TAI/TA-Deployment-Broker
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
David Schroeder
2026-07-26 10:33:50 -05:00
parent 60a739a1aa
commit 0ed0fb5817
8 changed files with 35 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/audit_test.go
+3 -1
View File
@@ -77,6 +77,9 @@ func TestAuditQueryUsesPlaceholders(t *testing.T) {
if strings.Contains(query, "INTERVAL") {
t.Fatal("all-time query must not include a time restriction")
}
if strings.Contains(query, "lan_ip") {
t.Fatal("audit query must use the single source_ip column")
}
if !strings.HasSuffix(query, "ORDER BY ae.created_at DESC LIMIT ?") {
t.Fatalf("query has unexpected limit: %s", query)
}
@@ -88,7 +91,6 @@ func TestAuditQueryUsesPlaceholders(t *testing.T) {
"sentinelone-linux",
"install-rmm",
"10.10.1.25",
"10.10.1.25",
250,
}
if !reflect.DeepEqual(arguments, expectedArguments) {
internal/app/authorization.go
+6 -24
View File
@@ -207,7 +207,7 @@ func (s *Server) listAuditEventTypes(r *http.Request) ([]string, error) {
func auditQuery(filters auditFilters, limit int) (string, []any) {
query := `SELECT ae.event_type, COALESCE(a.customer_label, ''), ae.actor,
ae.hostname, ae.package_slug, ae.source_ip, ae.lan_ip,
ae.hostname, ae.package_slug, ae.source_ip,
ae.details, ae.created_at
FROM audit_events ae
LEFT JOIN authorizations a ON a.id = ae.authorization_id
@@ -244,8 +244,8 @@ func auditQuery(filters auditFilters, limit int) (string, []any) {
arguments = append(arguments, filter.value)
}
if filters.SourceIP != "" {
query += " AND (LOCATE(?, ae.source_ip) > 0 OR LOCATE(?, ae.lan_ip) > 0)"
arguments = append(arguments, filters.SourceIP, filters.SourceIP)
query += " AND LOCATE(?, ae.source_ip) > 0"
arguments = append(arguments, filters.SourceIP)
}
query += " ORDER BY ae.created_at DESC LIMIT ?"
arguments = append(arguments, limit)
@@ -274,7 +274,6 @@ func (s *Server) listAuditEvents(r *http.Request, filters auditFilters, limit in
&record.Hostname,
&record.PackageSlug,
&record.SourceIP,
&record.LANIP,
&record.Details,
&record.CreatedAt,
); err != nil {
@@ -623,23 +622,6 @@ func (s *Server) audit(
packageSlug string,
sourceIP string,
details string,
) error {
return s.auditWithNetwork(
ctx, eventType, user, authorizationID, hostname, packageSlug,
sourceIP, "", details,
)
}
func (s *Server) auditWithNetwork(
ctx context.Context,
eventType string,
user string,
authorizationID *uint64,
hostname string,
packageSlug string,
sourceIP string,
lanIP string,
details string,
) error {
var authID any
if authorizationID != nil {
@@ -649,9 +631,9 @@ func (s *Server) auditWithNetwork(
ctx,
`INSERT INTO audit_events
(event_type, actor, authorization_id, hostname, package_slug,
source_ip, lan_ip, details)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
eventType, user, authID, hostname, packageSlug, sourceIP, lanIP, details,
source_ip, details)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
eventType, user, authID, hostname, packageSlug, sourceIP, details,
)
return err
}
internal/app/download.go
+16 -31
View File
@@ -6,7 +6,6 @@ import (
"errors"
"fmt"
"io"
"net"
"net/http"
"net/url"
"strings"
@@ -17,7 +16,6 @@ type exchangeRequest struct {
Code string `json:"code"`
HostFingerprint string `json:"host_fingerprint"`
Hostname string `json:"hostname"`
LANIP string `json:"lan_ip,omitempty"`
RequestedAction string `json:"requested_action,omitempty"`
RequestedPackage string `json:"requested_package,omitempty"`
}
@@ -59,17 +57,8 @@ func (s *Server) handleExchange(w http.ResponseWriter, r *http.Request) {
request.Code = normalizeCode(request.Code)
request.HostFingerprint = strings.TrimSpace(request.HostFingerprint)
request.Hostname = strings.TrimSpace(request.Hostname)
request.LANIP = strings.TrimSpace(request.LANIP)
request.RequestedAction = strings.TrimSpace(request.RequestedAction)
request.RequestedPackage = strings.TrimSpace(request.RequestedPackage)
if request.LANIP != "" {
parsedLANIP := net.ParseIP(request.LANIP)
if parsedLANIP == nil {
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "lan_ip must be a valid IP address"})
return
}
request.LANIP = parsedLANIP.String()
}
if request.Code == "" || len(request.HostFingerprint) < 16 ||
request.Hostname == "" || len(request.Hostname) > 255 ||
(request.RequestedAction != "" && !validSlug(request.RequestedAction)) ||
@@ -86,12 +75,12 @@ func (s *Server) handleExchange(w http.ResponseWriter, r *http.Request) {
status = http.StatusForbidden
message = "authorization is invalid, expired, revoked, or at its host limit"
}
_ = s.auditWithNetwork(r.Context(), "code_exchange_failed", "", nil,
request.Hostname, "", sourceIP, request.LANIP, err.Error())
_ = s.audit(r.Context(), "code_exchange_failed", "", nil,
request.Hostname, "", sourceIP, err.Error())
writeJSON(w, status, map[string]string{"error": message})
return
}
_ = s.auditWithNetwork(
_ = s.audit(
r.Context(),
"code_exchanged",
"",
@@ -99,7 +88,6 @@ func (s *Server) handleExchange(w http.ResponseWriter, r *http.Request) {
request.Hostname,
request.RequestedPackage,
sourceIP,
request.LANIP,
"requested_action="+request.RequestedAction,
)
writeJSON(w, http.StatusOK, response)
@@ -212,9 +200,9 @@ func (s *Server) exchangeDeploymentCode(
result, err := tx.ExecContext(
r.Context(),
`INSERT INTO authorization_hosts
(authorization_id, host_fingerprint, hostname, lan_ip)
VALUES (?, ?, ?, ?)`,
authorizationID, fingerprintHash[:], request.Hostname, request.LANIP,
(authorization_id, host_fingerprint, hostname)
VALUES (?, ?, ?)`,
authorizationID, fingerprintHash[:], request.Hostname,
)
if err != nil {
return response, 0, err
@@ -228,10 +216,9 @@ func (s *Server) exchangeDeploymentCode(
r.Context(),
`UPDATE authorization_hosts
SET hostname = ?,
lan_ip = COALESCE(NULLIF(?, ''), lan_ip),
last_seen_at = UTC_TIMESTAMP(6)
WHERE id = ?`,
request.Hostname, request.LANIP, hostID,
request.Hostname, hostID,
)
if err != nil {
return response, 0, err
@@ -343,12 +330,11 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
var packageInfo packageRecord
var authorizationID uint64
var hostname string
var lanIP string
err := s.db.QueryRowContext(
r.Context(),
`SELECT p.id, p.slug, p.display_name, p.package_name,
p.package_version, p.file_name, p.sha256, p.enabled,
ds.authorization_id, ah.hostname, ah.lan_ip
ds.authorization_id, ah.hostname
FROM download_sessions ds
JOIN authorizations a ON a.id = ds.authorization_id
JOIN authorization_hosts ah ON ah.id = ds.authorization_host_id
@@ -373,7 +359,6 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
&packageInfo.Enabled,
&authorizationID,
&hostname,
&lanIP,
)
if errors.Is(err, sql.ErrNoRows) {
writeJSON(w, http.StatusForbidden, map[string]string{"error": "package is not authorized"})
@@ -402,15 +387,15 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
upstreamRequest.SetBasicAuth(s.cfg.GiteaPackageUser, s.cfg.GiteaPackageToken)
upstreamResponse, err := s.packageClient.Do(upstreamRequest)
if err != nil {
_ = s.auditWithNetwork(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), lanIP, err.Error())
_ = s.audit(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), err.Error())
writeJSON(w, http.StatusBadGateway, map[string]string{"error": "package registry is unavailable"})
return
}
defer upstreamResponse.Body.Close()
if upstreamResponse.StatusCode != http.StatusOK {
_ = s.auditWithNetwork(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), lanIP, upstreamResponse.Status)
_ = s.audit(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), upstreamResponse.Status)
writeJSON(w, http.StatusBadGateway, map[string]string{"error": "package registry rejected the request"})
return
}
@@ -421,10 +406,10 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Cache-Control", "no-store")
w.WriteHeader(http.StatusOK)
if _, err := io.Copy(w, upstreamResponse.Body); err != nil {
_ = s.auditWithNetwork(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), lanIP, err.Error())
_ = s.audit(r.Context(), "package_download_failed", "",
&authorizationID, hostname, slug, s.clientIP(r), err.Error())
return
}
_ = s.auditWithNetwork(r.Context(), "package_downloaded", "",
&authorizationID, hostname, slug, s.clientIP(r), lanIP, "")
_ = s.audit(r.Context(), "package_downloaded", "",
&authorizationID, hostname, slug, s.clientIP(r), "")
}
internal/app/server.go
-1
View File
@@ -75,7 +75,6 @@ type auditRecord struct {
Hostname string
PackageSlug string
SourceIP string
LANIP string
Details string
CreatedAt time.Time
}
internal/app/server_test.go
-1
View File
@@ -73,7 +73,6 @@ func TestPackageAndAuditTemplatesExecute(t *testing.T) {
CustomerLabel: "Acme cluster refresh",
Hostname: "pve01",
SourceIP: "203.0.113.10",
LANIP: "10.10.1.25",
CreatedAt: time.Now(),
}}
if err := templates.ExecuteTemplate(io.Discard, "audit.html", data); err != nil {
internal/app/templates/audit.html
+1 -1
View File
@@ -42,7 +42,7 @@
<label>User <input name="audit_user" value="{{.AuditFilters.User}}" placeholder="taiadmin"></label>
<label>Hostname <input name="audit_hostname" value="{{.AuditFilters.Hostname}}" placeholder="pve01"></label>
<label>Package ID <input name="audit_package" value="{{.AuditFilters.PackageSlug}}" placeholder="sentinelone-linux"></label>
<label>LAN or WAN IP <input name="audit_ip" value="{{.AuditFilters.SourceIP}}" placeholder="10.10.1.25"></label>
<label>IP address <input name="audit_ip" value="{{.AuditFilters.SourceIP}}" placeholder="10.10.1.25"></label>
<label>Details contain <input name="audit_details" value="{{.AuditFilters.Details}}" placeholder="customer or action"></label>
<div class="audit-filter-actions">
<button class="button secondary" type="submit">Apply filters</button>
internal/app/templates/components.html
+2 -4
View File
@@ -29,7 +29,7 @@
<span>Event</span>
<span>Customer / deployment</span>
<span>User / host / package</span>
<span>WAN / LAN / details</span>
<span>IP / Details</span>
</div>
{{range .AuditEvents}}
<div class="audit-row">
@@ -46,9 +46,7 @@
{{if .PackageSlug}}<span>{{.PackageSlug}}</span>{{end}}
</div>
<div>
{{if .SourceIP}}<span>WAN: {{.SourceIP}}</span>{{end}}
{{if .LANIP}}<span>LAN: {{.LANIP}}</span>{{end}}
{{if and (not .SourceIP) (not .LANIP)}}<span>—</span>{{end}}
{{if .SourceIP}}<span>{{.SourceIP}}</span>{{else}}<span>—</span>{{end}}
{{if .Details}}<small>{{.Details}}</small>{{end}}
</div>
</div>
migrations/004_remove_lan_ip.sql
+7
View File
@@ -0,0 +1,7 @@
ALTER TABLE authorization_hosts
DROP COLUMN IF EXISTS lan_ip;
ALTER TABLE audit_events
DROP COLUMN IF EXISTS lan_ip;
INSERT IGNORE INTO schema_migrations (version) VALUES (4);