feat: add support for workspace app audit #16801
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
e94f72d to
054a301
Compare
mafredri
commented
Mar 6, 2025
coderd/database/migrations/000301_add_workspace_app_audit_sessions.up.sql
Show resolved
Hide resolved
johnstcn
reviewed
Mar 6, 2025
Emyrk
reviewed
Mar 6, 2025
coderd/database/migrations/000301_add_workspace_app_audit_sessions.up.sql
Outdated
Show resolved
Hide resolved
johnstcn
reviewed
Mar 7, 2025
coderd/database/migrations/000301_add_workspace_app_audit_sessions.up.sql
Outdated
Show resolved
Hide resolved
de7e913 to
c1ae295
Compare
|
I've implemented the requested changes, PTAL. Up-to-date view of audit log: 
We still don't have any custom handling for terminal entry and port forward entry, they will just say "opened the agent". |
johnstcn
approved these changes
Mar 18, 2025
Comment on lines
+285
to
+292
| switch { | ||
| case alog.AuditLog.StatusCode == int32(http.StatusSeeOther): | ||
| _, _ = b.WriteString("was redirected attempting to ") | ||
| _, _ = b.WriteString(string(alog.AuditLog.Action)) | ||
| case alog.AuditLog.StatusCode >= 400: | ||
| _, _ = b.WriteString("unsuccessfully attempted to ") | ||
| _, _ = b.WriteString(string(alog.AuditLog.Action)) | ||
| } else { | ||
| default: |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adds support for workspace app auditing.
To avoid audit log spam, we introduce the concept of app audit sessions. An audit session is unique per workspace app, user, ip, user agent and http status code. The sessions are stored in a separate table from audit logs to allow use-case specific optimizations. Sessions are ephemeral and the table does not function as a log.
The logic for auditing is placed in the DBTokenProvider for workspace apps so that wsproxies are included.
This is the final change affecting the API fo #15139.
Updates #15139