fix: handle errors from audit log INSERT statements

Previously, errors from INSERT INTO audit_log were silently discarded using _, _, which
meant audit log failures could go unnoticed during add/delete/cleanup operations.

The changes now properly capture and return errors for permanent entry operations and
temporary entry operations, except for cleanupExpiredTemp which logs warnings instead
of failing the entire cleanup process when individual audit log entries fail.

db.go

@@ -64,7 +64,10 @@ func AddPermanentEntry(db *sql.DB, entry, apiClientIP string) (bool, error) {
 		}
 		return false, err
 	}
-	_, _ = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('add_perm', ?, ?)`, entry, apiClientIP)
+	_, err = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('add_perm', ?, ?)`, entry, apiClientIP)
+	if err != nil {
+		return true, err
+	}
 	return true, nil
 }
 
@@ -75,7 +78,10 @@ func DeletePermanentEntry(db *sql.DB, entry, apiClientIP string) error {
 	}
 	rows, _ := res.RowsAffected()
 	if rows > 0 {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('delete_perm', ?, ?)`, entry, apiClientIP)
+		_, err = db.Exec(`INSERT INTO audit_log(action, cidr, api_client_ip) VALUES('delete_perm', ?, ?)`, entry, apiClientIP)
+		if err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -113,8 +119,11 @@ func AddTempEntry(db *sql.DB, ip string, ttlSeconds int, reason, apiClientIP str
 	if err != nil {
 		return err
 	}
-	_, _ = db.Exec(`INSERT INTO audit_log(action, ip, ttl_seconds, reason, api_client_ip) VALUES('add_temp', ?, ?, ?, ?)`,
+	_, err = db.Exec(`INSERT INTO audit_log(action, ip, ttl_seconds, reason, api_client_ip) VALUES('add_temp', ?, ?, ?, ?)`,
 		ip, ttlSeconds, reason, apiClientIP)
+	if err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -125,7 +134,10 @@ func DeleteTempEntry(db *sql.DB, ip, apiClientIP string) error {
 	}
 	rows, _ := res.RowsAffected()
 	if rows > 0 {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, ip, api_client_ip) VALUES('delete_temp', ?, ?)`, ip, apiClientIP)
+		_, err = db.Exec(`INSERT INTO audit_log(action, ip, api_client_ip) VALUES('delete_temp', ?, ?)`, ip, apiClientIP)
+		if err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -162,7 +174,10 @@ func CleanupExpiredTemp(db *sql.DB) error {
 	}
 
 	for _, ip := range expiredIPs {
-		_, _ = db.Exec(`INSERT INTO audit_log(action, ip) VALUES('expire_temp', ?)`, ip)
+		_, err = db.Exec(`INSERT INTO audit_log(action, ip) VALUES('expire_temp', ?)`, ip)
+		if err != nil {
+			slog.Warn("failed to log expired temp entry", "ip", ip, "error", err)
+		}
 		slog.Info("expired temporary whitelist", "ip", ip)
 	}
 	return nil