WIP: Save current state - security subsystems, migrations, logging

aggregator-server/internal/api/handlers/subsystems.go

@@ -1,10 +1,14 @@
 package handlers
 
 import (
+	"fmt"
+	"log"
 	"net/http"
 
 	"github.com/Fimeg/RedFlag/aggregator-server/internal/database/queries"
 	"github.com/Fimeg/RedFlag/aggregator-server/internal/models"
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/services"
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/logging"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
@@ -12,15 +16,50 @@ import (
 type SubsystemHandler struct {
 	subsystemQueries *queries.SubsystemQueries
 	commandQueries   *queries.CommandQueries
+	signingService   *services.SigningService
+	securityLogger   *logging.SecurityLogger
 }
 
-func NewSubsystemHandler(sq *queries.SubsystemQueries, cq *queries.CommandQueries) *SubsystemHandler {
+func NewSubsystemHandler(sq *queries.SubsystemQueries, cq *queries.CommandQueries, signingService *services.SigningService, securityLogger *logging.SecurityLogger) *SubsystemHandler {
 	return &SubsystemHandler{
 		subsystemQueries: sq,
 		commandQueries:   cq,
+		signingService:   signingService,
+		securityLogger:   securityLogger,
 	}
 }
 
+// signAndCreateCommand signs a command if signing service is enabled, then stores it in the database
+func (h *SubsystemHandler) signAndCreateCommand(cmd *models.AgentCommand) error {
+	// Sign the command before storing
+	if h.signingService != nil && h.signingService.IsEnabled() {
+		signature, err := h.signingService.SignCommand(cmd)
+		if err != nil {
+			return fmt.Errorf("failed to sign command: %w", err)
+		}
+		cmd.Signature = signature
+
+		// Log successful signing
+		if h.securityLogger != nil {
+			h.securityLogger.LogCommandSigned(cmd)
+		}
+	} else {
+		// Log warning if signing disabled
+		log.Printf("[WARNING] Command signing disabled, storing unsigned command")
+		if h.securityLogger != nil {
+			h.securityLogger.LogPrivateKeyNotConfigured()
+		}
+	}
+
+	// Store in database
+	err := h.commandQueries.CreateCommand(cmd)
+	if err != nil {
+		return fmt.Errorf("failed to create command: %w", err)
+	}
+
+	return nil
+}
+
 // GetSubsystems retrieves all subsystems for an agent
 // GET /api/v1/agents/:id/subsystems
 func (h *SubsystemHandler) GetSubsystems(c *gin.Context) {
@@ -205,7 +244,7 @@ func (h *SubsystemHandler) TriggerSubsystem(c *gin.Context) {
 		Source:      "web_ui", // Manual trigger from UI
 	}
 
-	err = h.commandQueries.CreateCommand(command)
+	err = h.signAndCreateCommand(command)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create command"})
 		return