Implement Audit API

.github/workflows/docker.yaml

@@ -26,9 +26,9 @@ jobs:
  cache: false
 
  - name: Lint
- uses: golangci/golangci-lint-action@v6
+ uses: golangci/golangci-lint-action@v7
  with:
- args: --build-tags integration -p bugs -p unused -D protogetter --timeout=5m
+ args: -D protogetter --timeout=5m
 
  - name: Test
  run: |

.gitignore

@@ -1,2 +1,3 @@
 *.out
-bin/
+bin/
+.vscode

cmd/admin/v1/cluster.go

@@ -196,7 +196,7 @@ func (c *cluster) kubeconfig(args []string) error {
 	}
 
 	if !viper.GetBool("merge") {
- fmt.Fprintln(c.c.Out, resp.Msg.Kubeconfig)
+_, _ = fmt.Fprintln(c.c.Out, resp.Msg.Kubeconfig)
  return nil
 	}
 
@@ -214,7 +214,7 @@ func (c *cluster) kubeconfig(args []string) error {
  return fmt.Errorf("unable to write merged kubeconfig: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s merged context %q into %s\n", color.GreenString("✔"), merged.ContextName, merged.Path)
+_, _ = fmt.Fprintf(c.c.Out, "%s merged context %q into %s\n", color.GreenString("✔"), merged.ContextName, merged.Path)
 
 	return nil
 }

cmd/api/v1/audit.go

@@ -0,0 +1,211 @@
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"connectrpc.com/connect"
+	apiv1 "github.com/metal-stack-cloud/api/go/api/v1"
+	"github.com/metal-stack-cloud/cli/cmd/config"
+	"github.com/metal-stack-cloud/cli/cmd/sorters"
+	"github.com/metal-stack/metal-lib/pkg/genericcli"
+	"github.com/metal-stack/metal-lib/pkg/genericcli/printers"
+	"github.com/metal-stack/metal-lib/pkg/pointer"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+type audit struct {
+	c *config.Config
+}
+
+func newAuditCmd(c *config.Config) *cobra.Command {
+	a := &audit{
+ c: c,
+	}
+
+	cmdsConfig := &genericcli.CmdsConfig[any, any, *apiv1.AuditTrace]{
+ BinaryName: config.BinaryName,
+ GenericCLI: genericcli.NewGenericCLI(a).WithFS(c.Fs),
+ Singular: "audit trace",
+ Plural: "audit traces",
+ Description: "show audit traces of the api-server",
+ Sorter: sorters.AuditSorter(),
+ OnlyCmds: genericcli.OnlyCmds(genericcli.ListCmd, genericcli.DescribeCmd),
+ DescribePrinter: func() printers.Printer { return c.DescribePrinter },
+ ListPrinter: func() printers.Printer { return c.ListPrinter },
+ ListCmdMutateFn: func(cmd *cobra.Command) {
+ cmd.Flags().String("request-id", "", "request id of the audit trace.")
+
+ cmd.Flags().String("from", "", "start of range of the audit traces. e.g. 1h, 10m, 2006-01-02 15:04:05")
+ cmd.Flags().String("to", "", "end of range of the audit traces. e.g. 1h, 10m, 2006-01-02 15:04:05")
+
+ cmd.Flags().String("user", "", "user of the audit trace.")
+ cmd.Flags().String("tenant", "", "tenant of the audit trace.")
+
+ cmd.Flags().String("project", "", "project id of the audit trace")
+
+ cmd.Flags().String("phase", "", "the audit trace phase.")
+ cmd.Flags().String("method", "", "api method of the audit trace.")
+ cmd.Flags().Int32("result-code", 0, "gRPC result status code of the audit trace.")
+ cmd.Flags().String("source-ip", "", "source-ip of the audit trace.")
+
+ cmd.Flags().String("body", "", "filters audit trace body payloads for the given text (full-text search).")
+
+ cmd.Flags().Int64("limit", 0, "limit the number of audit traces.")
+
+ cmd.Flags().Bool("prettify-body", false, "attempts to interpret the body as json and prettifies it.")
+
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("phase", c.Completion.AuditPhaseListCompletion))
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("project", c.Completion.ProjectListCompletion))
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("tenant", c.Completion.TenantListCompletion))
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("result-code", c.Completion.AuditStatusCodesCompletion))
+ },
+ DescribeCmdMutateFn: func(cmd *cobra.Command) {
+ cmd.Flags().String("tenant", "", "tenant of the audit trace.")
+
+ cmd.Flags().String("phase", "", "the audit trace phase.")
+
+ cmd.Flags().Bool("prettify-body", false, "attempts to interpret the body as json and prettifies it.")
+
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("phase", c.Completion.AuditPhaseListCompletion))
+ genericcli.Must(cmd.RegisterFlagCompletionFunc("tenant", c.Completion.TenantListCompletion))
+ },
+	}
+
+	return genericcli.NewCmds(cmdsConfig)
+}
+
+func (a *audit) Get(id string) (*apiv1.AuditTrace, error) {
+	ctx, cancel := a.c.NewRequestContext()
+	defer cancel()
+
+	tenant, err := a.c.GetTenant()
+	if err != nil {
+ return nil, err
+	}
+
+	req := &apiv1.AuditServiceGetRequest{
+ Login: tenant,
+ Uuid: id,
+ Phase: a.toPhase(viper.GetString("phase")),
+	}
+
+	resp, err := a.c.Client.Apiv1().Audit().Get(ctx, connect.NewRequest(req))
+	if err != nil {
+ return nil, fmt.Errorf("failed to get audit trace: %w", err)
+	}
+
+	if viper.GetBool("prettify-body") {
+ a.tryPrettifyBody(resp.Msg.Trace)
+	}
+
+	return resp.Msg.Trace, nil
+}
+
+func (a *audit) List() ([]*apiv1.AuditTrace, error) {
+	ctx, cancel := a.c.NewRequestContext()
+	defer cancel()
+
+	fromDateTime, err := eventuallyRelativeDateTime(viper.GetString("from"))
+	if err != nil {
+ return nil, err
+	}
+	toDateTime, err := eventuallyRelativeDateTime(viper.GetString("to"))
+	if err != nil {
+ return nil, err
+	}
+
+	tenant, err := a.c.GetTenant()
+	if err != nil {
+ return nil, fmt.Errorf("tenant is required %w", err)
+	}
+
+	var code *int32
+	if viper.IsSet("result-code") {
+ code = pointer.Pointer(viper.GetInt32("result-code"))
+	}
+
+	req := &apiv1.AuditServiceListRequest{
+ Login: tenant,
+ Uuid: pointer.PointerOrNil(viper.GetString("request-id")),
+ From: fromDateTime,
+ To: toDateTime,
+ User: pointer.PointerOrNil(viper.GetString("user")),
+ Project: pointer.PointerOrNil(viper.GetString("project")),
+ Method: pointer.PointerOrNil(viper.GetString("method")),
+ ResultCode: code,
+ Body: pointer.PointerOrNil(viper.GetString("body")),
+ SourceIp: pointer.PointerOrNil(viper.GetString("source-ip")),
+ Limit: pointer.PointerOrNil(viper.GetInt32("limit")),
+ Phase: a.toPhase(viper.GetString("phase")),
+	}
+
+	resp, err := a.c.Client.Apiv1().Audit().List(ctx, connect.NewRequest(req))
+	if err != nil {
+ return nil, fmt.Errorf("failed to list audit traces: %w", err)
+	}
+
+	if viper.GetBool("prettify-body") {
+ for _, trace := range resp.Msg.Traces {
+ a.tryPrettifyBody(trace)
+ }
+	}
+
+	return resp.Msg.Traces, nil
+}
+
+func eventuallyRelativeDateTime(s string) (*timestamppb.Timestamp, error) {
+	if s == "" {
+ return nil, nil
+	}
+	duration, err := time.ParseDuration(s)
+	if err == nil {
+ return timestamppb.New(time.Now().Add(-duration)), nil
+	}
+	t, err := time.Parse("2006-01-02 15:04:05", s)
+	if err != nil {
+ return timestamppb.Now(), fmt.Errorf("failed to convert time: %w", err)
+	}
+	return timestamppb.New(t), nil
+}
+
+func (a *audit) Convert(*apiv1.AuditTrace) (string, any, any, error) {
+	return "", nil, nil, fmt.Errorf("not implemented for audit traces")
+}
+
+func (a *audit) Delete(id string) (*apiv1.AuditTrace, error) {
+	return nil, fmt.Errorf("not implemented for audit traces")
+}
+
+func (a *audit) Create(any) (*apiv1.AuditTrace, error) {
+	return nil, fmt.Errorf("not implemented for audit traces")
+}
+
+func (a *audit) Update(any) (*apiv1.AuditTrace, error) {
+	return nil, fmt.Errorf("not implemented for audit traces")
+}
+
+func (a *audit) tryPrettifyBody(trace *apiv1.AuditTrace) {
+	if trace.Body != nil {
+ trimmed := strings.Trim(*trace.Body, `"`)
+ body := map[string]any{}
+ if err := json.Unmarshal([]byte(trimmed), &body); err == nil {
+ if pretty, err := json.MarshalIndent(body, "", " "); err == nil {
+ trace.Body = pointer.Pointer(string(pretty))
+ }
+ }
+	}
+}
+
+func (a *audit) toPhase(phase string) *apiv1.AuditPhase {
+	p, ok := apiv1.AuditPhase_value[phase]
+	if !ok {
+ return nil
+	}
+
+	return pointer.Pointer(apiv1.AuditPhase(p))
+}

cmd/api/v1/cluster.go

@@ -544,7 +544,7 @@ func (c *cluster) kubeconfig(args []string) error {
 	}
 
 	if !viper.GetBool("merge") {
- fmt.Fprintln(c.c.Out, resp.Msg.Kubeconfig)
+_, _ = fmt.Fprintln(c.c.Out, resp.Msg.Kubeconfig)
  return nil
 	}
 
@@ -568,7 +568,7 @@ func (c *cluster) kubeconfig(args []string) error {
  return fmt.Errorf("unable to write merged kubeconfig: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s merged context %q into %s\n", color.GreenString("✔"), merged.ContextName, merged.Path)
+_, _ = fmt.Fprintf(c.c.Out, "%s merged context %q into %s\n", color.GreenString("✔"), merged.ContextName, merged.Path)
 
 	return nil
 }
@@ -637,8 +637,8 @@ func (c *cluster) status(args []string) error {
  return nil
 	}
 
-	fmt.Fprintln(c.c.Out)
-	fmt.Fprintln(c.c.Out, "Last Errors:")
+_, _ = fmt.Fprintln(c.c.Out)
+_, _ = fmt.Fprintln(c.c.Out, "Last Errors:")
 
 	return c.c.ListPrinter.Print(resp.Msg.Cluster.Status.LastErrors)
 }

cmd/api/v1/commands.go

@@ -6,18 +6,19 @@ import (
 )
 
 func AddCmds(cmd *cobra.Command, c *config.Config) {
-	cmd.AddCommand(newVersionCmd(c))
-	cmd.AddCommand(newHealthCmd(c))
 	cmd.AddCommand(newAssetCmd(c))
-	cmd.AddCommand(newTokenCmd(c))
-	cmd.AddCommand(newIPCmd(c))
-	cmd.AddCommand(newStorageCmd(c))
+	cmd.AddCommand(newAuditCmd(c))
 	cmd.AddCommand(newClusterCmd(c))
-	cmd.AddCommand(newProjectCmd(c))
-	cmd.AddCommand(newTenantCmd(c))
+	cmd.AddCommand(newHealthCmd(c))
+	cmd.AddCommand(newIPCmd(c))
 	cmd.AddCommand(newMethodsCmd(c))
 	cmd.AddCommand(newPaymentCmd(c))
+	cmd.AddCommand(newProjectCmd(c))
+	cmd.AddCommand(newStorageCmd(c))
+	cmd.AddCommand(newTenantCmd(c))
+	cmd.AddCommand(newTokenCmd(c))
 	cmd.AddCommand(newUserCmd(c))
+	cmd.AddCommand(newVersionCmd(c))
 }
 
 func newStorageCmd(c *config.Config) *cobra.Command {

cmd/api/v1/methods.go

@@ -47,7 +47,7 @@ func newMethodsCmd(c *config.Config) *cobra.Command {
  sort.Strings(methods)
 
  for _, method := range methods {
- fmt.Fprintln(c.Out, method)
+_, _ = fmt.Fprintln(c.Out, method)
  }
 
  return nil

cmd/api/v1/project.go

@@ -247,15 +247,9 @@ func (c *project) Update(rq *apiv1.ProjectServiceUpdateRequest) (*apiv1.Project,
 }
 
 func (c *project) createRequestFromCLI() (*apiv1.ProjectServiceCreateRequest, error) {
-	tenant := viper.GetString("tenant")
-
-	if tenant == "" && c.c.GetProject() != "" {
- project, err := c.Get(c.c.GetProject())
- if err != nil {
- return nil, fmt.Errorf("unable to derive tenant from project: %w", err)
- }
-
- tenant = project.Tenant
+	tenant, err := c.c.GetTenant()
+	if err != nil {
+ return nil, err
 	}
 
 	if viper.GetString("name") == "" {
@@ -325,7 +319,7 @@ func (c *project) join(args []string) error {
  return fmt.Errorf("failed to join project: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s successfully joined project \"%s\"\n", color.GreenString("✔"), color.GreenString(acceptResp.Msg.ProjectName))
+_, _ = fmt.Fprintf(c.c.Out, "%s successfully joined project \"%s\"\n", color.GreenString("✔"), color.GreenString(acceptResp.Msg.ProjectName))
 
 	return nil
 }
@@ -347,8 +341,8 @@ func (c *project) generateInvite() error {
  return fmt.Errorf("failed to generate an invite: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "You can share this secret with the member to join, it expires in %s:\n\n", humanize.Time(resp.Msg.Invite.ExpiresAt.AsTime()))
-	fmt.Fprintf(c.c.Out, "%s (https://console.metalstack.cloud/project-invite/%s)\n", resp.Msg.Invite.Secret, resp.Msg.Invite.Secret)
+_, _ = fmt.Fprintf(c.c.Out, "You can share this secret with the member to join, it expires in %s:\n\n", humanize.Time(resp.Msg.Invite.ExpiresAt.AsTime()))
+_, _ = fmt.Fprintf(c.c.Out, "%s (https://console.metalstack.cloud/project-invite/%s)\n", resp.Msg.Invite.Secret, resp.Msg.Invite.Secret)
 
 	return nil
 }
@@ -409,7 +403,7 @@ func (c *project) removeMember(args []string) error {
  return fmt.Errorf("failed to remove member from project: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s successfully removed member %q\n", color.GreenString("✔"), member)
+_, _ = fmt.Fprintf(c.c.Out, "%s successfully removed member %q\n", color.GreenString("✔"), member)
 
 	return nil
 }

cmd/api/v1/tenant.go

@@ -317,7 +317,7 @@ func (c *tenant) join(args []string) error {
  return fmt.Errorf("failed to join tenant: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s successfully joined tenant \"%s\"\n", color.GreenString("✔"), color.GreenString(acceptResp.Msg.TenantName))
+_, _ = fmt.Fprintf(c.c.Out, "%s successfully joined tenant \"%s\"\n", color.GreenString("✔"), color.GreenString(acceptResp.Msg.TenantName))
 
 	return nil
 }
@@ -339,8 +339,8 @@ func (c *tenant) generateInvite() error {
  return fmt.Errorf("failed to generate an invite: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "You can share this secret with the member to join, it expires in %s:\n\n", humanize.Time(resp.Msg.Invite.ExpiresAt.AsTime()))
-	fmt.Fprintf(c.c.Out, "%s (https://console.metalstack.cloud/organization-invite/%s)\n", resp.Msg.Invite.Secret, resp.Msg.Invite.Secret)
+_, _ = fmt.Fprintf(c.c.Out, "You can share this secret with the member to join, it expires in %s:\n\n", humanize.Time(resp.Msg.Invite.ExpiresAt.AsTime()))
+_, _ = fmt.Fprintf(c.c.Out, "%s (https://console.metalstack.cloud/organization-invite/%s)\n", resp.Msg.Invite.Secret, resp.Msg.Invite.Secret)
 
 	return nil
 }
@@ -416,7 +416,7 @@ func (c *tenant) removeMember(args []string) error {
  return fmt.Errorf("failed to remove member from tenant: %w", err)
 	}
 
-	fmt.Fprintf(c.c.Out, "%s successfully removed member %q\n", color.GreenString("✔"), member)
+_, _ = fmt.Fprintf(c.c.Out, "%s successfully removed member %q\n", color.GreenString("✔"), member)
 
 	return nil
 }