TAI/TA-Deployment-Broker
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update audit view

Browse Source
This commit is contained in:
David Schroeder
2026-07-25 15:50:06 -05:00
parent 01a3d1250a
commit 90d5b637ac
8 changed files with 85 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/authorization.go
+26 -20
View File
@@ -61,6 +61,7 @@ func hasAuditQuery(r *http.Request) bool {
for _, field := range []string{
"audit_range",
"audit_event",
"audit_customer",
"audit_actor",
"audit_hostname",
"audit_package",
@@ -155,13 +156,14 @@ func auditFiltersFromRequest(r *http.Request) auditFilters {
timeRange = "30d"
}
return auditFilters{
TimeRange: timeRange,
EventType: limitedFilter(query.Get("audit_event"), 100),
Actor: limitedFilter(query.Get("audit_actor"), 255),
Hostname: limitedFilter(query.Get("audit_hostname"), 255),
PackageSlug: limitedFilter(query.Get("audit_package"), 100),
SourceIP: limitedFilter(query.Get("audit_ip"), 64),
Details: limitedFilter(query.Get("audit_details"), 255),
TimeRange: timeRange,
EventType: limitedFilter(query.Get("audit_event"), 100),
CustomerLabel: limitedFilter(query.Get("audit_customer"), 255),
Actor: limitedFilter(query.Get("audit_actor"), 255),
Hostname: limitedFilter(query.Get("audit_hostname"), 255),
PackageSlug: limitedFilter(query.Get("audit_package"), 100),
SourceIP: limitedFilter(query.Get("audit_ip"), 64),
Details: limitedFilter(query.Get("audit_details"), 255),
}
}
@@ -198,32 +200,35 @@ func (s *Server) listAuditEventTypes(r *http.Request) ([]string, error) {
}
func auditQuery(filters auditFilters, limit int) (string, []any) {
query := `SELECT event_type, actor, hostname, package_slug, source_ip, details, created_at
FROM audit_events
query := `SELECT ae.event_type, COALESCE(a.customer_label, ''), ae.actor,
ae.hostname, ae.package_slug, ae.source_ip, ae.details, ae.created_at
FROM audit_events ae
LEFT JOIN authorizations a ON a.id = ae.authorization_id
WHERE 1 = 1`
var arguments []any
timeClauses := map[string]string{
"24h": " AND created_at >= UTC_TIMESTAMP(6) - INTERVAL 1 DAY",
"7d": " AND created_at >= UTC_TIMESTAMP(6) - INTERVAL 7 DAY",
"30d": " AND created_at >= UTC_TIMESTAMP(6) - INTERVAL 30 DAY",
"90d": " AND created_at >= UTC_TIMESTAMP(6) - INTERVAL 90 DAY",
"24h": " AND ae.created_at >= UTC_TIMESTAMP(6) - INTERVAL 1 DAY",
"7d": " AND ae.created_at >= UTC_TIMESTAMP(6) - INTERVAL 7 DAY",
"30d": " AND ae.created_at >= UTC_TIMESTAMP(6) - INTERVAL 30 DAY",
"90d": " AND ae.created_at >= UTC_TIMESTAMP(6) - INTERVAL 90 DAY",
}
query += timeClauses[filters.TimeRange]
if filters.EventType != "" {
query += " AND event_type = ?"
query += " AND ae.event_type = ?"
arguments = append(arguments, filters.EventType)
}
containsFilters := []struct {
column string
value string
}{
{"actor", filters.Actor},
{"hostname", filters.Hostname},
{"package_slug", filters.PackageSlug},
{"source_ip", filters.SourceIP},
{"details", filters.Details},
{"COALESCE(a.customer_label, '')", filters.CustomerLabel},
{"ae.actor", filters.Actor},
{"ae.hostname", filters.Hostname},
{"ae.package_slug", filters.PackageSlug},
{"ae.source_ip", filters.SourceIP},
{"ae.details", filters.Details},
}
for _, filter := range containsFilters {
if filter.value == "" {
@@ -232,7 +237,7 @@ func auditQuery(filters auditFilters, limit int) (string, []any) {
query += " AND LOCATE(?, " + filter.column + ") > 0"
arguments = append(arguments, filter.value)
}
query += " ORDER BY created_at DESC LIMIT ?"
query += " ORDER BY ae.created_at DESC LIMIT ?"
arguments = append(arguments, limit)
return query, arguments
}
@@ -254,6 +259,7 @@ func (s *Server) listAuditEvents(r *http.Request, filters auditFilters, limit in
var record auditRecord
if err := rows.Scan(
&record.EventType,
&record.CustomerLabel,
&record.Actor,
&record.Hostname,
&record.PackageSlug,