Skip to content

feat: add workspace build start/stop to audit log #4744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 14 commits into from
Oct 25, 2022
Merged

feat: add workspace build start/stop to audit log #4744

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
cfe5dd0
adding workspace_build resource
Kira-Pilot Oct 18, 2022
5d094a2
added migration
Kira-Pilot Oct 19, 2022
c11befc
fix keyword
Kira-Pilot Oct 19, 2022
ac6e405
got rid oof diffs for workspace builds
Kira-Pilot Oct 20, 2022
ec3e6bf
adding workspace name to string
Kira-Pilot Oct 21, 2022
c0ffe78
renamed migrations
Kira-Pilot Oct 21, 2022
7e09219
fixed lint
Kira-Pilot Oct 21, 2022
9cd9ea9
pass throough AdditionalFields and fix tests
Kira-Pilot Oct 21, 2022
76438e1
no need to pass through each handler
Kira-Pilot Oct 24, 2022
eba75cf
cleaned up migrations
Kira-Pilot Oct 24, 2022
97233a0
generated types; fixed missing cases
Kira-Pilot Oct 25, 2022
5946e8b
Merge remote-tracking branch 'origin/main' into add-start-stop-audit/…
Kira-Pilot Oct 25, 2022
3200a10
Merge remote-tracking branch 'origin/main' into add-start-stop-audit/…
Kira-Pilot Oct 25, 2022
1112a66
logging error
Kira-Pilot Oct 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
adding workspace_build resource
  • Loading branch information
@Kira-Pilot
Kira-Pilot committed Oct 25, 2022
commit cfe5dd097678e80ac0ce661ee6e921cc76d7499b
2 changes: 2 additions & 0 deletions coderd/audit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,6 +288,8 @@ func resourceTypeFromString(resourceTypeString string) string {
return resourceTypeString
case codersdk.ResourceTypeWorkspace:
return resourceTypeString
case codersdk.ResourceTypeWorkspaceBuild:
return resourceTypeString
case codersdk.ResourceTypeGitSSHKey:
return resourceTypeString
case codersdk.ResourceTypeAPIKey:
Expand Down
3 changes: 2 additions & 1 deletion coderd/audit/diff.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ type Auditable interface {
database.User |
database.Workspace |
database.GitSSHKey |
database.Group
database.Group |
database.WorkspaceBuild
}

// Map is a map of changed fields in an audited resource. It maps field names to
Expand Down
6 changes: 6 additions & 0 deletions coderd/audit/request.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ func ResourceTarget[T Auditable](tgt T) string {
return typed.Username
case database.Workspace:
return typed.Name
case database.WorkspaceBuild:
return string(typed.Transition)
case database.GitSSHKey:
return typed.PublicKey
case database.Group:
Expand All @@ -64,6 +66,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
return typed.ID
case database.Workspace:
return typed.ID
case database.WorkspaceBuild:
return typed.ID
case database.GitSSHKey:
return typed.UserID
case database.Group:
Expand All @@ -85,6 +89,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
return database.ResourceTypeUser
case database.Workspace:
return database.ResourceTypeWorkspace
case database.WorkspaceBuild:
return database.ResourceTypeWorkspaceBuild
case database.GitSSHKey:
return database.ResourceTypeGitSshKey
case database.Group:
Expand Down
28 changes: 23 additions & 5 deletions coderd/workspacebuilds.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,10 +278,11 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
return
}

// we only want to create audit logs for delete builds right now
auditor := api.Auditor.Load()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not really related to your PR since this was already here so feel free to ignore but I wonder if the auditor should be set up before the authorization check so we can log unauthorized request attempts.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good eye! We have a separate ticket for this!


// if user deletes a workspace, audit the workspace
if action == rbac.ActionDelete {
var (
auditor = api.Auditor.Load()
aReq, commitAudit = audit.InitRequest[database.Workspace](rw, &audit.RequestParams{
Audit: *auditor,
Log: api.Logger,
Expand All @@ -294,12 +295,29 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
aReq.Old = workspace
}

latestBuild, latestBuildErr := api.Database.GetLatestWorkspaceBuildByWorkspaceID(ctx, workspace.ID)

// if a user starts/stops a workspace, audit the workspace build
if action == rbac.ActionUpdate {

var (
aReq, commitAudit = audit.InitRequest[database.WorkspaceBuild](rw, &audit.RequestParams{
Audit: *auditor,
Log: api.Logger,
Request: r,
Action: database.AuditActionWrite,
})
)

defer commitAudit()
aReq.Old = latestBuild
}

if createBuild.TemplateVersionID == uuid.Nil {
latestBuild, err := api.Database.GetLatestWorkspaceBuildByWorkspaceID(ctx, workspace.ID)
if err != nil {
if latestBuildErr != nil {
httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
Message: "Internal error fetching the latest workspace build.",
Detail: err.Error(),
Detail: latestBuildErr.Error(),
})
return
}
Expand Down
3 changes: 3 additions & 0 deletions codersdk/audit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ const (
ResourceTypeTemplateVersion ResourceType = "template_version"
ResourceTypeUser ResourceType = "user"
ResourceTypeWorkspace ResourceType = "workspace"
ResourceTypeWorkspaceBuild ResourceType = "workspace_build"
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
ResourceTypeAPIKey ResourceType = "api_key"
ResourceTypeGroup ResourceType = "group"
Expand All @@ -36,6 +37,8 @@ func (r ResourceType) FriendlyString() string {
return "user"
case ResourceTypeWorkspace:
return "workspace"
case ResourceTypeWorkspaceBuild:
return "workspace build"
case ResourceTypeGitSSHKey:
return "git ssh key"
case ResourceTypeAPIKey:
Expand Down
14 changes: 14 additions & 0 deletions enterprise/audit/table.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,20 @@ var AuditableResources = auditMap(map[any]map[string]Action{
"organization_id": ActionIgnore, // Never changes.
"avatar_url": ActionTrack,
},
&database.WorkspaceBuild{}: {
"id": ActionIgnore, // Unimportant to the user
"created_at": ActionIgnore, // Never changes.
"updated_at": ActionIgnore, // Changes, but is implicit and not helpful in a diff.
"workspace_id": ActionTrack,
"template_version_id": ActionTrack,
"build_number": ActionIgnore, // Unimportant to the user
"transition": ActionTrack,
"initiator_id": ActionIgnore, // Changes, but is implicit and not helpful in a diff.
"provisioner_state": ActionIgnore, // Unimportant to the user
"job_id": ActionIgnore, // Unimportant to the user
"deadline": ActionIgnore, // Unimportant to the user
"reason": ActionTrack,
},
})

// auditMap converts a map of struct pointers to a map of struct names as
Expand Down