Skip to content
This repository was archived by the owner on Jun 2, 2021. It is now read-only.

Commit 648958d

Browse files
FelisiaMFelisiaM
authored
V3 add audit events for route bindings 175228173 (cloudfoundry#1945)
* v3(services) Created generic binding event repository - Should be usable by route bindings, credential bindings of type app and key [#175228173](https://www.pivotaltracker.com/story/show/175228173) * v3(services): Added audit events for service_route_bindings * v3(services) Added audit events for unbind service route bindings * v3(services) Removed audit logging in service instance when binding route service * Formatting fix * Added constants for the event repo type
1 parent 474a9c4 commit 648958d

16 files changed

+408
-130
lines changed

‎app/actions/service_credential_binding_create.rb‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
require 'repositories/service_binding_event_repository'
1+
require 'repositories/service_generic_binding_event_repository'
22
require 'services/service_brokers/service_client_provider'
33
require 'actions/v3/service_binding_create'
44

@@ -84,7 +84,8 @@ def all_space_guids(service_instance)
8484
end
8585

8686
def event_repository
87-
Repositories::ServiceBindingEventRepository
87+
@event_repository ||= Repositories::ServiceGenericBindingEventRepository.new(
88+
Repositories::ServiceGenericBindingEventRepository::SERVICE_APP_CREDENTIAL_BINDING)
8889
end
8990

9091
def operation_in_progress!

‎app/actions/service_credential_binding_delete.rb‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ def perform_start_delete_actions(binding)
2121
end
2222

2323
def event_repository
24-
Repositories::ServiceBindingEventRepository
24+
@event_repository ||= Repositories::ServiceGenericBindingEventRepository.new(
25+
Repositories::ServiceGenericBindingEventRepository::SERVICE_APP_CREDENTIAL_BINDING)
2526
end
2627
end
2728
end

‎app/actions/service_route_binding_create.rb‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@
55
module VCAP::CloudController
66
module V3
77
class ServiceRouteBindingCreate < V3::ServiceBindingCreate
8-
def initialize(service_event_repository)
8+
def initialize(user_audit_info, audit_hash)
99
super()
10-
@service_event_repository = service_event_repository
10+
@user_audit_info = user_audit_info
11+
@audit_hash = audit_hash
1112
end
1213

1314
def precursor(service_instance, route, message:)
@@ -35,6 +36,11 @@ class RouteBindingAlreadyExists < StandardError; end
3536

3637
private
3738

39+
def event_repository
40+
@event_repository ||= Repositories::ServiceGenericBindingEventRepository.new(
41+
Repositories::ServiceGenericBindingEventRepository::SERVICE_ROUTE_BINDING)
42+
end
43+
3844
def validate!(service_instance, route)
3945
not_supported! unless service_instance.route_service?
4046
not_bindable! unless service_instance.bindable?
@@ -45,8 +51,6 @@ def validate!(service_instance, route)
4551
operation_in_progress! if service_instance.operation_in_progress?
4652
end
4753

48-
attr_reader :service_event_repository
49-
5054
def complete_binding_and_save(binding, binding_details, last_operation)
5155
binding.save_with_attributes_and_new_operation(
5256
{
@@ -58,15 +62,32 @@ def complete_binding_and_save(binding, binding_details, last_operation)
5862
description: last_operation[:description],
5963
}
6064
)
65+
6166
binding.notify_diego
62-
record_audit_event(binding)
67+
68+
event_repository.record_create(
69+
binding,
70+
@user_audit_info,
71+
@audit_hash,
72+
manifest_triggered: false
73+
)
6374
end
6475

65-
def record_audit_event(precursor)
66-
service_event_repository.record_service_instance_event(
67-
:bind_route,
68-
precursor.service_instance,
69-
{ route_guid: precursor.route.guid },
76+
def save_incomplete_binding(precursor, operation)
77+
precursor.save_with_attributes_and_new_operation(
78+
{},
79+
{
80+
type: 'create',
81+
state: 'in progress',
82+
broker_provided_operation: operation
83+
}
84+
)
85+
86+
event_repository.record_start_create(
87+
precursor,
88+
@user_audit_info,
89+
@audit_hash,
90+
manifest_triggered: false
7091
)
7192
end
7293

‎app/actions/service_route_binding_delete.rb‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,30 @@
44
module VCAP::CloudController
55
module V3
66
class ServiceRouteBindingDelete < V3::ServiceBindingDelete
7-
def initialize(service_event_repository)
7+
def initialize(user_audit_info)
88
super()
9-
@service_event_repository = service_event_repository
9+
@user_audit_info = user_audit_info
1010
end
1111

1212
private
1313

14-
attr_reader :service_event_repository
14+
def event_repository
15+
@event_repository ||= Repositories::ServiceGenericBindingEventRepository.new(
16+
Repositories::ServiceGenericBindingEventRepository::SERVICE_ROUTE_BINDING)
17+
end
1518

1619
def perform_delete_actions(binding)
17-
record_audit_event(binding)
20+
event_repository.record_delete(
21+
binding,
22+
@user_audit_info
23+
)
24+
1825
binding.destroy
1926
binding.notify_diego
2027
end
2128

22-
def record_audit_event(binding)
23-
service_event_repository.record_service_instance_event(
24-
:unbind_route,
25-
binding.service_instance,
26-
{ route_guid: binding.route.guid },
27-
)
29+
def perform_start_delete_actions(binding)
30+
event_repository.record_start_delete(binding, @user_audit_info)
2831
end
2932
end
3033
end

‎app/actions/v3/service_binding_create.rb‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -76,17 +76,6 @@ def save_last_operation(binding, details)
7676
)
7777
end
7878

79-
def save_incomplete_binding(precursor, operation)
80-
precursor.save_with_attributes_and_new_operation(
81-
{},
82-
{
83-
type: 'create',
84-
state: 'in progress',
85-
broker_provided_operation: operation
86-
}
87-
)
88-
end
89-
9079
def bindings_retrievable?(binding)
9180
binding.service_instance.service.bindings_retrievable
9281
end

‎app/actions/v3/service_binding_delete.rb‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,6 @@ class BindingNotRetrievable < StandardError; end
6363

6464
private
6565

66-
def perform_start_delete_actions(binding); end
67-
6866
def send_unbind_to_client(binding)
6967
client = VCAP::Services::ServiceClientProvider.provide(instance: binding.service_instance)
7068
details = client.unbind(binding, nil, true)

‎app/controllers/v3/service_route_bindings_controller.rb‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ def create
4545
route = fetch_route(message.route_guid)
4646

4747
check_parameters_support(service_instance, message)
48-
action = V3::ServiceRouteBindingCreate.new(service_event_repository)
48+
action = V3::ServiceRouteBindingCreate.new(user_audit_info, message.audit_hash)
4949
precursor = action.precursor(service_instance, route, message: message)
5050

5151
case service_instance
5252
when ManagedServiceInstance
53-
pollable_job_guid = enqueue_bind_job(precursor.guid, message.parameters)
53+
pollable_job_guid = enqueue_bind_job(precursor.guid, message)
5454
head :accepted, 'Location' => url_builder.build_url(path: "/v3/jobs/#{pollable_job_guid}")
5555
when UserProvidedServiceInstance
5656
action.bind(precursor)
@@ -71,7 +71,7 @@ def destroy
7171
pollable_job_guid = enqueue_unbind_job(@route_binding.guid)
7272
head :accepted, 'Location' => url_builder.build_url(path: "/v3/jobs/#{pollable_job_guid}")
7373
when UserProvidedServiceInstance
74-
action = V3::ServiceRouteBindingDelete.new(service_event_repository)
74+
action = V3::ServiceRouteBindingDelete.new(user_audit_info)
7575
action.delete(@route_binding)
7676
head :no_content
7777
end
@@ -132,13 +132,13 @@ def valid_message(message_type:)
132132
end
133133
end
134134

135-
def enqueue_bind_job(binding_guid, parameters)
135+
def enqueue_bind_job(binding_guid, message)
136136
bind_job = VCAP::CloudController::V3::CreateBindingAsyncJob.new(
137137
:route,
138138
binding_guid,
139139
user_audit_info: user_audit_info,
140-
audit_hash: {},
141-
parameters: parameters,
140+
audit_hash: message.audit_hash,
141+
parameters: message.parameters,
142142
)
143143
pollable_job = Jobs::Enqueuer.new(bind_job, queue: Jobs::Queues.generic).enqueue_pollable
144144
pollable_job.guid

‎app/jobs/v3/create_service_binding_job_factory.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@ def self.for(type)
2121
def self.action(type, user_audit_info, audit_hash)
2222
case type
2323
when :route
24-
service_event_repository = VCAP::CloudController::Repositories::ServiceEventRepository::WithUserActor.new(user_audit_info)
25-
V3::ServiceRouteBindingCreate.new(service_event_repository)
24+
V3::ServiceRouteBindingCreate.new(user_audit_info, audit_hash)
2625
when :credential
2726
V3::ServiceCredentialBindingCreate.new(user_audit_info, audit_hash)
2827
else

‎app/jobs/v3/delete_service_binding_job_factory.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,7 @@ def self.for(type)
2323
def self.action(type, user_audit_info)
2424
case type
2525
when :route
26-
service_event_repository = VCAP::CloudController::Repositories::ServiceEventRepository::WithUserActor.new(user_audit_info)
27-
V3::ServiceRouteBindingDelete.new(service_event_repository)
26+
V3::ServiceRouteBindingDelete.new(user_audit_info)
2827
when :credential
2928
V3::ServiceCredentialBindingDelete.new(user_audit_info)
3029
else

‎app/repositories/service_generic_binding_event_repository.rb‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
require 'repositories/mixins/app_manifest_event_mixins'
2+
3+
module VCAP::CloudController
4+
module Repositories
5+
class ServiceGenericBindingEventRepository
6+
include AppManifestEventMixins
7+
8+
SERVICE_APP_CREDENTIAL_BINDING = 'service_binding'.freeze
9+
SERVICE_KEY_CREDENTIAL_BINDING = 'service_key'.freeze
10+
SERVICE_ROUTE_BINDING = 'service_route_binding'.freeze
11+
12+
def initialize(actee_name)
13+
@actee_name = actee_name
14+
end
15+
16+
def record_start_create(service_binding, user_audit_info, request, manifest_triggered: false)
17+
attrs = censor_request_attributes(request)
18+
19+
record_event(
20+
type: "audit.#{@actee_name}.start_create",
21+
service_binding: service_binding,
22+
user_audit_info: user_audit_info,
23+
metadata: add_manifest_triggered(manifest_triggered, { request: attrs })
24+
)
25+
end
26+
27+
def record_create(service_binding, user_audit_info, request, manifest_triggered: false)
28+
attrs = censor_request_attributes(request)
29+
30+
record_event(
31+
type: "audit.#{@actee_name}.create",
32+
service_binding: service_binding,
33+
user_audit_info: user_audit_info,
34+
metadata: add_manifest_triggered(manifest_triggered, { request: attrs })
35+
)
36+
end
37+
38+
def record_start_delete(service_binding, user_audit_info)
39+
record_event(
40+
type: "audit.#{@actee_name}.start_delete",
41+
service_binding: service_binding,
42+
user_audit_info: user_audit_info,
43+
metadata: {
44+
request: {
45+
app_guid: service_binding.try(:app_guid),
46+
route_guid: service_binding.try(:route_guid),
47+
service_instance_guid: service_binding.service_instance_guid,
48+
}
49+
}
50+
)
51+
end
52+
53+
def record_delete(service_binding, user_audit_info)
54+
record_event(
55+
type: "audit.#{@actee_name}.delete",
56+
service_binding: service_binding,
57+
user_audit_info: user_audit_info,
58+
metadata: {
59+
request: {
60+
app_guid: service_binding.try(:app_guid),
61+
route_guid: service_binding.try(:route_guid),
62+
service_instance_guid: service_binding.service_instance_guid,
63+
}
64+
}
65+
)
66+
end
67+
68+
private
69+
70+
def censor_request_attributes(request)
71+
attrs = request.dup.stringify_keys
72+
attrs['data'] = Presenters::Censorship::PRIVATE_DATA_HIDDEN if attrs.key?('data')
73+
attrs
74+
end
75+
76+
def record_event(type:, service_binding:, user_audit_info:, metadata: {})
77+
space_guid = service_binding.service_instance.space.guid
78+
org_guid = service_binding.service_instance.space.organization.guid
79+
80+
if service_binding.try(:space)
81+
space_guid = service_binding.space.guid
82+
org_guid = service_binding.space.organization.guid
83+
end
84+
85+
Event.create(
86+
type: type,
87+
actor: user_audit_info.user_guid,
88+
actor_type: 'user',
89+
actor_name: user_audit_info.user_email,
90+
actor_username: user_audit_info.user_name,
91+
actee: service_binding.guid,
92+
actee_type: @actee_name,
93+
actee_name: service_binding.try(:name) || '',
94+
space_guid: space_guid,
95+
organization_guid: org_guid,
96+
timestamp: Sequel::CURRENT_TIMESTAMP,
97+
metadata: metadata
98+
)
99+
end
100+
end
101+
end
102+
end

0 commit comments

Comments
 (0)