fix: do up No audit of document access in vigilcare-records-gap-analysis.md

VigilCareRecordsAPI/Controllers/AuthController.cs

@@ -1,6 +1,7 @@
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
 
 
 /// <summary>
@@ -20,8 +21,10 @@ public class AuthController : ControllerBase
     /// </summary>
     [HttpPost("login")]
     [AllowAnonymous]
+    [EnableRateLimiting("auth")]
     [ProducesResponseType(typeof(ApiResponse<LoginResponse>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
     public async Task<IActionResult> Login([FromBody] LoginRequest req)
     {
         var result = await _auth.LoginAsync(req);
@@ -33,8 +36,10 @@ public class AuthController : ControllerBase
     /// </summary>
     [HttpPost("refresh")]
     [AllowAnonymous]
+    [EnableRateLimiting("auth")]
     [ProducesResponseType(typeof(ApiResponse<TokenResponse>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
     public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
     {
         var result = await _auth.RefreshAsync(req);

VigilCareRecordsAPI/Controllers/DigitizationBatchesController.cs

@@ -1,6 +1,7 @@
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
 
 
 /// <summary>
@@ -16,6 +17,7 @@ public class DigitizationBatchesController : ControllerBase
     private readonly IDocumentStorageService _storage;
     private readonly IPromotionService _promotion;
     private readonly IBatchEventService _batchEventService;
+    private readonly AppDbContext _db;
 
     private static readonly HashSet<string> _allowedMimeTypes = new()
     {
@@ -26,12 +28,14 @@ public class DigitizationBatchesController : ControllerBase
         IBatchService batches,
         IDocumentStorageService storage,
         IPromotionService promotion,
-        IBatchEventService batchEventService)
+        IBatchEventService batchEventService,
+        AppDbContext db)
     {
         _batches = batches;
         _storage = storage;
         _promotion = promotion;
         _batchEventService = batchEventService;
+        _db = db;
     }
 
     /// <summary>
@@ -83,6 +87,27 @@ public class DigitizationBatchesController : ControllerBase
         var batch = await _batches.GetByIdAsync(id);
         var presignedUrl = await _storage.GetPresignedUrlAsync(batch.DocumentRef);
 
+        var userId = Guid.Parse(User.FindFirstValue(ClaimTypes.NameIdentifier)!);
+        var cutoff = DateTimeOffset.UtcNow.AddMinutes(-5);
+        var recentAccess = await _db.DigitizationEvents.AnyAsync(e =>
+            e.BatchId == id &&
+            e.EventType == DigitizationEventType.DocumentAccessed &&
+            e.ActorUserId == userId &&
+            e.OccurredAt >= cutoff);
+
+        if (!recentAccess)
+        {
+            _db.DigitizationEvents.Add(new DigitizationEvent
+            {
+                Id = Guid.NewGuid(),
+                BatchId = id,
+                EventType = DigitizationEventType.DocumentAccessed,
+                ActorUserId = userId,
+                OccurredAt = DateTimeOffset.UtcNow
+            });
+            await _db.SaveChangesAsync();
+        }
+
         return Ok(ApiResponse<BatchDetailResponse>.Ok(
             BatchDetailResponse.FromEntity(batch, presignedUrl)));
     }