Улучшение безопасности и обработки ошибок. Этап 1. #8

src/handlers/admin/admin_handler_reports.erl

@@ -8,11 +8,11 @@ init(Req, _Opts) ->
   case cowboy_req:method(Req) of
     <<"GET">> -> list_reports(Req);
     <<"PUT">> -> update_report(Req);
-    _ -> send_error(Req, 405, <<"Method not allowed">>)
+    _         -> send_error(Req, 405, <<"Method not allowed">>)
   end.
 
 list_reports(Req) ->
-  case handler_auth:authenticate(Req) of
+  case auth_admin(Req) of
     {ok, AdminId, Req1} ->
       case admin_utils:is_admin(AdminId) of
         true ->
@@ -26,16 +26,18 @@ list_reports(Req) ->
   end.
 
 update_report(Req) ->
-  case handler_auth:authenticate(Req) of
+  case auth_admin(Req) of
     {ok, AdminId, Req1} ->
       case admin_utils:is_admin(AdminId) of
         true ->
           ReportId = cowboy_req:binding(id, Req1),
           {ok, Body, Req2} = cowboy_req:read_body(Req1),
           try jsx:decode(Body, [return_maps]) of
-            #{<<"status">> := NewStatus} ->
-              case core_report:update_status(ReportId, NewStatus, AdminId) of
+            #{<<"status">> := NewStatus, <<"reason">> := Reason} ->
+              StatusAtom = binary_to_atom(NewStatus, utf8),
+              case core_report:update_status(ReportId, StatusAtom, AdminId) of
                 {ok, Report} ->
+                  log_audit(AdminId, <<"update_report_status">>, <<"report">>, ReportId, Reason),
                   send_json(Req2, 200, report_to_json(Report));
                 {error, not_found} ->
                   send_error(Req2, 404, <<"Report not found">>);
@@ -43,7 +45,7 @@ update_report(Req) ->
                   send_error(Req2, 500, <<"Internal server error">>)
               end;
             _ ->
-              send_error(Req2, 400, <<"Missing status field">>)
+              send_error(Req2, 400, <<"Missing status or reason">>)
           catch
             _:_ -> send_error(Req2, 400, <<"Invalid JSON">>)
           end;
@@ -54,6 +56,26 @@ update_report(Req) ->
       send_error(Req1, Code, Message)
   end.
 
+auth_admin(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, AdminId, Req1} ->
+      case admin_utils:is_admin(AdminId) of
+        true  -> {ok, AdminId, Req1};
+        false -> {error, 403, <<"Admin access required">>, Req1}
+      end;
+    {error, Code, Message, Req1} ->
+      {error, Code, Message, Req1}
+  end.
+
+log_audit(AdminId, Action, EntityType, EntityId, Reason) ->
+  case core_admin:get_by_id(AdminId) of
+    {ok, Admin} ->
+      core_admin_audit:log(AdminId, Admin#admin.email, Admin#admin.role,
+        Action, EntityType, EntityId,
+        <<"127.0.0.1">>, Reason);
+    _ -> ok
+  end.
+
 report_to_json(R) ->
   #{
     id           => R#report.id,