feat: audit log export support (#465)

Author: scop

CHANGELOG.md

@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Object storage user access key management with `object-storage create-access-key`, `object-storage delete-access-key`, and `object-storage list-access-keys` commands
 - Expose GPU limits in `account show` command
 - Expose GPU model and amount in `server plans` command
+- Add `audit-log export` command.
 
 ## [3.21.0] - 2025-07-15
 

internal/commands/auditlog/auditlog.go

@@ -0,0 +1,21 @@
+package auditlog
+
+import (
+	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands"
+)
+
+// BaseAuditLogCommand creates the base "audit-log" command
+func BaseAuditLogCommand() commands.Command {
+	return &auditLogCommand{
+		commands.New("audit-log", "Manage audit logs"),
+	}
+}
+
+type auditLogCommand struct {
+	*commands.BaseCommand
+}
+
+// InitCommand implements [commands.BaseCommand.InitCommand].
+func (c *auditLogCommand) InitCommand() {
+	c.Cobra().Aliases = []string{"auditlog", "al"}
+}

internal/commands/auditlog/export.go

@@ -0,0 +1,44 @@
+package auditlog
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands"
+	"github.com/UpCloudLtd/upcloud-cli/v3/internal/output"
+	"github.com/UpCloudLtd/upcloud-go-api/v8/upcloud/request"
+	"github.com/spf13/pflag"
+)
+
+var formats = []string{
+	request.ExportAuditLogFormatJSON,
+	request.ExportAuditLogFormatCSV,
+}
+
+// ExportCommand creates the "audit-log export" command
+func ExportCommand() commands.Command {
+	return &exportCommand{
+		BaseCommand: commands.New("export", "Export audit logs", "upctl audit-log export", "upctl audit-log export --output csv >audit-log.csv"),
+	}
+}
+
+type exportCommand struct {
+	*commands.BaseCommand
+	params request.ExportAuditLogRequest
+}
+
+func (c *exportCommand) InitCommand() {
+	fs := &pflag.FlagSet{}
+	fs.StringVar(&c.params.Format, "output", formats[0], fmt.Sprintf("Export format (typically %s). Note that this overrides the global --output flag.", strings.Join(formats, "|")))
+	c.AddFlags(fs)
+}
+
+// ExecuteWithoutArguments implements [commands.NoArgumentCommand].
+func (c *exportCommand) ExecuteWithoutArguments(exec commands.Executor) (output.Output, error) {
+	r, err := exec.All().ExportAuditLog(exec.Context(), &c.params)
+	if err != nil {
+		return nil, err
+	}
+
+	return output.Raw{Source: r}, nil
+}

internal/commands/base/base.go

@@ -6,6 +6,7 @@ import (
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/account/permissions"
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/account/token"
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/all"
+	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/auditlog"
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/database"
 	databaseindex "github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/database/index"
 	databaseproperties "github.com/UpCloudLtd/upcloud-cli/v3/internal/commands/database/properties"
@@ -269,6 +270,10 @@ func BuildCommands(rootCmd *cobra.Command, conf *config.Config) {
 	commands.BuildCommand(partneraccount.CreateCommand(), partnerAccountCommand.Cobra(), conf)
 	commands.BuildCommand(partneraccount.ListCommand(), partnerAccountCommand.Cobra(), conf)
 
+	// Audit log operations
+	auditlogCommand := commands.BuildCommand(auditlog.BaseAuditLogCommand(), rootCmd, conf)
+	commands.BuildCommand(auditlog.ExportCommand(), auditlogCommand.Cobra(), conf)
+
 	// Operations for managing all resources at once
 	allCommand := commands.BuildCommand(all.BaseAllCommand(), rootCmd, conf)
 	commands.BuildCommand(all.PurgeCommand(), allCommand.Cobra(), conf)

internal/mock/mock.go

@@ -3,6 +3,7 @@ package mock
 
 import (
 	"context"
+	"io"
 
 	"github.com/UpCloudLtd/upcloud-go-api/v8/upcloud"
 	"github.com/UpCloudLtd/upcloud-go-api/v8/upcloud/request"
@@ -96,6 +97,7 @@ var (
 	_ service.ManagedObjectStorage = &Service{}
 	_ service.Gateway              = &Service{}
 	_ service.Token                = &Service{}
+	_ service.AuditLog             = &Service{}
 )
 
 // GetServerConfigurations implements service.Server.GetServerConfigurations
@@ -1556,3 +1558,12 @@ func (m *Service) GetBillingSummary(_ context.Context, r *request.GetBillingSumm
 	}
 	return args[0].(*upcloud.BillingSummary), args.Error(1)
 }
+
+// ExportAuditLog implements service.AuditLog.ExportAuditLog
+func (m *Service) ExportAuditLog(_ context.Context, r *request.ExportAuditLogRequest) (io.ReadCloser, error) {
+	args := m.Called(r)
+	if args[0] == nil {
+		return nil, args.Error(1)
+	}
+	return args[0].(io.ReadCloser), args.Error(1)
+}

internal/output/raw.go

@@ -1,21 +1,33 @@
 package output
 
-import "fmt"
+import "io"
 
-// Raw is a way to output raw data to the user. It is *only* supported in humanized output and used for generating shell completion scripts.
-type Raw []byte
+// Raw is a way to output raw data from a source reader.
+type Raw struct {
+	Source io.ReadCloser
+}
 
 // MarshalJSON implements output.Output
 func (s Raw) MarshalJSON() ([]byte, error) {
-	return nil, fmt.Errorf("json output not supported")
+	return []byte{}, nil
 }
 
 // MarshalHuman implements output.Output
 func (s Raw) MarshalHuman() ([]byte, error) {
-	return s, nil
+	return []byte{}, nil
 }
 
 // MarshalRawMap implements output.Output
 func (s Raw) MarshalRawMap() (map[string]interface{}, error) {
-	return nil, fmt.Errorf("raw mao output not supported")
+	return map[string]interface{}{}, nil
+}
+
+// Read implements io.ReadCloser.
+func (s Raw) Read(p []byte) (n int, err error) {
+	return s.Source.Read(p)
+}
+
+// Close implements io.ReadCloser.
+func (s Raw) Close() error {
+	return s.Source.Close()
 }

internal/output/render.go

@@ -3,6 +3,7 @@ package output
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 
@@ -28,9 +29,13 @@ func Render(writer io.Writer, outputFormat string, commandOutputs ...Output) (er
 	var b []byte
 	switch outputFormat {
 	case formatHuman:
-		b, err = withNewline(toHuman(commandOutputs...))
+		if b, err = toHuman(commandOutputs...); err == nil && len(b) != 0 {
+			b = append(b, '\n')
+		}
 	case formatJSON:
-		b, err = withNewline(toJSON(commandOutputs...))
+		if b, err = toJSON(commandOutputs...); err == nil && len(b) != 0 {
+			b = append(b, '\n')
+		}
 	case formatYAML:
 		b, err = toYAML(commandOutputs...)
 	default:
@@ -45,14 +50,20 @@ func Render(writer io.Writer, outputFormat string, commandOutputs ...Output) (er
 		return err
 	}
 
-	// Count failed outputs
+	// Render streaming outputs and count failed ones
 	failedCount := 0
 	for _, commandOutput := range commandOutputs {
-		if _, ok := commandOutput.(Error); ok {
+		if rawOutput, ok := commandOutput.(Raw); ok {
+			_, cErr := io.Copy(writer, rawOutput)
+			err = errors.Join(err, cErr, rawOutput.Close())
+		} else if _, ok := commandOutput.(Error); ok {
 			failedCount++
 		}
 	}
 
+	if err != nil {
+		return err
+	}
 	if failedCount > 0 {
 		return &clierrors.CommandFailedError{
 			FailedCount: failedCount,
@@ -84,7 +95,9 @@ func toJSON(commandOutputs ...Output) ([]byte, error) {
 			if err != nil {
 				return nil, err
 			}
-			jsonOutput = append(jsonOutput, outBytes)
+			if len(outBytes) > 0 {
+				jsonOutput = append(jsonOutput, outBytes)
+			}
 		}
 	}
 
@@ -109,7 +122,3 @@ func toYAML(commandOutputs ...Output) ([]byte, error) {
 
 	return JSONToYAML(b)
 }
-
-func withNewline(b []byte, err error) ([]byte, error) {
-	return append(b, "\n"...), err
-}

internal/output/render_test.go

@@ -3,12 +3,15 @@ package output_test
 import (
 	"bytes"
 	"errors"
+	"io"
+	"strings"
 	"testing"
 
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/config"
 	"github.com/UpCloudLtd/upcloud-cli/v3/internal/output"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type failWriter struct{}
@@ -26,22 +29,30 @@ func TestRenderFailingWriter(t *testing.T) {
 }
 
 func TestRender(t *testing.T) {
+	rr := strings.NewReader("raw hello")
 	renderTests := []outputTestCase{
 		{
 			name:                "none",
 			input:               output.None{},
-			expectedHumanResult: "\n",
-			expectedJSONResult:  "\n",
+			expectedHumanResult: "",
+			expectedJSONResult:  "",
 			expectedYAMLResult:  "",
 		},
 		{
 			name:                "marshaled",
 			input:               output.OnlyMarshaled{Value: "hello"},
-			expectedHumanResult: "\n", // marshaled should not output in human mode
+			expectedHumanResult: "", // marshaled should not output in human mode
 			expectedJSONResult: `"hello"
 `,
 			expectedYAMLResult: "hello\n",
 		},
+		{
+			name:                "raw",
+			input:               output.Raw{Source: io.NopCloser(rr)},
+			expectedHumanResult: "raw hello",
+			expectedJSONResult:  "raw hello",
+			expectedYAMLResult:  "raw hello",
+		},
 	}
 	for _, test := range renderTests {
 		t.Run(test.name, func(t *testing.T) {
@@ -51,11 +62,15 @@ func TestRender(t *testing.T) {
 			cfg.Viper().Set(config.KeyOutput, "human")
 			err := output.Render(out, cfg.Output(), test.input)
 			validateOutput(t, test.expectedHumanResult, test.expectedErrorMessage, out.Bytes(), err)
+			_, err = rr.Seek(0, io.SeekStart)
+			require.NoError(t, err)
 			out.Truncate(0)
 
 			cfg.Viper().Set(config.KeyOutput, "json")
 			err = output.Render(out, cfg.Output(), test.input)
 			validateOutput(t, test.expectedJSONResult, test.expectedErrorMessage, out.Bytes(), err)
+			_, err = rr.Seek(0, io.SeekStart)
+			require.NoError(t, err)
 			out.Truncate(0)
 
 			cfg.Viper().Set(config.KeyOutput, "yaml")

internal/service/service.go

@@ -25,4 +25,5 @@ type AllServices interface {
 	service.Partner
 	service.Token
 	service.Tag
+	service.AuditLog
 }