+            if (entry := _entry(op, Operation.CANCELLED)) is not None:
+                _log(op.username, *entry, None)
         elif op.state == Operation.RUNNING:
             if not get_kind(op.kind).cancellable:
                 raise OperationError("This job cannot be cancelled once it has started")
@@ -210,15 +210,22 @@ def cancel(op_id, user):
     return op
 
 
-def _log(user, host, instance, message):
-    Logs.objects.create(user=str(user)[:50], host=str(host)[:50], instance=str(instance)[:50],
-                        message=utils.safe_text(message)[:255])
+def _entry(op, state):
+    """The kind's log entry; one that cannot be computed is logged and skipped, so it never undoes the job."""
+    try:
+        return get_kind(op.kind).log_entry(op, state)
+    except Exception:
+        logging.getLogger("logs.audit").exception("log entry of job %s not computed", op.pk)
+        return None
+
+
+def _log(user, host, instance, message, success):
+    write(str(user), str(host), str(instance), utils.safe_text(message), success)
 
 
 def finish(op, outcome, *, worker=None):
     """Terminal state, claims and history together, once. With a worker,
     only while it holds the lease and owns the job. Uncertain keeps the claims."""
-    kind = get_kind(op.kind)
     error = utils.safe_text(outcome.error)
     with fenced(worker.identity) if worker is not None else transaction.atomic():
         q = Operation.objects.filter(pk=op.pk, state__in=Operation.ACTIVE)
@@ -233,8 +240,8 @@ def finish(op, outcome, *, worker=None):
             return False
         if outcome.state != Operation.UNCERTAIN:
             Claim.objects.filter(operation=op).delete()
-        if (entry := kind.log_entry(op, outcome.state)) is not None:
-            _log(op.username, *entry)
+        if (entry := _entry(op, outcome.state)) is not None:
+            _log(op.username, *entry, {Operation.SUCCEEDED: True, Operation.FAILED: False}.get(outcome.state))
     logger.info("job %s %s: %s", op.pk, op.kind, outcome.state)
     op.refresh_from_db()
     return True
@@ -256,9 +263,10 @@ def resolve(op_id, user, outcome_state, note):
                                                   resolution_note=note, resolved_by=user, resolved_at=timezone.now())
         Claim.objects.filter(operation=op).delete()
         # the host and VM columns of the kind's own entries, so the VM's log shows it
-        entry = get_kind(op.kind).log_entry(op, outcome_state)
+        entry = _entry(op, outcome_state)
         host, instance = entry[:2] if entry is not None else ("-", op.resource_label)
-        _log(user.username, host, instance, f"Job {op.pk} resolved as {outcome_state}: {note}")
+        _log(user.username, host, instance, f"Job {op.pk} resolved as {outcome_state}: {note}",
+             outcome_state == Operation.SUCCEEDED)
     op.refresh_from_db()
     return op
 

operations/tests/test_service.py

@@ -90,12 +90,26 @@ class CancelFinishResolveTestCase(TransactionTestCase):
         self.assertFalse(Claim.objects.exists())
         self.assertEqual(list(Logs.objects.values_list("message", flat=True)), ["No-op cancelled"])
 
-    def test_the_log_entry_is_written_inside_the_finishing_transaction(self):
+    def test_a_failing_log_entry_does_not_undo_the_finish(self):
         op = jobs.submit("test.noop", self.user, {}, KEY)
-        with patch.object(fakes.NoopKind, "log_entry", side_effect=RuntimeError("x")), self.assertRaises(RuntimeError):
-            jobs.finish(op, Outcome(Operation.SUCCEEDED))
-        self.assertEqual(Operation.objects.get(pk=op.pk).state, Operation.QUEUED)  # rolled back
-        self.assertTrue(Claim.objects.exists())
+        with patch.object(fakes.NoopKind, "log_entry", side_effect=RuntimeError("x")), \
+                self.assertLogs("logs.audit", "ERROR"):
+            self.assertTrue(jobs.finish(op, Outcome(Operation.SUCCEEDED)))
+        self.assertEqual(Operation.objects.get(pk=op.pk).state, Operation.SUCCEEDED)
+        self.assertFalse(Claim.objects.exists())
+        self.assertFalse(Logs.objects.exists())
+
+    def test_job_rows_carry_the_result(self):
+        for key, state, success in (("key-00000002", Operation.SUCCEEDED, True), ("key-00000003", Operation.FAILED, False)):
+            jobs.finish(jobs.submit("test.noop", self.user, {}, key), Outcome(state))
+            self.assertIs(Logs.objects.latest("pk").success, success)
+        jobs.cancel(jobs.submit("test.noop", self.user, {}, "key-00000004").pk, self.user)
+        self.assertIsNone(Logs.objects.latest("pk").success)
+        op = jobs.submit("test.noop", self.user, {}, "key-00000005")
+        jobs.finish(op, Outcome(Operation.UNCERTAIN))
+        self.assertIsNone(Logs.objects.latest("pk").success)
+        jobs.resolve(op.pk, self.admin, Operation.FAILED, "checked")
+        self.assertIs(Logs.objects.latest("pk").success, False)
 
     def test_cancel_decides_from_the_current_state(self):
         op = jobs.submit("test.scripted", self.user, {}, KEY)
@@ -176,7 +190,7 @@ class CancelFinishResolveTestCase(TransactionTestCase):
         jobs.finish(op, Outcome(Operation.FAILED, error="qemu+tcp://admin:s3cret@192.0.2.5/system failed"))
         op.refresh_from_db()
         self.assertNotIn("s3cret", op.error)
-        self.assertLessEqual(len(Logs.objects.get().user), 50)
+        self.assertLessEqual(len(Logs.objects.get().user), 150)
 
     def test_an_uncertain_job_keeps_its_claims_until_resolved(self):
         op = jobs.submit("test.noop", self.user, {}, KEY)