Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7125f02

Browse files
committed
add specific test for audit
1 parent9379491 commit7125f02

File tree

2 files changed

+132
-5
lines changed

2 files changed

+132
-5
lines changed

‎coderd/workspaceapps/db.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,6 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
155155
// Verify the user has access to the app.
156156
authed,warnings,err:=p.authorizeRequest(r.Context(),authz,dbReq)
157157
iferr!=nil {
158-
// TODO(mafredri): Audit?
159158
WriteWorkspaceApp500(p.Logger,p.DashboardURL,rw,r,&appReq,err,"verify authz")
160159
returnnil,"",false
161160
}

‎coderd/workspaceapps/db_test.go

Lines changed: 132 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -372,8 +372,7 @@ func Test_ResolveRequest(t *testing.T) {
372372
require.WithinDuration(t,token.Expiry.Time(),secondToken.Expiry.Time(),2*time.Second)
373373
secondToken.Expiry=token.Expiry
374374
require.Equal(t,token,secondToken)
375-
376-
require.Len(t,auditor.AuditLogs(),1,"single audit log, same user and app audit session is active")
375+
require.Len(t,auditor.AuditLogs(),1,"no new audit log, FromRequest returned the same token and is not audited")
377376
}
378377
})
379378
}
@@ -1248,6 +1247,134 @@ func Test_ResolveRequest(t *testing.T) {
12481247
}),"audit log unhealthy app")
12491248
require.Len(t,auditor.AuditLogs(),1,"single audit log")
12501249
})
1250+
1251+
t.Run("AuditLogging",func(t*testing.T) {
1252+
t.Parallel()
1253+
1254+
for_,app:=rangeallApps {
1255+
req:= (workspaceapps.Request{
1256+
AccessMethod:workspaceapps.AccessMethodPath,
1257+
BasePath:"/app",
1258+
UsernameOrID:me.Username,
1259+
WorkspaceNameOrID:workspace.Name,
1260+
AgentNameOrID:agentName,
1261+
AppSlugOrPort:app,
1262+
}).Normalize()
1263+
1264+
auditor:=audit.NewMock()
1265+
auditableIP:=randomIPv6(t)
1266+
1267+
t.Log("app",app)
1268+
1269+
// First request, new audit log.
1270+
rw:=httptest.NewRecorder()
1271+
r:=httptest.NewRequest("GET","/app",nil)
1272+
r.Header.Set(codersdk.SessionTokenHeader,client.SessionToken())
1273+
r=requestWithAuditorAndRemoteAddr(r,auditor,auditableIP)
1274+
1275+
_,ok:=workspaceappsResolveRequest(t,rw,r, workspaceapps.ResolveRequestOptions{
1276+
Logger:api.Logger,
1277+
SignedTokenProvider:api.WorkspaceAppsProvider,
1278+
DashboardURL:api.AccessURL,
1279+
PathAppBaseURL:api.AccessURL,
1280+
AppHostname:api.AppHostname,
1281+
AppRequest:req,
1282+
})
1283+
require.True(t,ok)
1284+
w:=rw.Result()
1285+
_=w.Body.Close()
1286+
require.True(t,auditor.Contains(t, database.AuditLog{
1287+
OrganizationID:workspace.OrganizationID,
1288+
Action:database.AuditActionOpen,
1289+
ResourceType:audit.ResourceType(appsBySlug[app]),
1290+
ResourceID:audit.ResourceID(appsBySlug[app]),
1291+
ResourceTarget:audit.ResourceTarget(appsBySlug[app]),
1292+
UserID:me.ID,
1293+
Ip:audit.ParseIP(auditableIP),
1294+
StatusCode:int32(w.StatusCode),//nolint:gosec
1295+
}),"audit log 1")
1296+
require.Len(t,auditor.AuditLogs(),1,"single audit log")
1297+
1298+
// Second request, no audit log because the session is active.
1299+
rw=httptest.NewRecorder()
1300+
r=httptest.NewRequest("GET","/app",nil)
1301+
r.Header.Set(codersdk.SessionTokenHeader,client.SessionToken())
1302+
r=requestWithAuditorAndRemoteAddr(r,auditor,auditableIP)
1303+
1304+
_,ok=workspaceappsResolveRequest(t,rw,r, workspaceapps.ResolveRequestOptions{
1305+
Logger:api.Logger,
1306+
SignedTokenProvider:api.WorkspaceAppsProvider,
1307+
DashboardURL:api.AccessURL,
1308+
PathAppBaseURL:api.AccessURL,
1309+
AppHostname:api.AppHostname,
1310+
AppRequest:req,
1311+
})
1312+
require.True(t,ok)
1313+
w=rw.Result()
1314+
_=w.Body.Close()
1315+
require.Len(t,auditor.AuditLogs(),1,"single audit log, previous session active")
1316+
1317+
// Third request, session timed out, new audit log.
1318+
rw=httptest.NewRecorder()
1319+
r=httptest.NewRequest("GET","/app",nil)
1320+
r.Header.Set(codersdk.SessionTokenHeader,client.SessionToken())
1321+
r.RemoteAddr=auditableIP
1322+
1323+
sessionTimeoutTokenProvider:=signedTokenProviderWithAuditor(t,api.WorkspaceAppsProvider,auditor,0)
1324+
_,ok=workspaceappsResolveRequest(t,rw,r, workspaceapps.ResolveRequestOptions{
1325+
Logger:api.Logger,
1326+
SignedTokenProvider:sessionTimeoutTokenProvider,
1327+
DashboardURL:api.AccessURL,
1328+
PathAppBaseURL:api.AccessURL,
1329+
AppHostname:api.AppHostname,
1330+
AppRequest:req,
1331+
})
1332+
require.True(t,ok)
1333+
w=rw.Result()
1334+
_=w.Body.Close()
1335+
require.True(t,auditor.Contains(t, database.AuditLog{
1336+
OrganizationID:workspace.OrganizationID,
1337+
Action:database.AuditActionOpen,
1338+
ResourceType:audit.ResourceType(appsBySlug[app]),
1339+
ResourceID:audit.ResourceID(appsBySlug[app]),
1340+
ResourceTarget:audit.ResourceTarget(appsBySlug[app]),
1341+
UserID:me.ID,
1342+
Ip:audit.ParseIP(auditableIP),
1343+
StatusCode:int32(w.StatusCode),//nolint:gosec
1344+
}),"audit log 2")
1345+
require.Len(t,auditor.AuditLogs(),2,"two audit logs, session timed out")
1346+
1347+
// Fourth request, new IP produces new audit log.
1348+
auditableIP=randomIPv6(t)
1349+
rw=httptest.NewRecorder()
1350+
r=httptest.NewRequest("GET","/app",nil)
1351+
r.Header.Set(codersdk.SessionTokenHeader,client.SessionToken())
1352+
r=requestWithAuditorAndRemoteAddr(r,auditor,auditableIP)
1353+
1354+
_,ok=workspaceappsResolveRequest(t,rw,r, workspaceapps.ResolveRequestOptions{
1355+
Logger:api.Logger,
1356+
SignedTokenProvider:api.WorkspaceAppsProvider,
1357+
DashboardURL:api.AccessURL,
1358+
PathAppBaseURL:api.AccessURL,
1359+
AppHostname:api.AppHostname,
1360+
AppRequest:req,
1361+
})
1362+
require.True(t,ok)
1363+
w=rw.Result()
1364+
_=w.Body.Close()
1365+
require.True(t,auditor.Contains(t, database.AuditLog{
1366+
OrganizationID:workspace.OrganizationID,
1367+
Action:database.AuditActionOpen,
1368+
ResourceType:audit.ResourceType(appsBySlug[app]),
1369+
ResourceID:audit.ResourceID(appsBySlug[app]),
1370+
ResourceTarget:audit.ResourceTarget(appsBySlug[app]),
1371+
UserID:me.ID,
1372+
Ip:audit.ParseIP(auditableIP),
1373+
StatusCode:int32(w.StatusCode),//nolint:gosec
1374+
}),"audit log 3")
1375+
require.Len(t,auditor.AuditLogs(),3,"three audit logs, new IP")
1376+
}
1377+
})
12511378
}
12521379

12531380
typeauditorKeyint
@@ -1281,7 +1408,7 @@ func workspaceappsResolveRequest(t testing.TB, w http.ResponseWriter, r *http.Re
12811408
ifopts.SignedTokenProvider!=nil&&auditorValue!=nil {
12821409
auditor,ok:=auditorValue.(audit.Auditor)
12831410
require.True(t,ok,"auditor is not an audit.Auditor")
1284-
opts.SignedTokenProvider=signedTokenProviderWithAuditor(t,opts.SignedTokenProvider,auditor)
1411+
opts.SignedTokenProvider=signedTokenProviderWithAuditor(t,opts.SignedTokenProvider,auditor,time.Hour)
12851412
}
12861413

12871414
tracing.StatusWriterMiddleware(http.HandlerFunc(func(w http.ResponseWriter,r*http.Request) {
@@ -1291,13 +1418,14 @@ func workspaceappsResolveRequest(t testing.TB, w http.ResponseWriter, r *http.Re
12911418
returntoken,ok
12921419
}
12931420

1294-
funcsignedTokenProviderWithAuditor(t testing.TB,provider workspaceapps.SignedTokenProvider,auditor audit.Auditor) workspaceapps.SignedTokenProvider {
1421+
funcsignedTokenProviderWithAuditor(t testing.TB,provider workspaceapps.SignedTokenProvider,auditor audit.Auditor,sessionTimeout time.Duration) workspaceapps.SignedTokenProvider {
12951422
t.Helper()
12961423
p,ok:=provider.(*workspaceapps.DBTokenProvider)
12971424
require.True(t,ok,"provider is not a DBTokenProvider")
12981425

12991426
shallowCopy:=*p
13001427
shallowCopy.Auditor=&atomic.Pointer[audit.Auditor]{}
13011428
shallowCopy.Auditor.Store(&auditor)
1429+
shallowCopy.WorkspaceAppAuditSessionTimeout=sessionTimeout
13021430
return&shallowCopy
13031431
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp