coder · coadler · Sep 2, 2022 · Sep 1, 2022 · Sep 1, 2022 · Sep 2, 2022
diff --git a/coderd/audit/exporter.go b/coderd/audit/exporter.go
diff --git a/coderd/audit/filter.go b/coderd/audit/filter.go
diff --git a/coderd/audit/request.go b/coderd/audit/request.go
@@ -2,22 +2,28 @@ package audit
 
 import (
 	"context"
+	"encoding/json"
+	"net"
 	"net/http"
 
-	chimw "github.com/go-chi/chi/v5/middleware"
 	"github.com/google/uuid"
+	"github.com/tabbed/pqtype"
 
 	"cdr.dev/slog"
 	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
 )
 
 type RequestParams struct {
 	Audit Auditor
 	Log   slog.Logger
 
-	Action       database.AuditAction
-	ResourceType database.ResourceType
-	Actor        uuid.UUID
+	Request        *http.Request
+	ResourceID     uuid.UUID
+	ResourceTarget string
+	Action         database.AuditAction
+	ResourceType   database.ResourceType
+	Actor          uuid.UUID
 }
 
 type Request[T Auditable] struct {
@@ -31,9 +37,9 @@ type Request[T Auditable] struct {
 // that should be deferred, causing the audit log to be committed when the
 // handler returns.
 func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request[T], func()) {
-	sw, ok := w.(chimw.WrapResponseWriter)
+	sw, ok := w.(*httpapi.StatusWriter)
 	if !ok {
-		panic("dev error: http.ResponseWriter is not chimw.WrapResponseWriter")
+		panic("dev error: http.ResponseWriter is not *httpapi.StatusWriter")
 	}
 
 	req := &Request[T]{
@@ -42,11 +48,54 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 
 	return req, func() {
 		ctx := context.Background()
-		code := sw.Status()
 
-		err := p.Audit.Export(ctx, database.AuditLog{StatusCode: int32(code)})
+		diff := Diff(p.Audit, req.Old, req.New)
+		diffRaw, _ := json.Marshal(diff)
+
+		ip, err := parseIP(p.Request.RemoteAddr)
+		if err != nil {
+			p.Log.Warn(ctx, "parse ip", slog.Error(err))
+		}
+
+		err = p.Audit.Export(ctx, database.AuditLog{
+			ID:             uuid.New(),
+			Time:           database.Now(),
+			UserID:         p.Actor,
+			Ip:             ip,
+			UserAgent:      p.Request.UserAgent(),
+			ResourceType:   p.ResourceType,
+			ResourceID:     p.ResourceID,
+			ResourceTarget: p.ResourceTarget,
+			Action:         p.Action,
+			Diff:           diffRaw,
+			StatusCode:     int32(sw.Status),
+		})
 		if err != nil {
 			p.Log.Error(ctx, "export audit log", slog.Error(err))
 		}
 	}
 }
+
+func parseIP(ipStr string) (pqtype.Inet, error) {
+	var err error
+
+	ipStr, _, err = net.SplitHostPort(ipStr)
+	if err != nil {
+		return pqtype.Inet{}, err
+	}
+
+	ip := net.ParseIP(ipStr)
+
+	ipNet := net.IPNet{}
+	if ip != nil {
+		ipNet = net.IPNet{
+			IP:   ip,
+			Mask: net.CIDRMask(len(ip)*8, len(ip)*8),
+		}
+	}
+
+	return pqtype.Inet{
+		IPNet: ipNet,
+		Valid: ip != nil,
+	}, nil
+}
diff --git a/coderd/database/time.go b/coderd/database/time.go
@@ -4,5 +4,11 @@ import "time"
 
 // Now returns a standardized timezone used for database resources.
 func Now() time.Time {
-	return time.Now().UTC()
+	return Time(time.Now().UTC())
+}
+
+// Time returns a time compatible with Postgres. Postgres only stores dates with
+// microsecond precision.
+func Time(t time.Time) time.Time {
+	return t.Round(time.Microsecond)
 }
diff --git a/enterprise/audit/audit.go b/enterprise/audit/audit.go
@@ -3,6 +3,8 @@ package audit
 import (
 	"context"
 
+	"golang.org/x/xerrors"
+
 	"github.com/coder/coder/coderd/audit"
 	"github.com/coder/coder/coderd/database"
 )
@@ -15,8 +17,10 @@ type Backend interface {
 	Export(ctx context.Context, alog database.AuditLog) error
 }
 
-func NewAuditor() audit.Auditor {
+func NewAuditor(filter Filter, backends ...Backend) audit.Auditor {
 	return &auditor{
+		filter:   filter,
+		backends: backends,
 		Differ: audit.Differ{DiffFn: func(old, new any) audit.Map {
 			return diffValues(old, new, AuditableResources)
 		}},
@@ -25,15 +29,30 @@ func NewAuditor() audit.Auditor {
 
 // auditor is the enterprise implementation of the Auditor interface.
 type auditor struct {
-	//nolint:unused
-	filter Filter
-	//nolint:unused
+	filter   Filter
 	backends []Backend
 
 	audit.Differ
 }
 
-//nolint:unused
-func (*auditor) Export(context.Context, database.AuditLog) error {
-	panic("not implemented") // TODO: Implement
+func (a *auditor) Export(ctx context.Context, alog database.AuditLog) error {
+	decision, err := a.filter.Check(ctx, alog)
+	if err != nil {
+		return xerrors.Errorf("filter check: %w", err)
+	}
+
+	for _, backend := range a.backends {
+		if decision&backend.Decision() != backend.Decision() {
+			continue
+		}
+
+		err = backend.Export(ctx, alog)
+		if err != nil {
+			// naively return the first error. should probably make this smarter
+			// by returning multiple errors.
+			return xerrors.Errorf("export audit log to backend: %w", err)
+		}
+	}
+
+	return nil
 }
diff --git a/coderd/audit/exporter_test.go → enterprise/audit/audit_test.go b/coderd/audit/exporter_test.go → enterprise/audit/audit_test.go
@@ -2,26 +2,25 @@ package audit_test
 
 import (
 	"context"
-	"net"
-	"net/http"
 	"testing"
-	"time"
 
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
-	"github.com/tabbed/pqtype"
+	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
 	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/enterprise/audit"
+	"github.com/coder/coder/enterprise/audit/audittest"
 )
 
-func TestExporter(t *testing.T) {
+func TestAuditor(t *testing.T) {
 	t.Parallel()
 
 	var tests = []struct {
 		name            string
 		filterDecision  audit.FilterDecision
+		filterError     error
 		backendDecision audit.FilterDecision
+		backendError    error
 		shouldExport    bool
 	}{
 		{
@@ -60,11 +59,22 @@ func TestExporter(t *testing.T) {
 			backendDecision: audit.FilterDecisionExport,
 			shouldExport:    true,
 		},
+		{
+			name:            "FilterError",
+			filterError:     xerrors.New("filter errored"),
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    false,
+		},
+		{
+			name:         "BackendError",
+			backendError: xerrors.New("backend errored"),
+			shouldExport: false,
+		},
 		// When more filters are written they should have their own tests.
 		{
 			name: "DefaultFilter",
 			filterDecision: func() audit.FilterDecision {
-				decision, _ := audit.DefaultFilter.Check(context.Background(), randomAuditLog())
+				decision, _ := audit.DefaultFilter.Check(context.Background(), audittest.RandomLog())
 				return decision
 			}(),
 			backendDecision: audit.FilterDecisionExport,
@@ -78,45 +88,30 @@ func TestExporter(t *testing.T) {
 			t.Parallel()
 
 			var (
-				backend  = &testBackend{decision: test.backendDecision}
-				exporter = audit.NewExporter(
+				backend  = &testBackend{decision: test.backendDecision, err: test.backendError}
+				exporter = audit.NewAuditor(
 					audit.FilterFunc(func(_ context.Context, _ database.AuditLog) (audit.FilterDecision, error) {
-						return test.filterDecision, nil
+						return test.filterDecision, test.filterError
 					}),
 					backend,
 				)
 			)
 
-			err := exporter.Export(context.Background(), randomAuditLog())
-			require.NoError(t, err)
+			err := exporter.Export(context.Background(), audittest.RandomLog())
+			if test.filterError != nil {
+				require.ErrorIs(t, err, test.filterError)
+			} else if test.backendError != nil {
+				require.ErrorIs(t, err, test.backendError)
+			}
+
 			require.Equal(t, len(backend.alogs) > 0, test.shouldExport)
 		})
 	}
 }
 
-func randomAuditLog() database.AuditLog {
-	_, inet, _ := net.ParseCIDR("127.0.0.1/32")
-	return database.AuditLog{
-		ID:             uuid.New(),
-		Time:           time.Now(),
-		UserID:         uuid.New(),
-		OrganizationID: uuid.New(),
-		Ip: pqtype.Inet{
-			IPNet: *inet,
-			Valid: true,
-		},
-		UserAgent:      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36",
-		ResourceType:   database.ResourceTypeOrganization,
-		ResourceID:     uuid.New(),
-		ResourceTarget: "colin's organization",
-		Action:         database.AuditActionDelete,
-		Diff:           []byte{},
-		StatusCode:     http.StatusNoContent,
-	}
-}
-
 type testBackend struct {
 	decision audit.FilterDecision
+	err      error
 
 	alogs []database.AuditLog
 }
@@ -126,6 +121,10 @@ func (t *testBackend) Decision() audit.FilterDecision {
 }
 
 func (t *testBackend) Export(_ context.Context, alog database.AuditLog) error {
+	if t.err != nil {
+		return t.err
+	}
+
 	t.alogs = append(t.alogs, alog)
 	return nil
 }