DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Add actionlog debugging flag, implement policies

Browse Source
This commit is contained in:
Denis Arh
2020-06-01 23:13:04 +02:00
parent f05d2fc257
commit 4245630ec6
9 changed files with 97 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compose/app.go
+2 -1
View File
@@ -62,7 +62,8 @@ func (app *App) Upgrade(ctx context.Context) (err error) {
func (app *App) Initialize(ctx context.Context) (err error) {
// Connects to all services it needs to
err = service.Initialize(ctx, app.Log, service.Config{
Storage: app.Opts.Storage,
ActionLog: app.Opts.ActionLog,
Storage: app.Opts.Storage,
})
if err != nil {
compose/service/service.go
+17 -6
View File
@@ -30,6 +30,7 @@ type (
}
Config struct {
ActionLog options.ActionLogOpt
Storage options.StorageOpt
GRPCClientSystem options.GRPCServerOpt
}
@@ -77,12 +78,22 @@ func Initialize(ctx context.Context, log *zap.Logger, c Config) (err error) {
DefaultLogger = log.Named("service")
DefaultActionlog = actionlog.NewService(
// will log directly to system schema for now
actionlogRepository.Mysql(repository.DB(ctx), "sys_actionlog"),
log,
log,
)
{
tee := log
policy := actionlog.MakeProductionPolicy()
if c.ActionLog.Debug {
tee = zap.NewNop()
policy = actionlog.MakeDebugPolicy()
}
DefaultActionlog = actionlog.NewService(
// will log directly to system schema for now
actionlogRepository.Mysql(repository.DB(ctx).Quiet(), "sys_actionlog"),
log,
tee,
policy,
)
}
if DefaultPermissions == nil {
// Do not override permissions service stored under DefaultPermissions
messaging/app.go
+2 -1
View File
@@ -67,7 +67,8 @@ func (app *App) Upgrade(ctx context.Context) (err error) {
func (app *App) Initialize(ctx context.Context) (err error) {
// Connects to all services it needs to
err = service.Initialize(ctx, app.Log, service.Config{
Storage: app.Opts.Storage,
ActionLog: app.Opts.ActionLog,
Storage: app.Opts.Storage,
})
if err != nil {
messaging/service/service.go
+18 -7
View File
@@ -31,7 +31,8 @@ type (
}
Config struct {
Storage options.StorageOpt
ActionLog options.ActionLogOpt
Storage options.StorageOpt
}
)
@@ -60,12 +61,22 @@ var (
func Initialize(ctx context.Context, log *zap.Logger, c Config) (err error) {
DefaultLogger = log.Named("service")
DefaultActionlog = actionlog.NewService(
// will log directly to system schema for now
actionlogRepository.Mysql(repository.DB(ctx), "sys_actionlog"),
log,
log,
)
{
tee := log
policy := actionlog.MakeProductionPolicy()
if c.ActionLog.Debug {
tee = zap.NewNop()
policy = actionlog.MakeDebugPolicy()
}
DefaultActionlog = actionlog.NewService(
// will log directly to system schema for now
actionlogRepository.Mysql(repository.DB(ctx).Quiet(), "sys_actionlog"),
log,
tee,
policy,
)
}
if DefaultPermissions == nil {
// Do not override permissions service stored under DefaultPermissions
pkg/actionlog/service.go
+21 -16
View File
@@ -22,6 +22,8 @@ type (
// logger for repository errors
logger *zap.Logger
policy policyMatcher
}
loggable interface {
@@ -39,17 +41,18 @@ type (
}
)
// NewService initializes auditlog service
// NewService initializes action log service
//
func NewService(r recordKeeper, logger, tee *zap.Logger) (svc *service) {
func NewService(r recordKeeper, logger, tee *zap.Logger, policy policyMatcher) (svc *service) {
if tee == nil {
tee = zap.NewNop()
}
svc = &service{
tee: tee,
logger: logger,
tee: tee.Named("actionlog"),
logger: logger.Named("actionlog"),
repo: r,
policy: policy,
}
return
@@ -63,10 +66,19 @@ func (svc service) Record(ctx context.Context, l loggable) {
a := enrich(ctx, l.LoggableAction())
var (
log = svc.logger
)
svc.log(a)
if !svc.policy.Match(a) {
// policy does not allow us to record this
return
}
if err := svc.repo.Record(ctx, a); err != nil {
svc.logger.With(zap.Error(err)).Error("could not record audit event")
}
}
func (svc service) log(a *Action) {
zlf := []zap.Field{
zap.Time("timestamp", a.Timestamp),
zap.String("requestOrigin", a.RequestOrigin),
@@ -78,18 +90,11 @@ func (svc service) Record(ctx context.Context, l loggable) {
zap.Uint8("severity", uint8(a.Severity)),
zap.String("error", a.Error),
zap.String("description", a.Description),
zap.Bool("policy-match", svc.policy.Match(a)),
zap.Any("meta", a.Meta),
}
for k, v := range a.Meta {
zlf = append(zlf, zap.Any("meta."+k, v))
}
log.Debug(a.Description, zlf...)
if err := svc.repo.Record(ctx, a); err != nil {
log.With(zap.Error(err)).Error("could not record audit event")
}
svc.tee.With(zlf...).Debug(a.Description)
}
func (svc service) Find(ctx context.Context, flt Filter) (ActionSet, Filter, error) {
pkg/app/options.go
+2
View File
@@ -6,6 +6,7 @@ import (
type (
Options struct {
ActionLog options.ActionLogOpt
SMTP options.SMTPOpt
Auth options.AuthOpt
HTTPClient options.HTTPClientOpt
@@ -30,6 +31,7 @@ func NewOptions(prefix ...string) *Options {
}
return &Options{
ActionLog: *options.ActionLog(),
Auth: *options.Auth(),
SMTP: *options.SMTP(p),
HTTPClient: *options.HttpClient(p),
pkg/app/options/actionlog.go
+17
View File
@@ -0,0 +1,17 @@
package options
type (
ActionLogOpt struct {
Debug bool `env:"ACTIONLOG_DEBUG"`
}
)
func ActionLog() (o *ActionLogOpt) {
o = &ActionLogOpt{
Debug: false,
}
fill(o, "")
return
}
system/app.go
+2 -1
View File
@@ -63,7 +63,8 @@ func (app *App) Upgrade(ctx context.Context) (err error) {
func (app *App) Initialize(ctx context.Context) (err error) {
// Connects to all services it needs to
err = service.Initialize(ctx, app.Log, service.Config{
Storage: app.Opts.Storage,
ActionLog: app.Opts.ActionLog,
Storage: app.Opts.Storage,
})
if err != nil {
system/service/service.go
+16 -5
View File
@@ -30,6 +30,7 @@ type (
}
Config struct {
ActionLog options.ActionLogOpt
Storage options.StorageOpt
GRPCClientSystem options.GRPCServerOpt
}
@@ -94,11 +95,21 @@ var (
func Initialize(ctx context.Context, log *zap.Logger, c Config) (err error) {
DefaultLogger = log.Named("service")
DefaultActionlog = actionlog.NewService(
actionlogRepository.Mysql(repository.DB(ctx), "sys_actionlog"),
log,
log,
)
{
tee := log
policy := actionlog.MakeProductionPolicy()
if c.ActionLog.Debug {
tee = zap.NewNop()
policy = actionlog.MakeDebugPolicy()
}
DefaultActionlog = actionlog.NewService(
actionlogRepository.Mysql(repository.DB(ctx).Quiet(), "sys_actionlog"),
log,
tee,
policy,
)
}
if DefaultPermissions == nil {
// Do not override permissions service stored under DefaultPermissions