feat: complete NX9-Auth management and integrity hardening

src/db/repository/postgres/audit.rs

@@ -64,8 +64,6 @@ impl AuditRepository for PostgresAuditRepository {
     }
 
     async fn list_filtered(&self, filter: &AuditFilter) -> Result<Vec<AuditLog>, sqlx::Error> {
-        // Build a dynamic but simple filter using COALESCE-style optional matches.
-        // Empty optionals are treated as wildcards via OR IS NULL pattern with bind of None.
         let search_like = filter
             .search
             .as_ref()
@@ -88,8 +86,13 @@ impl AuditRepository for PostgresAuditRepository {
              OR ip_address LIKE $7 ESCAPE '\'
              OR metadata_json LIKE $7 ESCAPE '\'
           )
+          AND (
+                $8::boolean IS NULL
+             OR ($8::boolean = TRUE AND action NOT LIKE '%fail%' AND action NOT LIKE '%denied%' AND severity != 'critical')
+             OR ($8::boolean = FALSE AND (action LIKE '%fail%' OR action LIKE '%denied%' OR severity = 'critical'))
+          )
         ORDER BY created_at DESC
-        LIMIT $8 OFFSET $9
+        LIMIT $9 OFFSET $10
         "#,
         )
         .bind(filter.actor_user_id.as_deref())
@@ -99,6 +102,7 @@ impl AuditRepository for PostgresAuditRepository {
         .bind(filter.since.as_deref())
         .bind(filter.until.as_deref())
         .bind(search_like.as_deref())
+        .bind(filter.success)
         .bind(filter.limit)
         .bind(filter.offset)
         .fetch_all(&self.pool)
@@ -128,6 +132,11 @@ impl AuditRepository for PostgresAuditRepository {
              OR ip_address LIKE $7 ESCAPE '\'
              OR metadata_json LIKE $7 ESCAPE '\'
           )
+          AND (
+                $8::boolean IS NULL
+             OR ($8::boolean = TRUE AND action NOT LIKE '%fail%' AND action NOT LIKE '%denied%' AND severity != 'critical')
+             OR ($8::boolean = FALSE AND (action LIKE '%fail%' OR action LIKE '%denied%' OR severity = 'critical'))
+          )
         "#,
         )
         .bind(filter.actor_user_id.as_deref())
@@ -137,6 +146,7 @@ impl AuditRepository for PostgresAuditRepository {
         .bind(filter.since.as_deref())
         .bind(filter.until.as_deref())
         .bind(search_like.as_deref())
+        .bind(filter.success)
         .fetch_one(&self.pool)
         .await?;
         Ok(row.0)