audit delete licenses

coder · Kira-Pilot · Feb 14, 2023 · Feb 8, 2023 · Feb 8, 2023 · Feb 8, 2023
commit 6c7429243b45a7025d85be85250f77edfa4b764f
diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go
@@ -15,7 +15,8 @@ type Auditable interface {
 		database.Workspace |
 		database.GitSSHKey |
 		database.WorkspaceBuild |
-		database.AuditableGroup
+		database.AuditableGroup |
+		database.License
 }
 
 // Map is a map of changed fields in an audited resource. It maps field names to

diff --git a/coderd/audit/request.go b/coderd/audit/request.go
@@ -99,7 +99,7 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 		return typed.UserID
 	case database.License:
 		// this isn't right
-		return uuid.Nil
+		return uuid.New()
 	default:
 		panic(fmt.Sprintf("unknown resource %T", tgt))
 	}
@@ -134,6 +134,7 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
 // that should be deferred, causing the audit log to be committed when the
 // handler returns.
 func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request[T], func()) {
+	fmt.Println("im in the init request")
 	sw, ok := w.(*tracing.StatusWriter)
 	if !ok {
 		panic("dev error: http.ResponseWriter is not *tracing.StatusWriter")
@@ -144,6 +145,8 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 	}
 
 	return req, func() {
+		fmt.Println("im in the init request callback")
+
 		ctx := context.Background()
 		logCtx := p.Request.Context()
 
@@ -155,6 +158,8 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 			// TODO: introduce the concept of an anonymous user so we always have a userID even
 			// when dealing with a mystery user. https://github.com/coder/coder/issues/6054
 			if req.params.Action != database.AuditActionLogin && req.params.Action != database.AuditActionLogout {
+				fmt.Println("im silently bailing")
+
 				return
 			}
 		}

diff --git a/coderd/database/dbfake/databasefake.go b/coderd/database/dbfake/databasefake.go
@@ -3808,6 +3808,18 @@ func (q *fakeQuerier) InsertLicense(
 	return l, nil
 }
 
+func (q *fakeQuerier) GetLicense(_ context.Context, id int32) (database.License, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, l := range q.licenses {
+		if l.ID == id {
+			return l, nil
+		}
+	}
+	return database.License{}, sql.ErrNoRows
+}
+
 func (q *fakeQuerier) GetLicenses(_ context.Context) ([]database.License, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()

diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/licenses.sql b/coderd/database/queries/licenses.sql
@@ -9,6 +9,11 @@ INSERT INTO
 VALUES
 	($1, $2, $3, $4) RETURNING *;
 
+-- name: GetLicense :one
+SELECT *
+FROM licenses
+WHERE id = $1;
+
 -- name: GetLicenses :many
 SELECT *
 FROM licenses

diff --git a/codersdk/audit.go b/codersdk/audit.go
@@ -45,6 +45,8 @@ func (r ResourceType) FriendlyString() string {
 		return "api key"
 	case ResourceTypeGroup:
 		return "group"
+	case ResourceTypeLicense:
+		return "license"
 	default:
 		return "unknown"
 	}

diff --git a/enterprise/coderd/licenses.go b/enterprise/coderd/licenses.go
@@ -8,6 +8,7 @@ import (
 	_ "embed"
 	"encoding/base64"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
@@ -20,6 +21,7 @@ import (
 
 	"cdr.dev/slog"
 	"github.com/coder/coder/coderd"
+	"github.com/coder/coder/coderd/audit"
 	"github.com/coder/coder/coderd/database"
 	"github.com/coder/coder/coderd/httpapi"
 	"github.com/coder/coder/coderd/rbac"
@@ -59,7 +61,19 @@ var Keys = map[string]ed25519.PublicKey{"2022-08-12": ed25519.PublicKey(key20220
 // @Success 201 {object} codersdk.License
 // @Router /licenses [post]
 func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
+	fmt.Println("im in postLicense")
+	var (
+		ctx               = r.Context()
+		auditor           = api.AGPL.Auditor.Load()
+		aReq, commitAudit = audit.InitRequest[database.License](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     api.Logger,
+			Request: r,
+			Action:  database.AuditActionCreate,
+		})
+	)
+	defer commitAudit()
+
 	if !api.AGPL.Authorize(r, rbac.ActionCreate, rbac.ResourceLicense) {
 		httpapi.Forbidden(rw)
 		return
@@ -114,6 +128,8 @@ func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	aReq.New = dl
+
 	err = api.updateEntitlements(ctx)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
@@ -181,11 +197,10 @@ func (api *API) licenses(rw http.ResponseWriter, r *http.Request) {
 // @Success 200
 // @Router /licenses/{id} [delete]
 func (api *API) deleteLicense(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	if !api.AGPL.Authorize(r, rbac.ActionDelete, rbac.ResourceLicense) {
-		httpapi.Forbidden(rw)
-		return
-	}
+	var (
+		ctx     = r.Context()
+		auditor = api.AGPL.Auditor.Load()
+	)
 
 	idStr := chi.URLParam(r, "id")
 	id, err := strconv.ParseInt(idStr, 10, 32)
@@ -196,6 +211,27 @@ func (api *API) deleteLicense(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	license, err := api.Database.GetLicense(ctx, int32(id))
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+			Message: "Could not retrieve license; cannot audit",
+		})
+	}
+
+	aReq, commitAudit := audit.InitRequest[database.License](rw, &audit.RequestParams{
+		Audit:   *auditor,
+		Log:     api.Logger,
+		Request: r,
+		Action:  database.AuditActionDelete,
+	})
+	defer commitAudit()
+	aReq.Old = license
+
+	if !api.AGPL.Authorize(r, rbac.ActionDelete, rbac.ResourceLicense) {
+		httpapi.Forbidden(rw)
+		return
+	}
+
 	_, err = api.Database.DeleteLicense(ctx, int32(id))
 	if xerrors.Is(err, sql.ErrNoRows) {
 		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{