feat: add audit logs and temporal constraints

test_morbac.sql

@@ -127,7 +127,10 @@ INSERT INTO morbac.activities (name, description) VALUES
 INSERT INTO morbac.views (name, description) VALUES
     ('documents', 'Document resources'),
     ('reports', 'Report resources'),
-    ('sensitive_data', 'Sensitive/confidential data');
+    ('sensitive_data', 'Sensitive/confidential data'),
+    ('temp_documents', 'Temporary documents'),
+    ('future_documents', 'Future documents'),
+    ('active_documents', 'Active documents');
 
 SELECT * FROM morbac.activities ORDER BY name;
 SELECT * FROM morbac.views ORDER BY name;
@@ -607,6 +610,122 @@ SELECT
         'documents'
     ) as allowed;
 
+\echo ''
+\echo '=== Test 21: Temporal Constraints on Rules ==='
+
+-- Create a time-limited rule (expires in the past)
+INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, valid_until)
+VALUES (
+    '11111111-1111-1111-1111-111111111111',
+    'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', -- employee role
+    'write',
+    'temp_documents',
+    (SELECT id FROM morbac.contexts WHERE name = 'always'),
+    'permission',
+    '2020-01-01 00:00:00+00'  -- Expired rule
+);
+
+-- Create a future rule (not yet active)
+INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, valid_from)
+VALUES (
+    '11111111-1111-1111-1111-111111111111',
+    'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+    'write',
+    'future_documents',
+    (SELECT id FROM morbac.contexts WHERE name = 'always'),
+    'permission',
+    '2030-01-01 00:00:00+00'  -- Future rule
+);
+
+-- Create an active time-bounded rule
+INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, valid_from, valid_until)
+VALUES (
+    '11111111-1111-1111-1111-111111111111',
+    'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+    'write',
+    'active_documents',
+    (SELECT id FROM morbac.contexts WHERE name = 'always'),
+    'permission',
+    '2020-01-01 00:00:00+00',  -- Started in the past
+    '2030-12-31 23:59:59+00'   -- Ends in the future
+);
+
+\echo 'Alice (employee) access to temporal-constrained documents:'
+SELECT
+    'write to temp_documents (expired rule)' as action,
+    morbac.is_allowed(
+        'aaaaaaaa-0000-0000-0000-000000000001'::uuid,
+        '11111111-1111-1111-1111-111111111111'::uuid,
+        'write',
+        'temp_documents'
+    ) as allowed
+UNION ALL
+SELECT
+    'write to future_documents (not yet active)' as action,
+    morbac.is_allowed(
+        'aaaaaaaa-0000-0000-0000-000000000001'::uuid,
+        '11111111-1111-1111-1111-111111111111'::uuid,
+        'write',
+        'future_documents'
+    ) as allowed
+UNION ALL
+SELECT
+    'write to active_documents (currently valid)' as action,
+    morbac.is_allowed(
+        'aaaaaaaa-0000-0000-0000-000000000001'::uuid,
+        '11111111-1111-1111-1111-111111111111'::uuid,
+        'write',
+        'active_documents'
+    ) as allowed;
+
+\echo ''
+\echo '=== Test 22: Audit Logging ==='
+
+-- Enable audit on user_roles table
+SELECT morbac.enable_audit('user_roles');
+
+\echo 'Audit trigger created for user_roles table'
+
+-- Perform some auditable operations
+INSERT INTO morbac.user_roles (user_id, role_id, org_id)
+VALUES (
+    'ffffffff-0000-0000-0000-000000000001'::uuid,
+    'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',  -- employee role
+    '11111111-1111-1111-1111-111111111111'
+);
+
+-- Update an existing user_role
+UPDATE morbac.user_roles
+SET active = false
+WHERE user_id = 'aaaaaaaa-0000-0000-0000-000000000001'::uuid
+  AND role_id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+
+-- Delete a user role
+DELETE FROM morbac.user_roles
+WHERE user_id = 'ffffffff-0000-0000-0000-000000000001'::uuid
+  AND role_id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+
+\echo 'Audit log entries for user_roles operations:'
+SELECT
+    operation,
+    record_id,
+    CASE
+        WHEN old_data IS NOT NULL THEN old_data->>'active'
+        ELSE 'N/A'
+    END as old_active,
+    CASE
+        WHEN new_data IS NOT NULL THEN new_data->>'active'
+        ELSE 'N/A'
+    END as new_active,
+    session_user,
+    timestamp
+FROM morbac.audit_log
+WHERE table_name = 'user_roles'
+ORDER BY timestamp;
+
+\echo 'Disable audit on user_roles:'
+SELECT morbac.disable_audit('user_roles');
+
 \echo ''
 \echo '=== ALL TESTS COMPLETED SUCCESSFULLY ==='
 \echo ''
@@ -621,7 +740,5 @@ SELECT
 \echo '- Cardinality constraints'
 \echo '- Administration rules'
 \echo '- Cross-organizational rules'
-\echo '- Derived roles (framework ready)'
-\echo '- Complete authorization with all features'
-\echo '- Prohibition precedence verified'
-\echo '- Multi-organization support verified'
+\echo '- Temporal constraints on rules (valid_from, valid_until)'
+\echo '- Audit logging for security-critical operations'