Skip to content

feat: add support for workspace app audit #16801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 40 commits into from
Mar 18, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
d235001
add migrations
mafredri Mar 3, 2025
b18740c
add queries
mafredri Mar 3, 2025
4dfb4fb
make gen
mafredri Mar 3, 2025
7d7922c
add user-agent support to background audit
mafredri Mar 4, 2025
19ca904
add done func support for tracing response writer
mafredri Mar 4, 2025
30bb732
wip auditor
mafredri Mar 3, 2025
94ddbbe
linttt
mafredri Mar 4, 2025
bef7614
dbmem impl
mafredri Mar 4, 2025
d13d3c0
resolve request with middleware
mafredri Mar 4, 2025
9a3a4c8
refactor tracing status writer done func
mafredri Mar 5, 2025
1f4e95b
fix audit mock check
mafredri Mar 5, 2025
bda2d12
mimic http response writer default status 200
mafredri Mar 5, 2025
93784b9
update db tests
mafredri Mar 5, 2025
e38ba0f
dbauthz
mafredri Mar 5, 2025
5f0c141
add app audit session timeout to dbtokenprovider
mafredri Mar 5, 2025
ae06fe4
remove log spam
mafredri Mar 5, 2025
cf1180e
verify audit log
mafredri Mar 5, 2025
623ad6f
add specific test for audit
mafredri Mar 5, 2025
c91024e
cleanup request context hack
mafredri Mar 5, 2025
9608da1
nonlint
mafredri Mar 5, 2025
5bb42c2
add slug or port to support separation of terminal and ports
mafredri Mar 6, 2025
14a1740
make gen
mafredri Mar 6, 2025
4426bcf
improve and reduce boilerplate in tests
mafredri Mar 6, 2025
2c1536e
fixup! add slug or port to support separation of terminal and ports
mafredri Mar 6, 2025
c070d74
move RandomIPv6 to testutil
mafredri Mar 10, 2025
8a61541
commit audit in Issue, revert tracing status writer changes
mafredri Mar 10, 2025
7279b9a
return if tx failed
mafredri Mar 10, 2025
4ff41d4
add fields to audit logger
mafredri Mar 10, 2025
c723b95
comment on WorkspaceAppAuditSessionTimeout use-case
mafredri Mar 17, 2025
217a0d3
update migrations, add status and ua, unique entries
mafredri Mar 17, 2025
336c7b8
rewrite queries, single upsert
mafredri Mar 17, 2025
8d7a763
make gen for db
mafredri Mar 17, 2025
0f162b1
simplify auditInitRequest in workspaceapps
mafredri Mar 17, 2025
22ea58c
update tests
mafredri Mar 17, 2025
119cf03
fix fixtures
mafredri Mar 17, 2025
16ae577
fix dbauthz
mafredri Mar 17, 2025
9003ae0
Merge branch 'main' into mafredri/app-audit
mafredri Mar 17, 2025
c1ae295
fix ip nullability
mafredri Mar 17, 2025
1ee8441
add exception for redirect in audit log
mafredri Mar 17, 2025
5b3b122
unused arg
mafredri Mar 17, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
add migrations
  • Loading branch information
mafredri committed Mar 6, 2025
commit d235001ec80c15722136e8b5cc4a062a666bbf4e
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
DROP TABLE workspace_app_audit_sessions;
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
CREATE UNLOGGED TABLE workspace_app_audit_sessions (
id UUID PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
agent_id UUID NOT NULL,
app_id UUID NULL,
user_id UUID,
ip inet,
started_at TIMESTAMP WITH TIME ZONE NOT NULL,
updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
FOREIGN KEY (agent_id) REFERENCES workspace_agents (id) ON DELETE CASCADE,
FOREIGN KEY (app_id) REFERENCES workspace_apps (id) ON DELETE CASCADE
);

COMMENT ON TABLE workspace_app_audit_sessions IS 'Audit sessions for workspace apps, the data in this table is ephemeral and is used to track the current session of a user in a workspace app.';
COMMENT ON COLUMN workspace_app_audit_sessions.id IS 'Unique identifier for the workspace app audit session.';
COMMENT ON COLUMN workspace_app_audit_sessions.user_id IS 'The user that is currently using the workspace app. This is nullable because the app may be public.';
COMMENT ON COLUMN workspace_app_audit_sessions.ip IS 'The IP address of the user that is currently using the workspace app.';
COMMENT ON COLUMN workspace_app_audit_sessions.agent_id IS 'The agent that is currently in the workspace app.';
COMMENT ON COLUMN workspace_app_audit_sessions.app_id IS 'The app that is currently in the workspace app. This is nullable because ports are not associated with an app.';
COMMENT ON COLUMN workspace_app_audit_sessions.started_at IS 'The time the user started the session.';
COMMENT ON COLUMN workspace_app_audit_sessions.updated_at IS 'The time the session was last updated.';

CREATE INDEX workspace_app_audit_sessions_agent_id_app_id ON workspace_app_audit_sessions (agent_id, app_id);

COMMENT ON INDEX workspace_app_audit_sessions_agent_id_app_id IS 'Index for the agent_id and app_id columns to perform updates.';
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
INSERT INTO workspace_app_audit_sessions
(agent_id, app_id, user_id, ip, started_at, updated_at)
VALUES
('45e89705-e09d-4850-bcec-f9a937f5d78d', '36b65d0c-042b-4653-863a-655ee739861c', '30095c71-380b-457a-8995-97b8ee6e5307', '127.0.0.1', '2025-03-04 15:08:38.579772+02', '2025-03-04 15:06:48.755158+02'),
('45e89705-e09d-4850-bcec-f9a937f5d78d', '36b65d0c-042b-4653-863a-655ee739861c', NULL, '127.0.0.1', '2025-03-04 15:08:44.411389+02', '2025-03-04 15:08:44.411389+02'),
('45e89705-e09d-4850-bcec-f9a937f5d78d', NULL, NULL, '::1', '2025-03-04 15:25:55.555306+02', '2025-03-04 15:25:55.555306+02');