Merge pull request #967 from Chris0Jeky/feat/ops-31-audit-retention-policy

Add audit trail retention policy with configurable cleanup

Author: Chris0Jeky

backend/src/Taskdeck.Infrastructure/Repositories/AuditLogRepository.cs

@@ -265,7 +265,11 @@ public async Task<int> DeleteOldEntriesAsync(DateTimeOffset olderThan, int batch
                 // SQLite stores DateTimeOffset as a string in "yyyy-MM-dd HH:mm:ss.fffffff+HH:mm" format.
                 // We must format the cutoff identically so the < comparison (string ordering) works correctly.
                 // See OAuthAuthCodeRepository.DeleteExpiredAsync for the same pattern.
-                var olderThanStr = olderThan.ToString("yyyy-MM-dd HH:mm:ss.fffffff+00:00");
+                // Normalize to UTC first so that a non-UTC DateTimeOffset (e.g. -05:00) is converted to
+                // its UTC-equivalent time before the "+00:00" suffix is appended; without this the time
+                // component would be wrong and entries in the wrong window could be kept or deleted.
+                var utcCutoff = olderThan.UtcDateTime;
+                var olderThanStr = utcCutoff.ToString("yyyy-MM-dd HH:mm:ss.fffffff") + "+00:00";
                 deleted = await _context.Database.ExecuteSqlRawAsync(
                     "DELETE FROM AuditLogs WHERE Id IN (SELECT Id FROM AuditLogs WHERE Timestamp < {0} ORDER BY Timestamp ASC LIMIT {1})",
                     new object[] { olderThanStr, batchSize },

backend/tests/Taskdeck.Api.Tests/AuditRetentionRepositoryIntegrationTests.cs

@@ -140,4 +140,42 @@ public async Task DeleteOldEntriesAsync_CompletesGracefully_WhenNothingToDelete(
 
         deleted.Should().Be(0);
     }
+
+    [Fact]
+    public async Task DeleteOldEntriesAsync_WithNonUtcCutoff_DeletesCorrectEntries()
+    {
+        // Regression test for: DateTimeOffset with non-zero UTC offset must be normalized
+        // to UTC before formatting as a SQLite timestamp string. Without normalization,
+        // a cutoff of e.g. 2026-01-01T00:00:00-05:00 would be formatted as
+        // "2026-01-01 00:00:00+00:00" instead of "2026-01-01 05:00:00+00:00",
+        // causing entries in the wrong five-hour window to be kept or deleted.
+        using var scope = _factory.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<TaskdeckDbContext>();
+        var repo = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
+
+        var oldEntry = new AuditLog("Board", Guid.NewGuid(), AuditAction.Created);
+        var recentEntry = new AuditLog("Board", Guid.NewGuid(), AuditAction.Created);
+        db.AuditLogs.AddRange(oldEntry, recentEntry);
+        await db.SaveChangesAsync();
+
+        // Backdate the old entry to well before the cutoff
+        var oldTimestampStr = DateTimeOffset.UtcNow.AddDays(-100).ToString("yyyy-MM-dd HH:mm:ss.fffffff+00:00");
+        await db.Database.ExecuteSqlRawAsync(
+            "UPDATE AuditLogs SET Timestamp = {0} WHERE Id = {1}",
+            oldTimestampStr, oldEntry.Id);
+
+        // Build a non-UTC cutoff that represents the same instant as "30 days ago UTC"
+        // expressed in Eastern Standard Time (-05:00). The repository must convert to
+        // UTC before building the SQLite comparison string.
+        var utcBase = DateTimeOffset.UtcNow.AddDays(-30);
+        var nonUtcCutoff = utcBase.ToOffset(TimeSpan.FromHours(-5));
+        var deleted = await repo.DeleteOldEntriesAsync(nonUtcCutoff, batchSize: 1000);
+
+        deleted.Should().BeGreaterOrEqualTo(1,
+            "entries older than the UTC-equivalent cutoff should be deleted regardless of the cutoff offset");
+
+        // The recent entry (created just now) must survive
+        var preserved = await repo.GetByIdAsync(recentEntry.Id);
+        preserved.Should().NotBeNull("the recent entry must not be deleted when a non-UTC cutoff is used");
+    }
 }