Skip to content

Commit 20caee1

Browse files
coadlercoadler
authored
feat: add audit exporting and filtering (#1314)
1 parent ac27f64 commit 20caee1

15 files changed

+448
-14
lines changed

‎coderd/audit/backends/postgres.go

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package backends
2+
3+
import (
4+
"context"
5+
6+
"golang.org/x/xerrors"
7+
8+
"github.com/coder/coder/coderd/audit"
9+
"github.com/coder/coder/coderd/database"
10+
)
11+
12+
type postgresBackend struct {
13+
// internal indicates if the exporter is exporting to the Postgres database
14+
// that the rest of Coderd uses. Since this is a generic Postgres exporter,
15+
// we make different decisions to store the audit log based on if it's
16+
// pointing to the Coderd database.
17+
internal bool
18+
db database.Store
19+
}
20+
21+
func NewPostgres(db database.Store, internal bool) audit.Backend {
22+
return &postgresBackend{db: db, internal: internal}
23+
}
24+
25+
func (b *postgresBackend) Decision() audit.FilterDecision {
26+
if b.internal {
27+
return audit.FilterDecisionStore
28+
}
29+
30+
return audit.FilterDecisionExport
31+
}
32+
33+
func (b *postgresBackend) Export(ctx context.Context, alog database.AuditLog) error {
34+
_, err := b.db.InsertAuditLog(ctx, database.InsertAuditLogParams{
35+
ID: alog.ID,
36+
Time: alog.Time,
37+
UserID: alog.UserID,
38+
OrganizationID: alog.OrganizationID,
39+
Ip: alog.Ip,
40+
UserAgent: alog.UserAgent,
41+
ResourceType: alog.ResourceType,
42+
ResourceID: alog.ResourceID,
43+
ResourceTarget: alog.ResourceTarget,
44+
Action: alog.Action,
45+
Diff: alog.Diff,
46+
StatusCode: alog.StatusCode,
47+
})
48+
if err != nil {
49+
return xerrors.Errorf("insert audit log: %w", err)
50+
}
51+
52+
return nil
53+
}

‎coderd/audit/backends/postgres_test.go

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
package backends_test
2+
3+
import (
4+
"context"
5+
"net"
6+
"net/http"
7+
"testing"
8+
"time"
9+
10+
"github.com/google/uuid"
11+
"github.com/stretchr/testify/require"
12+
"github.com/tabbed/pqtype"
13+
14+
"github.com/coder/coder/coderd/audit/backends"
15+
"github.com/coder/coder/coderd/database"
16+
"github.com/coder/coder/coderd/database/databasefake"
17+
)
18+
19+
func TestPostgresBackend(t *testing.T) {
20+
t.Parallel()
21+
t.Run("OK", func(t *testing.T) {
22+
t.Parallel()
23+
24+
var (
25+
ctx, cancel = context.WithCancel(context.Background())
26+
db = databasefake.New()
27+
pgb = backends.NewPostgres(db, true)
28+
alog = randomAuditLog()
29+
)
30+
defer cancel()
31+
32+
err := pgb.Export(ctx, alog)
33+
require.NoError(t, err)
34+
35+
got, err := db.GetAuditLogsBefore(ctx, database.GetAuditLogsBeforeParams{
36+
ID: uuid.Nil,
37+
StartTime: time.Now().Add(time.Second),
38+
RowLimit: 1,
39+
})
40+
require.NoError(t, err)
41+
require.Len(t, got, 1)
42+
require.Equal(t, alog, got[0])
43+
})
44+
}
45+
46+
func randomAuditLog() database.AuditLog {
47+
_, inet, _ := net.ParseCIDR("127.0.0.1/32")
48+
return database.AuditLog{
49+
ID: uuid.New(),
50+
Time: time.Now(),
51+
UserID: uuid.New(),
52+
OrganizationID: uuid.New(),
53+
Ip: pqtype.Inet{
54+
IPNet: *inet,
55+
Valid: true,
56+
},
57+
UserAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36",
58+
ResourceType: database.ResourceTypeOrganization,
59+
ResourceID: uuid.New(),
60+
ResourceTarget: "colin's organization",
61+
Action: database.AuditActionDelete,
62+
Diff: []byte{},
63+
StatusCode: http.StatusNoContent,
64+
}
65+
}

‎coderd/audit/backends/slog.go

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package backends
2+
3+
import (
4+
"context"
5+
6+
"github.com/fatih/structs"
7+
8+
"cdr.dev/slog"
9+
"github.com/coder/coder/coderd/audit"
10+
"github.com/coder/coder/coderd/database"
11+
)
12+
13+
type slogBackend struct {
14+
log slog.Logger
15+
}
16+
17+
func NewSlog(logger slog.Logger) audit.Backend {
18+
return slogBackend{log: logger}
19+
}
20+
21+
func (slogBackend) Decision() audit.FilterDecision {
22+
return audit.FilterDecisionExport
23+
}
24+
25+
func (b slogBackend) Export(ctx context.Context, alog database.AuditLog) error {
26+
m := structs.Map(alog)
27+
fields := make([]slog.Field, 0, len(m))
28+
for k, v := range m {
29+
fields = append(fields, slog.F(k, v))
30+
}
31+
32+
b.log.Info(ctx, "audit_log", fields...)
33+
return nil
34+
}

‎coderd/audit/backends/slog_test.go

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package backends_test
2+
3+
import (
4+
"context"
5+
"testing"
6+
7+
"github.com/fatih/structs"
8+
"github.com/stretchr/testify/require"
9+
10+
"cdr.dev/slog"
11+
"github.com/coder/coder/coderd/audit/backends"
12+
)
13+
14+
func TestSlogBackend(t *testing.T) {
15+
t.Parallel()
16+
t.Run("OK", func(t *testing.T) {
17+
t.Parallel()
18+
19+
var (
20+
ctx, cancel = context.WithCancel(context.Background())
21+
22+
sink = &fakeSink{}
23+
logger = slog.Make(sink)
24+
backend = backends.NewSlog(logger)
25+
26+
alog = randomAuditLog()
27+
)
28+
defer cancel()
29+
30+
err := backend.Export(ctx, alog)
31+
require.NoError(t, err)
32+
require.Len(t, sink.entries, 1)
33+
require.Equal(t, sink.entries[0].Message, "audit_log")
34+
require.Len(t, sink.entries[0].Fields, len(structs.Fields(alog)))
35+
})
36+
}
37+
38+
type fakeSink struct {
39+
entries []slog.SinkEntry
40+
}
41+
42+
func (s *fakeSink) LogEntry(_ context.Context, e slog.SinkEntry) {
43+
s.entries = append(s.entries, e)
44+
}
45+
46+
func (*fakeSink) Sync() {}

‎coderd/audit/exporter.go

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package audit
2+
3+
import (
4+
"context"
5+
6+
"golang.org/x/xerrors"
7+
8+
"github.com/coder/coder/coderd/database"
9+
)
10+
11+
// Backends can store or send audit logs to arbitrary locations.
12+
type Backend interface {
13+
// Decision determines the FilterDecisions that the backend tolerates.
14+
Decision() FilterDecision
15+
// Export sends an audit log to the backend.
16+
Export(ctx context.Context, alog database.AuditLog) error
17+
}
18+
19+
// Exporter exports audit logs to an arbitrary list of backends.
20+
type Exporter struct {
21+
filter Filter
22+
backends []Backend
23+
}
24+
25+
// NewExporter creates an exporter from the given filter and backends.
26+
func NewExporter(filter Filter, backends ...Backend) *Exporter {
27+
return &Exporter{
28+
filter: filter,
29+
backends: backends,
30+
}
31+
}
32+
33+
// Export exports and audit log. Before exporting to a backend, it uses the
34+
// filter to determine if the backend tolerates the audit log. If not, it is
35+
// dropped.
36+
func (e *Exporter) Export(ctx context.Context, alog database.AuditLog) error {
37+
decision, err := e.filter.Check(ctx, alog)
38+
if err != nil {
39+
return xerrors.Errorf("filter check: %w", err)
40+
}
41+
42+
for _, backend := range e.backends {
43+
if decision&backend.Decision() != backend.Decision() {
44+
continue
45+
}
46+
47+
err = backend.Export(ctx, alog)
48+
if err != nil {
49+
// naively return the first error. should probably make this smarter
50+
// by returning multiple errors.
51+
return xerrors.Errorf("export audit log to backend: %w", err)
52+
}
53+
}
54+
return nil
55+
}

‎coderd/audit/exporter_test.go

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
package audit_test
2+
3+
import (
4+
"context"
5+
"net"
6+
"net/http"
7+
"testing"
8+
"time"
9+
10+
"github.com/google/uuid"
11+
"github.com/stretchr/testify/require"
12+
"github.com/tabbed/pqtype"
13+
14+
"github.com/coder/coder/coderd/audit"
15+
"github.com/coder/coder/coderd/database"
16+
)
17+
18+
func TestExporter(t *testing.T) {
19+
t.Parallel()
20+
21+
var tests = []struct {
22+
name string
23+
filterDecision audit.FilterDecision
24+
backendDecision audit.FilterDecision
25+
shouldExport bool
26+
}{
27+
{
28+
name: "ShouldDrop",
29+
filterDecision: audit.FilterDecisionDrop,
30+
backendDecision: audit.FilterDecisionStore,
31+
shouldExport: false,
32+
},
33+
{
34+
name: "ShouldStore",
35+
filterDecision: audit.FilterDecisionStore,
36+
backendDecision: audit.FilterDecisionStore,
37+
shouldExport: true,
38+
},
39+
{
40+
name: "ShouldNotStore",
41+
filterDecision: audit.FilterDecisionExport,
42+
backendDecision: audit.FilterDecisionStore,
43+
shouldExport: false,
44+
},
45+
{
46+
name: "ShouldExport",
47+
filterDecision: audit.FilterDecisionExport,
48+
backendDecision: audit.FilterDecisionExport,
49+
shouldExport: true,
50+
},
51+
{
52+
name: "ShouldNotExport",
53+
filterDecision: audit.FilterDecisionStore,
54+
backendDecision: audit.FilterDecisionExport,
55+
shouldExport: false,
56+
},
57+
{
58+
name: "ShouldStoreOrExport",
59+
filterDecision: audit.FilterDecisionStore | audit.FilterDecisionExport,
60+
backendDecision: audit.FilterDecisionExport,
61+
shouldExport: true,
62+
},
63+
// When more filters are written they should have their own tests.
64+
{
65+
name: "DefaultFilter",
66+
filterDecision: func() audit.FilterDecision {
67+
decision, _ := audit.DefaultFilter.Check(context.Background(), randomAuditLog())
68+
return decision
69+
}(),
70+
backendDecision: audit.FilterDecisionExport,
71+
shouldExport: true,
72+
},
73+
}
74+
75+
for _, test := range tests {
76+
test := test
77+
t.Run(test.name, func(t *testing.T) {
78+
t.Parallel()
79+
80+
var (
81+
backend = &testBackend{decision: test.backendDecision}
82+
exporter = audit.NewExporter(
83+
audit.FilterFunc(func(_ context.Context, _ database.AuditLog) (audit.FilterDecision, error) {
84+
return test.filterDecision, nil
85+
}),
86+
backend,
87+
)
88+
)
89+
90+
err := exporter.Export(context.Background(), randomAuditLog())
91+
require.NoError(t, err)
92+
require.Equal(t, len(backend.alogs) > 0, test.shouldExport)
93+
})
94+
}
95+
}
96+
97+
func randomAuditLog() database.AuditLog {
98+
_, inet, _ := net.ParseCIDR("127.0.0.1/32")
99+
return database.AuditLog{
100+
ID: uuid.New(),
101+
Time: time.Now(),
102+
UserID: uuid.New(),
103+
OrganizationID: uuid.New(),
104+
Ip: pqtype.Inet{
105+
IPNet: *inet,
106+
Valid: true,
107+
},
108+
UserAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36",
109+
ResourceType: database.ResourceTypeOrganization,
110+
ResourceID: uuid.New(),
111+
ResourceTarget: "colin's organization",
112+
Action: database.AuditActionDelete,
113+
Diff: []byte{},
114+
StatusCode: http.StatusNoContent,
115+
}
116+
}
117+
118+
type testBackend struct {
119+
decision audit.FilterDecision
120+
121+
alogs []database.AuditLog
122+
}
123+
124+
func (t *testBackend) Decision() audit.FilterDecision {
125+
return t.decision
126+
}
127+
128+
func (t *testBackend) Export(_ context.Context, alog database.AuditLog) error {
129+
t.alogs = append(t.alogs, alog)
130+
return nil
131+
}

0 commit comments

Comments
 (0)