From 252c617769c9c1ca4cd86d7da84e7cc95b7d5388 Mon Sep 17 00:00:00 2001
From: db123-test <db123-test@yejayekhoob.com>
Date: Mon, 4 May 2026 13:16:58 +0330
Subject: [PATCH] fix: handle errors from audit log INSERT statements

Previously, errors from INSERT INTO audit_log were silently discarded using _, _, which
meant audit log failures could go unnoticed during add/delete/cleanup operations.

The changes now properly capture and return errors for permanent entry operations and
temporary entry operations, except for cleanupExpiredTemp which logs warnings instead
of failing the entire cleanup process when individual audit log entries fail.
---
 db.go | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/db.go b/db.go
index 1ebd7a1..8c8699b 100644
--- a/db.go
+++ b/db.go
@@ -64,7 +64,10 @@ func AddPermanentEntry(db *sql.DB, entry, apiClientIP string) (bool, error) {
 		}
 		return false, err
 	}
-	_, _ = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('add_perm', ?, ?)`, entry, apiClientIP)
+	_, err = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('add_perm', ?, ?)`, entry, apiClientIP)
+	if err != nil {
+		return true, err
+	}
 	return true, nil
 }
 
@@ -75,7 +78,10 @@ func DeletePermanentEntry(db *sql.DB, entry, apiClientIP string) error {
 	}
 	rows, _ := res.RowsAffected()
 	if rows > 0 {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('delete_perm', ?, ?)`, entry, apiClientIP)
+		_, err = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('delete_perm', ?, ?)`, entry, apiClientIP)
+		if err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -113,8 +119,11 @@ func AddTempEntry(db *sql.DB, ip string, ttlSeconds int, reason, apiClientIP str
 	if err != nil {
 		return err
 	}
-	_, _ = db.Exec(`INSERT INTO audit_log(action, ip, ttl_seconds, reason, api_client_ip) VALUES('add_temp', ?, ?, ?, ?)`,
+	_, err = db.Exec(`INSERT INTO audit_log(action, ip, ttl_seconds, reason, api_client_ip) VALUES('add_temp', ?, ?, ?, ?)`,
 		ip, ttlSeconds, reason, apiClientIP)
+	if err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -125,7 +134,10 @@ func DeleteTempEntry(db *sql.DB, ip, apiClientIP string) error {
 	}
 	rows, _ := res.RowsAffected()
 	if rows > 0 {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, ip, api_client_ip) VALUES('delete_temp', ?, ?)`, ip, apiClientIP)
+		_, err = db.Exec(`INSERT INTO audit_log(action, ip, api_client_ip) VALUES('delete_temp', ?, ?)`, ip, apiClientIP)
+		if err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -162,7 +174,10 @@ func CleanupExpiredTemp(db *sql.DB) error {
 	}
 
 	for _, ip := range expiredIPs {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, ip) VALUES('expire_temp', ?)`, ip)
+		_, err = db.Exec(`INSERT INTO audit_log(action, ip) VALUES('expire_temp', ?)`, ip)
+		if err != nil {
+			slog.Warn("failed to log expired temp entry", "ip", ip, "error", err)
+		}
 		slog.Info("expired temporary whitelist", "ip", ip)
 	}
 	return nil