# retoor <retoor@molodetz.nl>
import json
import logging
from typing import Any, Optional
from devplacepy.utils import strip_html, generate_uid, client_ip
from devplacepy.services.audit import store
from devplacepy.services.audit.categories import category_for
from devplacepy.services.background import background
logger = logging.getLogger(__name__)
_UNSET = object()
SUMMARY_LIMIT = 140
def link(
relation: str,
object_type: str,
object_uid: Optional[str],
object_label: Optional[str] = None,
) -> dict:
return {
"relation": relation,
"object_type": object_type,
"object_uid": object_uid,
"object_label": object_label,
}
def actor(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("actor", "user", uid, label)
def target(object_type: str, uid: Optional[str], label: Optional[str] = None) -> dict:
return link("target", object_type, uid, label)
def parent(object_type: str, uid: Optional[str], label: Optional[str] = None) -> dict:
return link("parent", object_type, uid, label)
def author(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("author", "user", uid, label)
def recipient(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("recipient", "user", uid, label)
def mention(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("mention", "user", uid, label)
def project(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("project", "project", uid, label)
def attachment_link(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("attachment", "attachment", uid, label)
def source(object_type: str, uid: Optional[str], label: Optional[str] = None) -> dict:
return link("source", object_type, uid, label)
def destination(object_type: str, uid: Optional[str], label: Optional[str] = None) -> dict:
return link("destination", object_type, uid, label)
def schedule(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("schedule", "schedule", uid, label)
def instance(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("instance", "instance", uid, label)
def setting(key: Optional[str], label: Optional[str] = None) -> dict:
return link("setting", "setting", key, label or key)
def service_link(name: Optional[str], label: Optional[str] = None) -> dict:
return link("target", "service", name, label or name)
def job(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("job", "job", uid, label)
def poll(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("poll", "poll", uid, label)
def option(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("option", "poll_option", uid, label)
def task(uid: Optional[str], label: Optional[str] = None) -> dict:
return link("target", "task", uid, label)
def _actor_from(user: Optional[dict]) -> dict:
if not user:
return {
"actor_kind": "guest",
"actor_uid": None,
"actor_username": None,
"actor_role": "guest",
}
return {
"actor_kind": "user",
"actor_uid": user.get("uid"),
"actor_username": user.get("username"),
"actor_role": "admin" if user.get("role") == "Admin" else "member",
}
def _request_fields(request) -> dict:
fields: dict = {
"request_method": None,
"request_path": None,
"actor_ip": None,
"user_agent": None,
"devii": False,
}
if request is None:
return fields
try:
fields["request_method"] = getattr(request, "method", None)
url = getattr(request, "url", None)
fields["request_path"] = url.path if url is not None else None
fields["actor_ip"] = client_ip(request, default=None)
headers = getattr(request, "headers", None)
if headers is not None:
fields["user_agent"] = headers.get("user-agent")
fields["devii"] = headers.get("x-devii-agent") == "1"
except Exception as exc:
logger.debug("audit request field read failed: %s", exc)
return fields
def _sanitize_summary(text: Optional[str], limit: int = SUMMARY_LIMIT) -> Optional[str]:
if not text:
return None
cleaned = strip_html(str(text))
if not cleaned:
return None
if len(cleaned) > limit:
return cleaned[: limit - 3].rstrip() + "..."
return cleaned
def _coerce_scalar(value: Any) -> Optional[str]:
if value is None:
return None
if isinstance(value, bool):
return "1" if value else "0"
return str(value)
def _persist(row: dict, links: list[dict]) -> None:
audit_uid = store.insert_event(row)
store.insert_links(audit_uid, links)
def _write(
*,
event_key: str,
base_actor: dict,
request_fields: dict,
target_type: Optional[str],
target_uid: Optional[str],
target_label: Optional[str],
old_value: Any,
new_value: Any,
summary: Optional[str],
metadata: Optional[dict],
result: str,
origin: Optional[str],
via_agent: Optional[int],
links: Optional[list[dict]],
category: Optional[str],
) -> Optional[str]:
resolved_origin = origin
if resolved_origin is None:
resolved_origin = "devii" if request_fields.get("devii") else "web"
resolved_via = via_agent
if resolved_via is None:
resolved_via = 1 if request_fields.get("devii") else 0
audit_uid = generate_uid()
row = {
"uid": audit_uid,
"created_at": store.now(),
"event_key": event_key,
"category": category or category_for(event_key),
"actor_kind": base_actor.get("actor_kind"),
"actor_uid": base_actor.get("actor_uid"),
"actor_username": base_actor.get("actor_username"),
"actor_role": base_actor.get("actor_role"),
"origin": resolved_origin,
"via_agent": int(resolved_via),
"request_method": request_fields.get("request_method"),
"request_path": request_fields.get("request_path"),
"actor_ip": request_fields.get("actor_ip"),
"user_agent": request_fields.get("user_agent"),
"target_type": target_type,
"target_uid": target_uid,
"target_label": _sanitize_summary(target_label, 200),
"old_value": _coerce_scalar(old_value),
"new_value": _coerce_scalar(new_value),
"summary": _sanitize_summary(summary),
"metadata": json.dumps(metadata) if metadata else None,
"result": result,
}
all_links = list(links or [])
if base_actor.get("actor_uid") and not any(
item.get("relation") == "actor" for item in all_links
):
all_links.append(
actor(base_actor["actor_uid"], base_actor.get("actor_username"))
)
background.submit(_persist, row, all_links)
logger.debug(
"audit %s by %s/%s result=%s origin=%s",
event_key,
row["actor_kind"],
row["actor_username"],
result,
resolved_origin,
)
return audit_uid
def record(
request,
event_key: str,
*,
user=_UNSET,
actor_kind: Optional[str] = None,
target_type: Optional[str] = None,
target_uid: Optional[str] = None,
target_label: Optional[str] = None,
old_value: Any = None,
new_value: Any = None,
summary: Optional[str] = None,
metadata: Optional[dict] = None,
result: str = "success",
origin: Optional[str] = None,
via_agent: Optional[int] = None,
links: Optional[list[dict]] = None,
category: Optional[str] = None,
) -> Optional[str]:
try:
if user is _UNSET:
from devplacepy.utils import get_current_user
try:
user = get_current_user(request)
except Exception:
user = None
base_actor = _actor_from(user)
if actor_kind:
base_actor["actor_kind"] = actor_kind
return _write(
event_key=event_key,
base_actor=base_actor,
request_fields=_request_fields(request),
target_type=target_type,
target_uid=target_uid,
target_label=target_label,
old_value=old_value,
new_value=new_value,
summary=summary,
metadata=metadata,
result=result,
origin=origin,
via_agent=via_agent,
links=links,
category=category,
)
except Exception as exc:
logger.warning("audit.record failed for %s: %s", event_key, exc)
return None
def record_system(
event_key: str,
*,
actor_kind: str = "system",
actor_uid: Optional[str] = None,
actor_username: Optional[str] = None,
actor_role: str = "system",
target_type: Optional[str] = None,
target_uid: Optional[str] = None,
target_label: Optional[str] = None,
old_value: Any = None,
new_value: Any = None,
summary: Optional[str] = None,
metadata: Optional[dict] = None,
result: str = "success",
origin: str = "service",
via_agent: int = 0,
links: Optional[list[dict]] = None,
category: Optional[str] = None,
) -> Optional[str]:
try:
base_actor = {
"actor_kind": actor_kind,
"actor_uid": actor_uid,
"actor_username": actor_username,
"actor_role": actor_role,
}
return _write(
event_key=event_key,
base_actor=base_actor,
request_fields={},
target_type=target_type,
target_uid=target_uid,
target_label=target_label,
old_value=old_value,
new_value=new_value,
summary=summary,
metadata=metadata,
result=result,
origin=origin,
via_agent=via_agent,
links=links,
category=category,
)
except Exception as exc:
logger.warning("audit.record_system failed for %s: %s", event_key, exc)
return None
Reference in New Issue View Git Blame Copy Permalink