Audit Log API Layer

cmd/server/pactasrv/BUILD.bazel

@@ -3,6 +3,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "pactasrv",
     srcs = [
+        "audit_logs.go",
         "incomplete_upload.go",
         "initiative.go",
         "initiative_invitation.go",

cmd/server/pactasrv/audit_logs.go

@@ -0,0 +1,39 @@
+package pactasrv
+
+import (
+	"context"
+
+	"github.com/RMI/pacta/cmd/server/pactasrv/conv"
+	"github.com/RMI/pacta/oapierr"
+	api "github.com/RMI/pacta/openapi/pacta"
+	"go.uber.org/zap"
+)
+
+// queries the platform's audit logs
+// (POST /audit-logs)
+func (s *Server) ListAuditLogs(ctx context.Context, request api.ListAuditLogsRequestObject) (api.ListAuditLogsResponseObject, error) {
+	// TODO(#12) implement authorization
+	query, err := conv.AuditLogQueryFromOAPI(request.Body)
+	if err != nil {
+		return nil, err
+	}
+	// TODO(#12) implement additional authorizations, ensuring for example that:
+	// - every generated query has reasonable limits + only filters by allowed search terms
+	// - the actor is allowed to see the audit logs of the actor_owner, but not of other actor_owners
+	// - initiative admins should be able to see audit logs of the initiative, but not initiative members
+	// - admins should be able to see all
+	// This is probably our most important piece of authz-ery, so it should be thoroughly tested.
+	als, pi, err := s.DB.AuditLogs(s.DB.NoTxn(ctx), query)
+	if err != nil {
+		return nil, oapierr.Internal("querying audit logs failed", zap.Error(err))
+	}
+	results, err := dereference(conv.AuditLogsToOAPI(als))
+	if err != nil {
+		return nil, err
+	}
+	return api.ListAuditLogs200JSONResponse{
+		AuditLogs:   results,
+		Cursor:      string(pi.Cursor),
+		HasNextPage: pi.HasNextPage,
+	}, nil
+}

cmd/server/pactasrv/conv/BUILD.bazel

@@ -10,6 +10,7 @@ go_library(
     importpath = "github.com/RMI/pacta/cmd/server/pactasrv/conv",
     visibility = ["//visibility:public"],
     deps = [
+        "//db",
         "//oapierr",
         "//openapi:pacta_generated",
         "//pacta",

cmd/server/pactasrv/conv/helpers.go

@@ -10,6 +10,14 @@ func strPtr[T ~string](t T) *string {
 	return ptr(string(t))
 }
 
+func fromStrs[T ~string](ss []string) []T {
+	result := make([]T, len(ss))
+	for i, s := range ss {
+		result[i] = T(s)
+	}
+	return result
+}
+
 func ifNil[T any](t *T, fallback T) T {
 	if t == nil {
 		return fallback

cmd/server/pactasrv/conv/oapi_to_pacta.go

@@ -1,8 +1,10 @@
 package conv
 
 import (
+	"fmt"
 	"regexp"
 
+	"github.com/RMI/pacta/db"
 	"github.com/RMI/pacta/oapierr"
 	api "github.com/RMI/pacta/openapi/pacta"
 	"github.com/RMI/pacta/pacta"
@@ -92,3 +94,109 @@ func PortfolioGroupCreateFromOAPI(pg *api.PortfolioGroupCreate, ownerID pacta.Ow
 		Owner:       &pacta.Owner{ID: ownerID},
 	}, nil
 }
+
+func auditLogActionFromOAPI(i api.AuditLogAction) (pacta.AuditLogAction, error) {
+	return pacta.ParseAuditLogAction(string(i))
+}
+
+func auditLogActorTypeFromOAPI(i api.AuditLogActorType) (pacta.AuditLogActorType, error) {
+	return pacta.ParseAuditLogActorType(string(i))
+}
+
+func auditLogTargetTypeFromOAPI(i api.AuditLogTargetType) (pacta.AuditLogTargetType, error) {
+	return pacta.ParseAuditLogTargetType(string(i))
+}
+
+func auditLogQueryWhereFromOAPI(i api.AuditLogQueryWhere) (*db.AuditLogQueryWhere, error) {
+	result := &db.AuditLogQueryWhere{}
+	if i.InId != nil {
+		result.InID = fromStrs[pacta.AuditLogID](*i.InId)
+	}
+	if i.MinCreatedAt != nil {
+		result.MinCreatedAt = *i.MinCreatedAt
+	}
+	if i.MaxCreatedAt != nil {
+		result.MaxCreatedAt = *i.MaxCreatedAt
+	}
+	if i.InAction != nil {
+		as, err := convAll(*i.InAction, auditLogActionFromOAPI)
+		if err != nil {
+			return nil, fmt.Errorf("converting audit log query where in action: %w", err)
+		}
+		result.InAction = as
+	}
+	if i.InActorType != nil {
+		at, err := convAll(*i.InActorType, auditLogActorTypeFromOAPI)
+		if err != nil {
+			return nil, fmt.Errorf("converting audit log query where in actor type: %w", err)
+		}
+		result.InActorType = at
+	}
+	if i.InActorId != nil {
+		result.InActorID = *i.InActorId
+	}
+	if i.InActorOwnerId != nil {
+		result.InActorOwnerID = fromStrs[pacta.OwnerID](*i.InActorOwnerId)
+	}
+	if i.InTargetType != nil {
+		tt, err := convAll(*i.InTargetType, auditLogTargetTypeFromOAPI)
+		if err != nil {
+			return nil, fmt.Errorf("converting audit log query where in target type: %w", err)
+		}
+		result.InTargetType = tt
+	}
+	if i.InTargetId != nil {
+		result.InTargetID = *i.InTargetId
+	}
+	if i.InTargetOwnerId != nil {
+		result.InTargetOwnerID = fromStrs[pacta.OwnerID](*i.InTargetOwnerId)
+	}
+	return result, nil
+}
+
+func auditLogQuerySortByFromOAPI(i api.AuditLogQuerySortBy) (db.AuditLogQuerySortBy, error) {
+	return db.ParseAuditLogQuerySortBy(string(i))
+}
+
+func auditLogQuerySortFromOAPI(i api.AuditLogQuerySort) (*db.AuditLogQuerySort, error) {
+	by, err := auditLogQuerySortByFromOAPI(i.By)
+	if err != nil {
+		return nil, fmt.Errorf("converting audit log query sort by: %w", err)
+	}
+	return &db.AuditLogQuerySort{
+		By:        by,
+		Ascending: i.Ascending,
+	}, nil
+}
+
+func AuditLogQueryFromOAPI(q *api.AuditLogQueryReq) (*db.AuditLogQuery, error) {
+	limit := 25
+	if q.Limit != nil {
+		limit = *q.Limit
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	cursor := ""
+	if q.Cursor != nil {
+		cursor = *q.Cursor
+	}
+	sorts := []*db.AuditLogQuerySort{}
+	if q.Sorts != nil {
+		ss, err := convAll(*q.Sorts, auditLogQuerySortFromOAPI)
+		if err != nil {
+			return nil, oapierr.BadRequest("error converting audit log query sorts", zap.Error(err))
+		}
+		sorts = ss
+	}
+	wheres, err := convAll(q.Wheres, auditLogQueryWhereFromOAPI)
+	if err != nil {
+		return nil, oapierr.BadRequest("error converting audit log query wheres", zap.Error(err))
+	}
+	return &db.AuditLogQuery{
+		Cursor: db.Cursor(cursor),
+		Limit:  limit,
+		Wheres: wheres,
+		Sorts:  sorts,
+	}, nil
+}

cmd/server/pactasrv/conv/pacta_to_oapi.go

@@ -1,6 +1,8 @@
 package conv
 
 import (
+	"fmt"
+
 	"github.com/RMI/pacta/oapierr"
 	api "github.com/RMI/pacta/openapi/pacta"
 	"github.com/RMI/pacta/pacta"
@@ -236,3 +238,123 @@ func PortfolioGroupToOAPI(pg *pacta.PortfolioGroup) (*api.PortfolioGroup, error)
 func PortfolioGroupsToOAPI(pgs []*pacta.PortfolioGroup) ([]*api.PortfolioGroup, error) {
 	return convAll(pgs, PortfolioGroupToOAPI)
 }
+
+func auditLogActorTypeToOAPI(i pacta.AuditLogActorType) (api.AuditLogActorType, error) {
+	switch i {
+	case pacta.AuditLogActorType_Public:
+		return api.AuditLogActorTypePUBLIC, nil
+	case pacta.AuditLogActorType_Owner:
+		return api.AuditLogActorTypeOWNER, nil
+	case pacta.AuditLogActorType_Admin:
+		return api.AuditLogActorTypeADMIN, nil
+	case pacta.AuditLogActorType_SuperAdmin:
+		return api.AuditLogActorTypeSUPERADMIN, nil
+	case pacta.AuditLogActorType_System:
+		return api.AuditLogActorTypeSYSTEM, nil
+	}
+	return "", oapierr.Internal(fmt.Sprintf("auditLogActorTypeToOAPI: unknown actor type: %q", i))
+}
+
+func auditLogActionToOAPI(i pacta.AuditLogAction) (api.AuditLogAction, error) {
+	switch i {
+	case pacta.AuditLogAction_Create:
+		return api.AuditLogActionCREATE, nil
+	case pacta.AuditLogAction_Update:
+		return api.AuditLogActionUPDATE, nil
+	case pacta.AuditLogAction_Delete:
+		return api.AuditLogActionDELETE, nil
+	case pacta.AuditLogAction_AddTo:
+		return api.AuditLogActionADDTO, nil
+	case pacta.AuditLogAction_RemoveFrom:
+		return api.AuditLogActionREMOVEFROM, nil
+	case pacta.AuditLogAction_EnableAdminDebug:
+		return api.AuditLogActionENABLEADMINDEBUG, nil
+	case pacta.AuditLogAction_DisableAdminDebug:
+		return api.AuditLogActionDISABLEADMINDEBUG, nil
+	case pacta.AuditLogAction_Download:
+		return api.AuditLogActionDOWNLOAD, nil
+	case pacta.AuditLogAction_EnableSharing:
+		return api.AuditLogActionENABLESHARING, nil
+	case pacta.AuditLogAction_DisableSharing:
+		return api.AuditLogActionDISABLESHARING, nil
+	}
+	return "", oapierr.Internal(fmt.Sprintf("auditLogActionToOAPI: unknown action: %q", i))
+}
+
+func auditLogTargetTypeToOAPI(i pacta.AuditLogTargetType) (api.AuditLogTargetType, error) {
+	switch i {
+	case pacta.AuditLogTargetType_User:
+		return api.AuditLogTargetTypeUSER, nil
+	case pacta.AuditLogTargetType_Portfolio:
+		return api.AuditLogTargetTypePORTFOLIO, nil
+	case pacta.AuditLogTargetType_IncompleteUpload:
+		return api.AuditLogTargetTypeINCOMPLETEUPLOAD, nil
+	case pacta.AuditLogTargetType_PortfolioGroup:
+		return api.AuditLogTargetTypePORTFOLIOGROUP, nil
+	case pacta.AuditLogTargetType_Initiative:
+		return api.AuditLogTargetTypeINITIATIVE, nil
+	case pacta.AuditLogTargetType_PACTAVersion:
+		return api.AuditLogTargetTypePACTAVERSION, nil
+	case pacta.AuditLogTargetType_Analysis:
+		return api.AuditLogTargetTypeANALYSIS, nil
+	}
+	return "", oapierr.Internal(fmt.Sprintf("auditLogTargetTypeToOAPI: unknown target type: %q", i))
+}
+
+func AuditLogToOAPI(al *pacta.AuditLog) (*api.AuditLog, error) {
+	if al == nil {
+		return nil, oapierr.Internal("auditLogToOAPI: can't convert nil pointer")
+	}
+	at, err := auditLogActorTypeToOAPI(al.ActorType)
+	if err != nil {
+		return nil, oapierr.Internal("auditLogToOAPI: auditLogActorTypeToOAPI failed", zap.Error(err))
+	}
+	act, err := auditLogActionToOAPI(al.Action)
+	if err != nil {
+		return nil, oapierr.Internal("auditLogToOAPI: auditLogActionToOAPI failed", zap.Error(err))
+	}
+	ptt, err := auditLogTargetTypeToOAPI(al.PrimaryTargetType)
+	if err != nil {
+		return nil, oapierr.Internal("auditLogToOAPI: auditLogTargetTypeToOAPI failed", zap.Error(err))
+	}
+	var aoi *string
+	if al.ActorOwner != nil {
+		aoi = stringToNilable(al.ActorOwner.ID)
+	}
+	var stt *api.AuditLogTargetType
+	if al.SecondaryTargetType != "" {
+		s, err := auditLogTargetTypeToOAPI(al.SecondaryTargetType)
+		if err != nil {
+			return nil, oapierr.Internal("auditLogToOAPI: auditLogTargetTypeToOAPI failed", zap.Error(err))
+		}
+		stt = &s
+	}
+	var sto *string
+	if al.SecondaryTargetOwner != nil {
+		s := string(al.SecondaryTargetOwner.ID)
+		sto = &s
+	}
+	var sid *string
+	if al.SecondaryTargetID != "" {
+		s := string(al.SecondaryTargetID)
+		sid = &s
+	}
+	return &api.AuditLog{
+		Id:                   string(al.ID),
+		CreatedAt:            al.CreatedAt,
+		ActorType:            at,
+		ActorId:              stringToNilable(al.ActorID),
+		ActorOwnerId:         aoi,
+		Action:               act,
+		PrimaryTargetType:    ptt,
+		PrimaryTargetId:      al.PrimaryTargetID,
+		PrimaryTargetOwner:   string(al.PrimaryTargetOwner.ID),
+		SecondaryTargetType:  stt,
+		SecondaryTargetId:    sid,
+		SecondaryTargetOwner: sto,
+	}, nil
+}
+
+func AuditLogsToOAPI(als []*pacta.AuditLog) ([]*api.AuditLog, error) {
+	return convAll(als, AuditLogToOAPI)
+}

cmd/server/pactasrv/pactasrv.go

@@ -93,6 +93,8 @@ type DB interface {
 	CreatePortfolioGroupMembership(tx db.Tx, pgID pacta.PortfolioGroupID, pID pacta.PortfolioID) error
 	DeletePortfolioGroupMembership(tx db.Tx, pgID pacta.PortfolioGroupID, pID pacta.PortfolioID) error
 
+	AuditLogs(tx db.Tx, q *db.AuditLogQuery) ([]*pacta.AuditLog, *db.PageInfo, error)
+
 	GetOrCreateUserByAuthn(tx db.Tx, mech pacta.AuthnMechanism, authnID, email, canonicalEmail string) (*pacta.User, error)
 	User(tx db.Tx, id pacta.UserID) (*pacta.User, error)
 	Users(tx db.Tx, ids []pacta.UserID) (map[pacta.UserID]*pacta.User, error)

db/queries.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/RMI/pacta/pacta"
@@ -28,6 +29,32 @@ const (
 	AuditLogQuerySortBy_SecondaryTargetOwnerID AuditLogQuerySortBy = "secondary_target_owner_id"
 )
 
+func ParseAuditLogQuerySortBy(s string) (AuditLogQuerySortBy, error) {
+	switch s {
+	case "created_at":
+		return AuditLogQuerySortBy_CreatedAt, nil
+	case "actor_type":
+		return AuditLogQuerySortBy_ActorType, nil
+	case "actor_id":
+		return AuditLogQuerySortBy_ActorID, nil
+	case "actor_owner_id":
+		return AuditLogQuerySortBy_ActorOwnerID, nil
+	case "primary_target_id":
+		return AuditLogQuerySortBy_PrimaryTargetID, nil
+	case "primary_target_type":
+		return AuditLogQuerySortBy_PrimaryTargetType, nil
+	case "primary_target_owner_id":
+		return AuditLogQuerySortBy_PrimaryTargetOwnerID, nil
+	case "secondary_target_id":
+		return AuditLogQuerySortBy_SecondaryTargetID, nil
+	case "secondary_target_type":
+		return AuditLogQuerySortBy_SecondaryTargetType, nil
+	case "secondary_target_owner_id":
+		return AuditLogQuerySortBy_SecondaryTargetOwnerID, nil
+	}
+	return "", fmt.Errorf("unknown ParseAuditLogActorType: %q", s)
+}
+
 type AuditLogQuerySort struct {
 	By        AuditLogQuerySortBy
 	Ascending bool
@@ -37,7 +64,7 @@ type AuditLogQueryWhere struct {
 	InID            []pacta.AuditLogID
 	MinCreatedAt    time.Time
 	MaxCreatedAt    time.Time
-	InActionType    []pacta.AuditLogAction
+	InAction        []pacta.AuditLogAction
 	InActorType     []pacta.AuditLogActorType
 	InActorID       []string
 	InActorOwnerID  []pacta.OwnerID

db/sqldb/audit_log.go

@@ -207,8 +207,8 @@ func auditLogQueryWheresToSQL(qs []*db.AuditLogQueryWhere, args *queryArgs) stri
 		if len(q.InID) > 0 {
 			wheres = append(wheres, eqOrIn("audit_log.id", q.InID, args))
 		}
-		if len(q.InActionType) > 0 {
-			wheres = append(wheres, eqOrIn("audit_log.action", q.InActionType, args))
+		if len(q.InAction) > 0 {
+			wheres = append(wheres, eqOrIn("audit_log.action", q.InAction, args))
 		}
 		if !q.MinCreatedAt.IsZero() {
 			wheres = append(wheres, "audit_log.created_at >= "+args.add(q.MinCreatedAt))