Skip to content

Commit 47cd78e

Browse files
code-ashercode-asher
committed
feat: audit oauth2 app management
1 parent 7e6cb66 commit 47cd78e

File tree

15 files changed

+207
-57
lines changed

15 files changed

+207
-57
lines changed

‎coderd/apidoc/docs.go

Lines changed: 6 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 6 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,22 @@ func (api *API) auditLogIsResourceDeleted(ctx context.Context, alog database.Get
333333
api.Logger.Error(ctx, "unable to fetch workspace", slog.Error(err))
334334
}
335335
return workspace.Deleted
336+
case database.ResourceTypeOauth2ProviderApp:
337+
_, err := api.Database.GetOAuth2ProviderAppByID(ctx, alog.ResourceID)
338+
if xerrors.Is(err, sql.ErrNoRows) {
339+
return true
340+
} else if err != nil {
341+
api.Logger.Error(ctx, "unable to fetch oauth2 app", slog.Error(err))
342+
}
343+
return false
344+
case database.ResourceTypeOauth2ProviderAppSecret:
345+
_, err := api.Database.GetOAuth2ProviderAppSecretByID(ctx, alog.ResourceID)
346+
if xerrors.Is(err, sql.ErrNoRows) {
347+
return true
348+
} else if err != nil {
349+
api.Logger.Error(ctx, "unable to fetch oauth2 app secret", slog.Error(err))
350+
}
351+
return false
336352
default:
337353
return false
338354
}
@@ -379,6 +395,16 @@ func (api *API) auditLogResourceLink(ctx context.Context, alog database.GetAudit
379395
return fmt.Sprintf("/@%s/%s/builds/%s",
380396
workspaceOwner.Username, additionalFields.WorkspaceName, additionalFields.BuildNumber)
381397

398+
case database.ResourceTypeOauth2ProviderApp:
399+
return fmt.Sprintf("/deployment/oauth2-provider/apps/%s", alog.ResourceID)
400+
401+
case database.ResourceTypeOauth2ProviderAppSecret:
402+
secret, err := api.Database.GetOAuth2ProviderAppSecretByID(ctx, alog.ResourceID)
403+
if err != nil {
404+
return ""
405+
}
406+
return fmt.Sprintf("/deployment/oauth2-provider/apps/%s", secret.AppID)
407+
382408
default:
383409
return ""
384410
}

‎coderd/audit/diff.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ type Auditable interface {
1919
database.License |
2020
database.WorkspaceProxy |
2121
database.AuditOAuthConvertState |
22-
database.HealthSettings
22+
database.HealthSettings |
23+
database.OAuth2ProviderApp |
24+
database.OAuth2ProviderAppSecret
2325
}
2426

2527
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,10 @@ func ResourceTarget[T Auditable](tgt T) string {
9595
return string(typed.ToLoginType)
9696
case database.HealthSettings:
9797
return "" // no target?
98+
case database.OAuth2ProviderApp:
99+
return typed.Name
100+
case database.OAuth2ProviderAppSecret:
101+
return typed.DisplaySecret
98102
default:
99103
panic(fmt.Sprintf("unknown resource %T", tgt))
100104
}
@@ -128,6 +132,10 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
128132
case database.HealthSettings:
129133
// Artificial ID for auditing purposes
130134
return typed.ID
135+
case database.OAuth2ProviderApp:
136+
return typed.ID
137+
case database.OAuth2ProviderAppSecret:
138+
return typed.ID
131139
default:
132140
panic(fmt.Sprintf("unknown resource %T", tgt))
133141
}
@@ -159,6 +167,10 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
159167
return database.ResourceTypeConvertLogin
160168
case database.HealthSettings:
161169
return database.ResourceTypeHealthSettings
170+
case database.OAuth2ProviderApp:
171+
return database.ResourceTypeOauth2ProviderApp
172+
case database.OAuth2ProviderAppSecret:
173+
return database.ResourceTypeOauth2ProviderAppSecret
162174
default:
163175
panic(fmt.Sprintf("unknown resource %T", typed))
164176
}

‎coderd/database/dump.sql

Lines changed: 3 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000197_oauth2_provider_app_audit.down.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
-- It is not possible to drop enum values from enum types, so the UPs on
2+
-- resource_type have "IF NOT EXISTS".

‎coderd/database/migrations/000197_oauth2_provider_app_audit.up.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'oauth2_provider_app';
2+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'oauth2_provider_app_secret';

‎coderd/database/models.go

Lines changed: 20 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎codersdk/audit.go

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,22 @@ import (
1414
type ResourceType string
1515

1616
const (
17-
ResourceTypeTemplate ResourceType = "template"
18-
ResourceTypeTemplateVersion ResourceType = "template_version"
19-
ResourceTypeUser ResourceType = "user"
20-
ResourceTypeWorkspace ResourceType = "workspace"
21-
ResourceTypeWorkspaceBuild ResourceType = "workspace_build"
22-
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
23-
ResourceTypeAPIKey ResourceType = "api_key"
24-
ResourceTypeGroup ResourceType = "group"
25-
ResourceTypeLicense ResourceType = "license"
26-
ResourceTypeConvertLogin ResourceType = "convert_login"
27-
ResourceTypeHealthSettings ResourceType = "health_settings"
28-
ResourceTypeWorkspaceProxy ResourceType = "workspace_proxy"
29-
ResourceTypeOrganization ResourceType = "organization"
17+
ResourceTypeTemplate ResourceType = "template"
18+
ResourceTypeTemplateVersion ResourceType = "template_version"
19+
ResourceTypeUser ResourceType = "user"
20+
ResourceTypeWorkspace ResourceType = "workspace"
21+
ResourceTypeWorkspaceBuild ResourceType = "workspace_build"
22+
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
23+
ResourceTypeAPIKey ResourceType = "api_key"
24+
ResourceTypeGroup ResourceType = "group"
25+
ResourceTypeLicense ResourceType = "license"
26+
ResourceTypeConvertLogin ResourceType = "convert_login"
27+
ResourceTypeHealthSettings ResourceType = "health_settings"
28+
ResourceTypeWorkspaceProxy ResourceType = "workspace_proxy"
29+
ResourceTypeOrganization ResourceType = "organization"
30+
ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app"
31+
// nolint:gosec // This is not a secret.
32+
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
3033
)
3134

3235
func (r ResourceType) FriendlyString() string {
@@ -59,6 +62,11 @@ func (r ResourceType) FriendlyString() string {
5962
return "organization"
6063
case ResourceTypeHealthSettings:
6164
return "health_settings"
65+
case ResourceTypeOAuth2ProviderApp:
66+
return "OAuth2 app"
67+
case ResourceTypeOAuth2ProviderAppSecret:
68+
// OAuth2 secrets have a unique friendly string.
69+
return "OAuth2 app secret"
6270
default:
6371
return "unknown"
6472
}

0 commit comments

Comments
 (0)