Class: Gitlab::Audit::Auditor

Inherits:
Object
  • Object
show all
Includes:
Logging
Defined in:
lib/gitlab/audit/auditor.rb

Constant Summary collapse

PERMITTED_TARGET_CLASSES = 
[
  ::Operations::FeatureFlag
].freeze

Constants included from Logging

Logging::ENTITY_TYPE_TO_CLASS

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Logging

#log_to_new_tables

Constructor Details

#initialize(context = {}) ⇒ Auditor

Returns a new instance of Auditor.

Raises:

  • (StandardError) 


66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/gitlab/audit/auditor.rb', line 66

def initialize(context = {})
  @context = context

  @name = @context.fetch(:name, 'audit_operation')
  @is_audit_event_yaml_defined = Gitlab::Audit::Type::Definition.defined?(@name)
  @stream_only = stream_only?
  @author = @context.fetch(:author)
  @scope = @context.fetch(:scope)
  @target = @context.fetch(:target)
  @created_at = @context.fetch(:created_at, DateTime.current)
  @message = @context.fetch(:message, '')
  @additional_details = @context.fetch(:additional_details, {})
  @additional_details[:event_name] = @name
  @ip_address = @context[:ip_address]
  @target_details = @context[:target_details]
  @authentication_event = @context.fetch(:authentication_event, false)
  @authentication_provider = @context[:authentication_provider]
  @organization = @context[:organization]

  return if @is_audit_event_yaml_defined

  raise StandardError, "Audit event type YML file is not defined for #{@name}. Please read " \
    "https://docs.gitlab.com/ee/development/audit_event_guide/" \
    "#how-to-instrument-new-audit-events for adding a new audit event"
end

Instance Attribute Details

#name ⇒ Object (readonly)

Returns the value of attribute name.



6
7
8
 
# File 'lib/gitlab/audit/auditor.rb', line 6

def name
  @name
end

#scope ⇒ Object (readonly)

Returns the value of attribute scope.



6
7
8
 
# File 'lib/gitlab/audit/auditor.rb', line 6

def scope
  @scope
end

Class Method Details

.audit(context, &block) ⇒ Object

Record audit events

Examples:

Using block (useful when events are emitted deep in the call stack)

i.e. multiple audit events

audit_context = {
  name: 'merge_approval_rule_updated',
  author: current_user,
  scope: project_alpha,
  target: merge_approval_rule,
  message: 'a user has attempted to update an approval rule'
}

# in the initiating service
Gitlab::Audit::Auditor.audit(audit_context) do
  service.execute
end

# in the model
Auditable.push_audit_event('an approver has been added')
Auditable.push_audit_event('an approval group has been removed')

Using standard method call

i.e. single audit event

merge_approval_rule.save
Gitlab::Audit::Auditor.audit(audit_context)

Options Hash (context):

  • :name (String) —

    the operation name to be audited, used for error tracking

  • :author (User) —

    the user who authors the change

  • :scope (User, Project, Group) —

    the scope which audit event belongs to

  • :target (Object) —

    the target object being audited

  • :message (String) —

    the message describing the action

  • :additional_details (Hash) —

    the additional details we want to merge into audit event details.

  • :created_at (Time) —

    the time that the event occurred (defaults to the current time)



52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/gitlab/audit/auditor.rb', line 52

def self.audit(context, &block)
  auditor = new(context)

  if block
    return yield unless auditor.audit_enabled?

    auditor.multiple_audit(&block)
  else
    return unless auditor.audit_enabled?

    auditor.single_audit
  end
end

Instance Method Details

#audit_enabled? ⇒ Boolean 



124
125
126
 
# File 'lib/gitlab/audit/auditor.rb', line 124

def audit_enabled?
  authentication_event? || permitted_target?
end

#authentication_event? ⇒ Boolean 



132
133
134
 
# File 'lib/gitlab/audit/auditor.rb', line 132

def authentication_event?
  @authentication_event
end

#authentication_event_payload ⇒ Object 



153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'lib/gitlab/audit/auditor.rb', line 153

def authentication_event_payload
  {
    # @author can be a User or various Gitlab::Audit authors.
    # Only capture real users for successful authentication events.
    user: author_if_user,
    user_name: @author.name,
    ip_address: Gitlab::RequestContext.instance.client_ip || @author.,
    result: AuthenticationEvent.results[:success],
    provider: @authentication_provider,
    organization: @organization
  }
end

#author_if_user ⇒ Object 



166
167
168
 
# File 'lib/gitlab/audit/auditor.rb', line 166

def author_if_user
  @author if @author.is_a?(User)
end

#build_event(message_or_attrs) ⇒ Object 



174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/gitlab/audit/auditor.rb', line 174

def build_event(message_or_attrs)
  params = {
    author: @author,
    scope: @scope,
    target: @target,
    created_at: @created_at,
    message: message_or_attrs,
    additional_details: @additional_details,
    ip_address: @ip_address,
    target_details: @target_details
  }

  params.merge!(message_or_attrs.slice(*params.keys)) if message_or_attrs.is_a?(Hash)

  AuditEvents::BuildService.new(**params).execute
end

#log_authentication_event ⇒ Object 



144
145
146
147
148
149
150
151
 
# File 'lib/gitlab/audit/auditor.rb', line 144

def log_authentication_event
  return unless Gitlab::Database.read_write? && authentication_event?

  event = AuthenticationEvent.new(authentication_event_payload)
  event.save!
rescue ActiveRecord::RecordInvalid => e
  ::Gitlab::ErrorTracking.track_exception(e, audit_operation: @name)
end

#log_events_and_stream(events) ⇒ Object 



107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/gitlab/audit/auditor.rb', line 107

def log_events_and_stream(events)
  log_authentication_event
  saved_events = log_to_database(events)
  log_to_new_tables(saved_events, @name)

  # we only want to override events with saved_events when it successfully saves into database.
  # we are doing so to ensure events in memory reflects events saved in database and have id column.
  events = saved_events if saved_events.present?

  log_to_file_and_stream(events)
end

#log_to_database(events) ⇒ Object 



191
192
193
194
195
196
197
198
199
200
201
202
203
 
# File 'lib/gitlab/audit/auditor.rb', line 191

def log_to_database(events)
  if events.one?
    events.first.save!
    events
  else
    event_ids = AuditEvent.bulk_insert!(events, returns: :ids)
    AuditEvent.id_in(event_ids)
  end
rescue ActiveRecord::RecordInvalid => e
  ::Gitlab::ErrorTracking.track_exception(e, audit_operation: @name)

  nil
end

#log_to_file(events) ⇒ Object 



205
206
207
208
209
 
# File 'lib/gitlab/audit/auditor.rb', line 205

def log_to_file(events)
  file_logger = ::Gitlab::AuditJsonLogger.build

  events.each { |event| file_logger.info(log_payload(event)) }
end

#log_to_file_and_stream(events) ⇒ Object 



119
120
121
122
 
# File 'lib/gitlab/audit/auditor.rb', line 119

def log_to_file_and_stream(events)
  log_to_file(events)
  send_to_stream(events)
end

#multiple_audit ⇒ Object 



98
99
100
101
 
# File 'lib/gitlab/audit/auditor.rb', line 98

def multiple_audit
  # For now we dont have any need to implement multiple audit event functionality in CE
  # Defined in EE
end

#permitted_target? ⇒ Boolean 



128
129
130
 
# File 'lib/gitlab/audit/auditor.rb', line 128

def permitted_target?
  @target.class.in? PERMITTED_TARGET_CLASSES
end

#record(events) ⇒ Object 



103
104
105
 
# File 'lib/gitlab/audit/auditor.rb', line 103

def record(events)
  @stream_only ? send_to_stream(events) : log_events_and_stream(events)
end

#send_to_stream(events) ⇒ Object 



170
171
172
 
# File 'lib/gitlab/audit/auditor.rb', line 170

def send_to_stream(events)
  # Defined in EE
end

#single_audit ⇒ Object 



92
93
94
95
96
 
# File 'lib/gitlab/audit/auditor.rb', line 92

def single_audit
  events = [build_event(@message)]

  record(events)
end

#stream_only? ⇒ Boolean 



136
137
138
139
140
141
142
 
# File 'lib/gitlab/audit/auditor.rb', line 136

def stream_only?
  if @is_audit_event_yaml_defined
    Gitlab::Audit::Type::Definition.stream_only?(@name)
  else
    @context.fetch(:stream_only, false)
  end
end