opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add GET /api/v2/agent-firewall/sessions/{id}/logs endpoint (#24816)

Browse Source 
Add a `GET /api/v2/agent-firewall/sessions/{id}/logs` endpoint that
returns agent firewall audit logs for a given session, sorted by
sequence number ascending.

The endpoint supports `seq_after` and `seq_before` (exclusive bounds)
and `limit` query parameters. This enables the frontend to fetch exactly
the firewall events that fall between two AI Bridge interceptions within
a thread, as described in FR 4 of the Boundary/Bridge correlation RFC.

Authorization reuses the `boundary_log` RBAC resource (owner and auditor
can read; members cannot). Returns 404 for unauthorized users to avoid
leaking existence information.

The endpoint is enterprise-only, gated behind `FeatureBoundary`
entitlement, matching the session endpoint from #24814.

Depends on #24814

> [!NOTE]
> This PR was authored by Coder Agents.
This commit is contained in:
Sas Swart
2026-06-22 13:56:29 +02:00
committed by GitHub
parent c0b8fa9418
commit 335d6bda1b
13 changed files with 829 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/enterprise.md
Generated
+53
View File
@@ -125,6 +125,59 @@ curl -X GET http://coder-server:8080/api/v2/agent-firewall/sessions/{id} \
To perform this operation, you must be authenticated. [Learn more](authentication.md).
## Get agent firewall session logs
### Code samples
```shell
# Example request using curl
curl -X GET http://coder-server:8080/api/v2/agent-firewall/sessions/{id}/logs \
-H 'Accept: application/json' \
-H 'Coder-Session-Token: API_KEY'
```
`GET /api/v2/agent-firewall/sessions/{id}/logs`
### Parameters
| Name | In | Type | Required | Description |
|--------------|-------|--------------|----------|------------------------------------------------|
| `id` | path | string(uuid) | true | Agent firewall session ID |
| `seq_after` | query | integer | false | Inclusive lower bound on sequence number |
| `seq_before` | query | integer | false | Exclusive upper bound on sequence number |
| `limit` | query | integer | false | Maximum number of logs to return (default 100) |
### Example responses
> 200 Response
```json
{
"results": [
{
"allowed": true,
"captured_at": "2019-08-24T14:15:22Z",
"created_at": "2019-08-24T14:15:22Z",
"detail": "string",
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"matched_rule": "string",
"method": "string",
"proto": "string",
"sequence_number": 0,
"session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82"
}
]
}
```
### Responses
| Status | Meaning | Description | Schema |
|--------|---------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------|
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.AgentFirewallSessionLogsResponse](schemas.md#codersdkagentfirewallsessionlogsresponse) |
To perform this operation, you must be authenticated. [Learn more](authentication.md).
## List AI Gateway keys
### Code samples
docs/reference/api/schemas.md
Generated
+59
View File
@@ -1263,6 +1263,38 @@ None
|-----------------------------------------------|
| `always_collapsed`, `always_expanded`, `auto` |
## codersdk.AgentFirewallLog
```json
{
"allowed": true,
"captured_at": "2019-08-24T14:15:22Z",
"created_at": "2019-08-24T14:15:22Z",
"detail": "string",
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"matched_rule": "string",
"method": "string",
"proto": "string",
"sequence_number": 0,
"session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82"
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|-------------------|---------|----------|--------------|-------------|
| `allowed` | boolean | false | | |
| `captured_at` | string | false | | |
| `created_at` | string | false | | |
| `detail` | string | false | | |
| `id` | string | false | | |
| `matched_rule` | string | false | | |
| `method` | string | false | | |
| `proto` | string | false | | |
| `sequence_number` | integer | false | | |
| `session_id` | string | false | | |
## codersdk.AgentFirewallSession
```json
@@ -1285,6 +1317,33 @@ None
| `started_at` | string | false | | |
| `workspace_id` | string | false | | |
## codersdk.AgentFirewallSessionLogsResponse
```json
{
"results": [
{
"allowed": true,
"captured_at": "2019-08-24T14:15:22Z",
"created_at": "2019-08-24T14:15:22Z",
"detail": "string",
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"matched_rule": "string",
"method": "string",
"proto": "string",
"sequence_number": 0,
"session_id": "1ffd059c-17ea-40a8-8aef-70fd0307db82"
}
]
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|-----------|-----------------------------------------------------------------|----------|--------------|-------------|
| `results` | array of [codersdk.AgentFirewallLog](#codersdkagentfirewalllog) | false | | |
## codersdk.AgentScriptTiming
```json