Skip to content

Commit 796d615

Browse files
EmyrkEmyrk
committed
chore: add sql filter to fetching audit logs
1 parent bf4b7ab commit 796d615

File tree

8 files changed

+139
-0
lines changed

8 files changed

+139
-0
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3852,3 +3852,7 @@ func (q *querier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersP
38523852
// GetUsers is authenticated.
38533853
return q.GetUsers(ctx, arg)
38543854
}
3855+
3856+
func (q *querier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]database.GetAuditLogsOffsetRow, error) {
3857+
panic("not implemented")
3858+
}

‎coderd/database/dbmem/dbmem.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10080,3 +10080,7 @@ func (q *FakeQuerier) GetAuthorizedUsers(ctx context.Context, arg database.GetUs
1008010080
}
1008110081
return filteredUsers, nil
1008210082
}
10083+
10084+
func (q *FakeQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]database.GetAuditLogsOffsetRow, error) {
10085+
panic("not implemented")
10086+
}

‎coderd/database/dbmetrics/dbmetrics.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbmock/dbmock.go

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/modelqueries.go

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ type customQuerier interface {
4848
templateQuerier
4949
workspaceQuerier
5050
userQuerier
51+
auditLogQuerier
5152
}
5253

5354
type templateQuerier interface {
@@ -375,6 +376,93 @@ func (q *sqlQuerier) GetAuthorizedUsers(ctx context.Context, arg GetUsersParams,
375376
return items, nil
376377
}
377378

379+
type auditLogQuerier interface {
380+
GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]GetAuditLogsOffsetRow, error)
381+
}
382+
383+
func (q *sqlQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]GetAuditLogsOffsetRow, error) {
384+
authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
385+
VariableConverter: regosql.AuditLogConverter(),
386+
})
387+
if err != nil {
388+
return nil, xerrors.Errorf("compile authorized filter: %w", err)
389+
}
390+
391+
filtered, err := insertAuthorizedFilter(getAuditLogsOffset, fmt.Sprintf(" AND %s", authorizedFilter))
392+
if err != nil {
393+
return nil, xerrors.Errorf("insert authorized filter: %w", err)
394+
}
395+
396+
query := fmt.Sprintf("-- name: GetAuthorizedAuditLogsOffset :many\n%s", filtered)
397+
rows, err := q.db.QueryContext(ctx, query,
398+
arg.ResourceType,
399+
arg.ResourceID,
400+
arg.OrganizationID,
401+
arg.ResourceTarget,
402+
arg.Action,
403+
arg.UserID,
404+
arg.Username,
405+
arg.Email,
406+
arg.DateFrom,
407+
arg.DateTo,
408+
arg.BuildReason,
409+
arg.OffsetOpt,
410+
arg.LimitOpt,
411+
)
412+
if err != nil {
413+
return nil, err
414+
}
415+
defer rows.Close()
416+
var items []GetAuditLogsOffsetRow
417+
for rows.Next() {
418+
var i GetAuditLogsOffsetRow
419+
if err := rows.Scan(
420+
&i.ID,
421+
&i.Time,
422+
&i.UserID,
423+
&i.OrganizationID,
424+
&i.Ip,
425+
&i.UserAgent,
426+
&i.ResourceType,
427+
&i.ResourceID,
428+
&i.ResourceTarget,
429+
&i.Action,
430+
&i.Diff,
431+
&i.StatusCode,
432+
&i.AdditionalFields,
433+
&i.RequestID,
434+
&i.ResourceIcon,
435+
&i.UserUsername,
436+
&i.UserName,
437+
&i.UserEmail,
438+
&i.UserCreatedAt,
439+
&i.UserUpdatedAt,
440+
&i.UserLastSeenAt,
441+
&i.UserStatus,
442+
&i.UserLoginType,
443+
&i.UserRoles,
444+
&i.UserAvatarUrl,
445+
&i.UserDeleted,
446+
&i.UserThemePreference,
447+
&i.UserQuietHoursSchedule,
448+
&i.OrganizationName,
449+
&i.OrganizationDisplayName,
450+
&i.OrganizationIcon,
451+
&i.Count,
452+
); err != nil {
453+
return nil, err
454+
}
455+
items = append(items, i)
456+
}
457+
if err := rows.Close(); err != nil {
458+
return nil, err
459+
}
460+
if err := rows.Err(); err != nil {
461+
return nil, err
462+
}
463+
return items, nil
464+
}
465+
378466
func insertAuthorizedFilter(query string, replaceWith string) (string, error) {
379467
if !strings.Contains(query, authorizedQueryPlaceholder) {
380468
return "", xerrors.Errorf("query does not contain authorized replace string, this is not an authorized query")

‎coderd/database/queries.sql.go

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries/auditlogs.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,9 @@ WHERE
117117
workspace_builds.reason::text = @build_reason
118118
ELSE true
119119
END
120+
121+
-- Authorize Filter clause will be injected below in GetAuthorizedAuditLogsOffset
122+
-- @authorize_filter
120123
ORDER BY
121124
"time" DESC
122125
LIMIT

‎coderd/rbac/regosql/configs.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,21 @@ func TemplateConverter() *sqltypes.VariableConverter {
3636
return matcher
3737
}
3838

39+
func AuditLogConverter() *sqltypes.VariableConverter {
40+
matcher := sqltypes.NewVariableConverter().RegisterMatcher(
41+
resourceIDMatcher(),
42+
organizationOwnerMatcher(),
43+
// Templates have no user owner, only owner by an organization.
44+
sqltypes.AlwaysFalse(userOwnerMatcher()),
45+
)
46+
matcher.RegisterMatcher(
47+
// No ACLs on the user type
48+
sqltypes.AlwaysFalse(groupACLMatcher(matcher)),
49+
sqltypes.AlwaysFalse(userACLMatcher(matcher)),
50+
)
51+
return matcher
52+
}
53+
3954
func UserConverter() *sqltypes.VariableConverter {
4055
matcher := sqltypes.NewVariableConverter().RegisterMatcher(
4156
resourceIDMatcher(),

0 commit comments

Comments
 (0)