refactor: standardize audit logging for ISO27001 compliance

gatehouse_app/api/v1/ssh/admin.py

@@ -2,7 +2,7 @@
 from flask import request, g
 from gatehouse_app.api.v1.ssh._helpers import ssh_bp
 from gatehouse_app.utils.constants import AuditAction, OrganizationRole
-from gatehouse_app.models import AuditLog
+from gatehouse_app.services.audit_service import AuditService
 from gatehouse_app.utils.decorators import login_required
 from gatehouse_app.utils.response import api_response
 
@@ -78,7 +78,14 @@ def add_ca_permission(ca_id):
     db.session.add(perm)
     db.session.commit()
 
-    AuditLog.log(action=AuditAction.CA_UPDATED, user_id=user.id, resource_type="CAPermission", resource_id=perm.id, ip_address=request.remote_addr, description=f"Granted '{permission}' on CA '{ca.name}' to user {target_user.email}")
+    AuditService.log_action(
+        action=AuditAction.CA_UPDATED,
+        user_id=user.id,
+        organization_id=ca.organization_id,
+        resource_type="CAPermission",
+        resource_id=perm.id,
+        description=f"Granted '{permission}' on CA '{ca.name}' to user {target_user.email}",
+    )
 
     d = perm.to_dict()
     d["user_email"] = target_user.email
@@ -102,10 +109,21 @@ def remove_ca_permission(ca_id, target_user_id):
         if not membership or membership.role not in (OrganizationRole.ADMIN, OrganizationRole.OWNER):
             return api_response(success=False, message="Admin access required", status=403, error_type="FORBIDDEN")
 
+    target_user = User.query.filter_by(id=target_user_id, deleted_at=None).first()
+    if not target_user:
+        return api_response(success=False, message="User not found", status=404, error_type="NOT_FOUND")
+
     perm = CAPermission.query.filter_by(ca_id=ca_id, user_id=target_user_id, deleted_at=None).first()
     if not perm:
         return api_response(success=False, message="Permission not found", status=404, error_type="NOT_FOUND")
 
     perm.delete(soft=True)
-    AuditLog.log(action=AuditAction.CA_UPDATED, user_id=user.id, resource_type="CAPermission", resource_id=perm.id, ip_address=request.remote_addr, description=f"Revoked permission on CA '{ca.name}' from user {target_user_id}")
+    AuditService.log_action(
+        action=AuditAction.CA_UPDATED,
+        user_id=user.id,
+        organization_id=ca.organization_id,
+        resource_type="CAPermission",
+        resource_id=perm.id,
+        description=f"Revoked permission on CA '{ca.name}' from user {target_user.email}",
+    )
     return api_response(data={}, message="Permission revoked")