audit

Documentation

Index

• func Empty[T Auditable]() T
• type Auditable
• type Auditor
  • func NewNop() Auditor
• type Backend
• type Differ
• type Exporter
  • func NewExporter(filter Filter, backends ...Backend) *Exporter
  • func (e *Exporter) Export(ctx context.Context, alog database.AuditLog) error
• type Filter
• type FilterDecision
• type FilterFunc
  • func (f FilterFunc) Check(ctx context.Context, alog database.AuditLog) (FilterDecision, error)
• type Map
  • func Diff[T Auditable](a Auditor, left, right T) Map
• type OldNew
• type Request
  • func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request[T], func())
• type RequestParams

Functions

func Empty

func Empty[T Auditable]() T

Empty returns a default value of type T.

Types

type Auditable

type Auditable interface {
	database.APIKey |
		database.Organization |
		database.OrganizationMember |
		database.Template |
		database.TemplateVersion |
		database.User |
		database.Workspace |
		database.GitSSHKey
}

Auditable is mostly a marker interface. It contains a definitive list of all auditable types. If you want to audit a new type, first define it in AuditableResources, then add it to this interface.

type Auditor

type Auditor interface {
	Export(ctx context.Context, alog database.AuditLog) error
	// contains filtered or unexported methods
}

func NewNop

func NewNop() Auditor

type Backend

type Backend interface {
	// Decision determines the FilterDecisions that the backend tolerates.
	Decision() FilterDecision
	// Export sends an audit log to the backend.
	Export(ctx context.Context, alog database.AuditLog) error
}

Backends can store or send audit logs to arbitrary locations.

type Differ

type Differ struct {
	DiffFn func(old, new any) Map
}

Differ is used so the enterprise version can implement the diff function in the Auditor feature interface. Only types in the same package as the interface can implement unexported methods.

type Exporter

type Exporter struct {
	// contains filtered or unexported fields
}

Exporter exports audit logs to an arbitrary list of backends.

func NewExporter

func NewExporter(filter Filter, backends ...Backend) *Exporter

NewExporter creates an exporter from the given filter and backends.

func (*Exporter) Export

func (e *Exporter) Export(ctx context.Context, alog database.AuditLog) error

Export exports and audit log. Before exporting to a backend, it uses the filter to determine if the backend tolerates the audit log. If not, it is dropped.

type Filter

type Filter interface {
	Check(ctx context.Context, alog database.AuditLog) (FilterDecision, error)
}

Filters produce a FilterDecision for a given audit log.

var DefaultFilter Filter = FilterFunc(func(ctx context.Context, alog database.AuditLog) (FilterDecision, error) {

	return FilterDecisionStore | FilterDecisionExport, nil
})

DefaultFilter is the default filter used when exporting audit logs. It allows storage and exporting for all audit logs.

type FilterDecision

type FilterDecision uint8

FilterDecision is a bitwise flag describing the actions a given filter allows for a given audit log.

const (
	// FilterDecisionDrop indicates that the audit log should be dropped. It
	// should not be stored or exported anywhere.
	FilterDecisionDrop FilterDecision = 0
	// FilterDecisionStore indicates that the audit log should be allowed to be
	// stored in the Coder database.
	FilterDecisionStore FilterDecision = 1 << iota
	// FilterDecisionExport indicates that the audit log should be exported
	// externally of Coder.
	FilterDecisionExport
)

type FilterFunc

type FilterFunc func(ctx context.Context, alog database.AuditLog) (FilterDecision, error)

FilterFunc constructs a Filter from a simple function.

func (FilterFunc) Check

func (f FilterFunc) Check(ctx context.Context, alog database.AuditLog) (FilterDecision, error)

type Map

type Map map[string]OldNew

Map is a map of changed fields in an audited resource. It maps field names to the old and new value for that field.

func Diff

func Diff[T Auditable](a Auditor, left, right T) Map

Diff compares two auditable resources and produces a Map of the changed values.

type OldNew

type OldNew struct {
	Old    any
	New    any
	Secret bool
}

OldNew is a pair of values representing the old value and the new value.

type Request

type Request[T Auditable] struct {
	Old T
	New T
	// contains filtered or unexported fields
}

func InitRequest

func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request[T], func())

InitRequest initializes an audit log for a request. It returns a function that should be deferred, causing the audit log to be committed when the handler returns.

type RequestParams

type RequestParams struct {
	Audit Auditor
	Log   slog.Logger

	Action       database.AuditAction
	ResourceType database.ResourceType
	Actor        uuid.UUID
}