chore: fully implement enterprise audit pkg (#3821)

enterprise/audit/audit.go

@@ -3,6 +3,8 @@ package audit
 import (
 	"context"
 
+	"golang.org/x/xerrors"
+
 	"github.com/coder/coder/coderd/audit"
 	"github.com/coder/coder/coderd/database"
 )
@@ -15,8 +17,10 @@ type Backend interface {
 	Export(ctx context.Context, alog database.AuditLog) error
 }
 
-func NewAuditor() audit.Auditor {
+func NewAuditor(filter Filter, backends ...Backend) audit.Auditor {
 	return &auditor{
+		filter:   filter,
+		backends: backends,
 		Differ: audit.Differ{DiffFn: func(old, new any) audit.Map {
 			return diffValues(old, new, AuditableResources)
 		}},
@@ -25,15 +29,30 @@ func NewAuditor() audit.Auditor {
 
 // auditor is the enterprise implementation of the Auditor interface.
 type auditor struct {
-	//nolint:unused
-	filter Filter
-	//nolint:unused
+	filter   Filter
 	backends []Backend
 
 	audit.Differ
 }
 
-//nolint:unused
-func (*auditor) Export(context.Context, database.AuditLog) error {
-	panic("not implemented") // TODO: Implement
+func (a *auditor) Export(ctx context.Context, alog database.AuditLog) error {
+	decision, err := a.filter.Check(ctx, alog)
+	if err != nil {
+		return xerrors.Errorf("filter check: %w", err)
+	}
+
+	for _, backend := range a.backends {
+		if decision&backend.Decision() != backend.Decision() {
+			continue
+		}
+
+		err = backend.Export(ctx, alog)
+		if err != nil {
+			// naively return the first error. should probably make this smarter
+			// by returning multiple errors.
+			return xerrors.Errorf("export audit log to backend: %w", err)
+		}
+	}
+
+	return nil
 }

enterprise/audit/audit_test.go

@@ -0,0 +1,130 @@
+package audit_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/enterprise/audit"
+	"github.com/coder/coder/enterprise/audit/audittest"
+)
+
+func TestAuditor(t *testing.T) {
+	t.Parallel()
+
+	var tests = []struct {
+		name            string
+		filterDecision  audit.FilterDecision
+		filterError     error
+		backendDecision audit.FilterDecision
+		backendError    error
+		shouldExport    bool
+	}{
+		{
+			name:            "ShouldDrop",
+			filterDecision:  audit.FilterDecisionDrop,
+			backendDecision: audit.FilterDecisionStore,
+			shouldExport:    false,
+		},
+		{
+			name:            "ShouldStore",
+			filterDecision:  audit.FilterDecisionStore,
+			backendDecision: audit.FilterDecisionStore,
+			shouldExport:    true,
+		},
+		{
+			name:            "ShouldNotStore",
+			filterDecision:  audit.FilterDecisionExport,
+			backendDecision: audit.FilterDecisionStore,
+			shouldExport:    false,
+		},
+		{
+			name:            "ShouldExport",
+			filterDecision:  audit.FilterDecisionExport,
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    true,
+		},
+		{
+			name:            "ShouldNotExport",
+			filterDecision:  audit.FilterDecisionStore,
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    false,
+		},
+		{
+			name:            "ShouldStoreOrExport",
+			filterDecision:  audit.FilterDecisionStore | audit.FilterDecisionExport,
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    true,
+		},
+		{
+			name:            "FilterError",
+			filterError:     xerrors.New("filter errored"),
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    false,
+		},
+		{
+			name:         "BackendError",
+			backendError: xerrors.New("backend errored"),
+			shouldExport: false,
+		},
+		// When more filters are written they should have their own tests.
+		{
+			name: "DefaultFilter",
+			filterDecision: func() audit.FilterDecision {
+				decision, _ := audit.DefaultFilter.Check(context.Background(), audittest.RandomLog())
+				return decision
+			}(),
+			backendDecision: audit.FilterDecisionExport,
+			shouldExport:    true,
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			var (
+				backend  = &testBackend{decision: test.backendDecision, err: test.backendError}
+				exporter = audit.NewAuditor(
+					audit.FilterFunc(func(_ context.Context, _ database.AuditLog) (audit.FilterDecision, error) {
+						return test.filterDecision, test.filterError
+					}),
+					backend,
+				)
+			)
+
+			err := exporter.Export(context.Background(), audittest.RandomLog())
+			if test.filterError != nil {
+				require.ErrorIs(t, err, test.filterError)
+			} else if test.backendError != nil {
+				require.ErrorIs(t, err, test.backendError)
+			}
+
+			require.Equal(t, len(backend.alogs) > 0, test.shouldExport)
+		})
+	}
+}
+
+type testBackend struct {
+	decision audit.FilterDecision
+	err      error
+
+	alogs []database.AuditLog
+}
+
+func (t *testBackend) Decision() audit.FilterDecision {
+	return t.decision
+}
+
+func (t *testBackend) Export(_ context.Context, alog database.AuditLog) error {
+	if t.err != nil {
+		return t.err
+	}
+
+	t.alogs = append(t.alogs, alog)
+	return nil
+}

enterprise/audit/audittest/rand.go

@@ -0,0 +1,33 @@
+package audittest
+
+import (
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/tabbed/pqtype"
+
+	"github.com/coder/coder/coderd/database"
+)
+
+func RandomLog() database.AuditLog {
+	_, inet, _ := net.ParseCIDR("127.0.0.1/32")
+	return database.AuditLog{
+		ID:             uuid.New(),
+		Time:           time.Now(),
+		UserID:         uuid.New(),
+		OrganizationID: uuid.New(),
+		Ip: pqtype.Inet{
+			IPNet: *inet,
+			Valid: true,
+		},
+		UserAgent:      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36",
+		ResourceType:   database.ResourceTypeOrganization,
+		ResourceID:     uuid.New(),
+		ResourceTarget: "colin's organization",
+		Action:         database.AuditActionDelete,
+		Diff:           []byte("{}"),
+		StatusCode:     http.StatusNoContent,
+	}
+}

enterprise/audit/backends/postgres.go

@@ -0,0 +1,40 @@
+package backends
+
+import (
+	"context"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/enterprise/audit"
+)
+
+type postgresBackend struct {
+	// internal indicates if the exporter is exporting to the Postgres database
+	// that the rest of Coderd uses. Since this is a generic Postgres exporter,
+	// we make different decisions to store the audit log based on if it's
+	// pointing to the Coderd database.
+	internal bool
+	db       database.Store
+}
+
+func NewPostgres(db database.Store, internal bool) audit.Backend {
+	return &postgresBackend{db: db, internal: internal}
+}
+
+func (b *postgresBackend) Decision() audit.FilterDecision {
+	if b.internal {
+		return audit.FilterDecisionStore
+	}
+
+	return audit.FilterDecisionExport
+}
+
+func (b *postgresBackend) Export(ctx context.Context, alog database.AuditLog) error {
+	_, err := b.db.InsertAuditLog(ctx, database.InsertAuditLogParams(alog))
+	if err != nil {
+		return xerrors.Errorf("insert audit log: %w", err)
+	}
+
+	return nil
+}

enterprise/audit/backends/postgres_test.go

@@ -0,0 +1,42 @@
+package backends_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/enterprise/audit/audittest"
+	"github.com/coder/coder/enterprise/audit/backends"
+)
+
+func TestPostgresBackend(t *testing.T) {
+	t.Parallel()
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx, cancel = context.WithCancel(context.Background())
+			db          = databasefake.New()
+			pgb         = backends.NewPostgres(db, true)
+			alog        = audittest.RandomLog()
+		)
+		defer cancel()
+
+		err := pgb.Export(ctx, alog)
+		require.NoError(t, err)
+
+		got, err := db.GetAuditLogsBefore(ctx, database.GetAuditLogsBeforeParams{
+			ID:        uuid.Nil,
+			StartTime: time.Now().Add(time.Second),
+			RowLimit:  1,
+		})
+		require.NoError(t, err)
+		require.Len(t, got, 1)
+		require.Equal(t, alog, got[0])
+	})
+}

enterprise/audit/backends/slog.go

@@ -0,0 +1,34 @@
+package backends
+
+import (
+	"context"
+
+	"github.com/fatih/structs"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/enterprise/audit"
+)
+
+type slogBackend struct {
+	log slog.Logger
+}
+
+func NewSlog(logger slog.Logger) audit.Backend {
+	return slogBackend{log: logger}
+}
+
+func (slogBackend) Decision() audit.FilterDecision {
+	return audit.FilterDecisionExport
+}
+
+func (b slogBackend) Export(ctx context.Context, alog database.AuditLog) error {
+	m := structs.Map(alog)
+	fields := make([]slog.Field, 0, len(m))
+	for k, v := range m {
+		fields = append(fields, slog.F(k, v))
+	}
+
+	b.log.Info(ctx, "audit_log", fields...)
+	return nil
+}

enterprise/audit/backends/slog_test.go

@@ -0,0 +1,47 @@
+package backends_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/fatih/structs"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/enterprise/audit/audittest"
+	"github.com/coder/coder/enterprise/audit/backends"
+)
+
+func TestSlogBackend(t *testing.T) {
+	t.Parallel()
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx, cancel = context.WithCancel(context.Background())
+
+			sink    = &fakeSink{}
+			logger  = slog.Make(sink)
+			backend = backends.NewSlog(logger)
+
+			alog = audittest.RandomLog()
+		)
+		defer cancel()
+
+		err := backend.Export(ctx, alog)
+		require.NoError(t, err)
+		require.Len(t, sink.entries, 1)
+		require.Equal(t, sink.entries[0].Message, "audit_log")
+		require.Len(t, sink.entries[0].Fields, len(structs.Fields(alog)))
+	})
+}
+
+type fakeSink struct {
+	entries []slog.SinkEntry
+}
+
+func (s *fakeSink) LogEntry(_ context.Context, e slog.SinkEntry) {
+	s.entries = append(s.entries, e)
+}
+
+func (*fakeSink) Sync() {}

enterprise/audit/generate.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+# This script facilitates code generation for auditing types. It outputs code
+# that can be copied and pasted into the audit.AuditableResources table. By
+# default, every field is ignored. It is your responsibility to go through each
+# field and document why each field should or should not be audited.
+#
+# Usage:
+# ./generate.sh <database type> <database type> ...
+
+set -euo pipefail
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+PROJECT_ROOT=$(cd "$SCRIPT_DIR" && git rev-parse --show-toplevel)
+
+(
+	cd "$PROJECT_ROOT"
+	go run ./scripts/auditgen ./coderd/database "$@"
+)