Examples with AuditLog keywhiz.log.AuditLog used on opensource projects

Example 1 with AuditLog

use of keywhiz.log.AuditLog in project keywhiz by square.

the class SecretResource method createSecret.

/**
 * Creates a secret and assigns to given groups
 *
 * @param request JSON request to create a secret
 *
 * responseMessage 201 Created secret and assigned to given groups
 * responseMessage 409 Secret already exists
 */
@Timed
@ExceptionMetered
@POST
@Consumes(APPLICATION_JSON)
public Response createSecret(@Auth AutomationClient automationClient, @Valid CreateSecretRequestV2 request) {
    // allows new version, return version in resulting path
    String name = request.name();
    String user = automationClient.getName();
    SecretBuilder builder = secretController.builder(name, request.content(), automationClient.getName(), request.expiry()).withDescription(request.description()).withMetadata(request.metadata()).withOwnerName(request.owner()).withType(request.type());
    Secret secret;
    try {
        secret = builder.create();
    } catch (DataAccessException e) {
        logger.info(format("Cannot create secret %s", name), e);
        throw new ConflictException(format("Cannot create secret %s.", name));
    }
    Map<String, String> extraInfo = new HashMap<>();
    if (request.description() != null) {
        extraInfo.put("description", request.description());
    }
    if (request.metadata() != null) {
        extraInfo.put("metadata", request.metadata().toString());
    }
    extraInfo.put("expiry", Long.toString(request.expiry()));
    auditLog.recordEvent(new Event(Instant.now(), EventTag.SECRET_CREATE, user, name, extraInfo));
    long secretId = secret.getId();
    groupsToGroupIds(request.groups()).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAO.findAndAllowAccess(secretId, groupId, auditLog, user, new HashMap<>())));
    UriBuilder uriBuilder = UriBuilder.fromResource(SecretResource.class).path(name);
    return Response.created(uriBuilder.build()).build();
}

Example 2 with AuditLog

use of keywhiz.log.AuditLog in project keywhiz by square.

the class ClientResource method doCreateClient.

private Response doCreateClient(AutomationClient automationClient, CreateClientRequestV2 request) {
    String creator = automationClient.getName();
    String client = request.name();
    setTag("client", client);
    clientDAOReadWrite.getClientByName(client).ifPresent((c) -> {
        logger.info("Automation ({}) - Client {} already exists", creator, client);
        throw new ConflictException("Client name already exists.");
    });
    // Creates new client record
    long clientId;
    try {
        clientId = clientDAOReadWrite.createClient(client, creator, request.description(), new URI(request.spiffeId()));
    } catch (URISyntaxException e) {
        logger.info(format("Automation (%s) - Client %s could not be created because of invalid SPIFFE ID %s", creator, client, request.spiffeId()), e);
        throw new BadRequestException("Invalid SPIFFE ID provided (not a URI)");
    }
    auditLog.recordEvent(new Event(Instant.now(), EventTag.CLIENT_CREATE, creator, client));
    // Enrolls client in any requested groups
    groupsToGroupIds(request.groups()).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAOReadWrite.findAndEnrollClient(clientId, groupId, auditLog, creator, new HashMap<>())));
    URI uri = UriBuilder.fromResource(ClientResource.class).path(client).build();
    return Response.created(uri).build();
}

Example 3 with AuditLog

use of keywhiz.log.AuditLog in project keywhiz by square.

the class ClientResource method modifyClientGroups.

/**
 * Modify groups a client has membership in
 *
 * @param name    Client name
 * @param request JSON request specifying which groups to add or remove
 * @return Listing of groups client has membership in
 * <p>
 * responseMessage 201 Client modified successfully
 * <p>
 * responseMessage 404 Client not found
 */
@Timed
@ExceptionMetered
@PUT
@Path("{name}/groups")
@Produces(APPLICATION_JSON)
public Iterable<String> modifyClientGroups(@Auth AutomationClient automationClient, @PathParam("name") String name, @Valid ModifyGroupsRequestV2 request) {
    Client client = clientDAOReadWrite.getClientByName(name).orElseThrow(NotFoundException::new);
    String user = automationClient.getName();
    long clientId = client.getId();
    Set<String> oldGroups = aclDAOReadWrite.getGroupsFor(client).stream().map(Group::getName).collect(toSet());
    Set<String> groupsToAdd = Sets.difference(request.addGroups(), oldGroups);
    Set<String> groupsToRemove = Sets.intersection(request.removeGroups(), oldGroups);
    // TODO: should optimize AclDAO to use names and return only name column
    groupsToGroupIds(groupsToAdd).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAOReadWrite.findAndEnrollClient(clientId, groupId, auditLog, user, new HashMap<>())));
    groupsToGroupIds(groupsToRemove).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAOReadWrite.findAndEvictClient(clientId, groupId, auditLog, user, new HashMap<>())));
    return aclDAOReadWrite.getGroupsFor(client).stream().map(Group::getName).collect(toSet());
}

Example 4 with AuditLog

use of keywhiz.log.AuditLog in project keywhiz by square.

the class ClientResource method createClient.

/**
   * Creates a client and assigns to given groups
   *
   * @excludeParams automationClient
   * @param request JSON request to create a client
   *
   * @responseMessage 201 Created client and assigned to given groups
   * @responseMessage 409 Client already exists
   */
@Timed
@ExceptionMetered
@POST
@Consumes(APPLICATION_JSON)
public Response createClient(@Auth AutomationClient automationClient, @Valid CreateClientRequestV2 request) {
    String creator = automationClient.getName();
    String client = request.name();
    clientDAOReadWrite.getClient(client).ifPresent((c) -> {
        logger.info("Automation ({}) - Client {} already exists", creator, client);
        throw new ConflictException("Client name already exists.");
    });
    // Creates new client record
    long clientId = clientDAOReadWrite.createClient(client, creator, request.description());
    auditLog.recordEvent(new Event(Instant.now(), EventTag.CLIENT_CREATE, creator, client));
    // Enrolls client in any requested groups
    groupsToGroupIds(request.groups()).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAOReadWrite.findAndEnrollClient(clientId, groupId, auditLog, creator, new HashMap<>())));
    URI uri = UriBuilder.fromResource(ClientResource.class).path(client).build();
    return Response.created(uri).build();
}

Example 5 with AuditLog

use of keywhiz.log.AuditLog in project keywhiz by square.

the class SecretResource method modifySecretGroups.

/**
 * Modify the groups a secret is assigned to
 *
 * @param name Secret series name
 * @param request JSON request to modify groups
 *
 * responseMessage 201 Group membership changed
 * responseMessage 404 Secret series not found
 */
@Timed
@ExceptionMetered
@PUT
@Path("{name}/groups")
@Consumes(APPLICATION_JSON)
@Produces(APPLICATION_JSON)
public Iterable<String> modifySecretGroups(@Auth AutomationClient automationClient, @PathParam("name") String name, @Valid ModifyGroupsRequestV2 request) {
    // TODO: Use latest version instead of non-versioned
    Secret secret = secretController.getSecretByName(name).orElseThrow(NotFoundException::new);
    String user = automationClient.getName();
    long secretId = secret.getId();
    Set<String> oldGroups = aclDAO.getGroupsFor(secret).stream().map(Group::getName).collect(toSet());
    Set<String> groupsToAdd = Sets.difference(request.addGroups(), oldGroups);
    Set<String> groupsToRemove = Sets.intersection(request.removeGroups(), oldGroups);
    // TODO: should optimize AclDAO to use names and return only name column
    groupsToGroupIds(groupsToAdd).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAO.findAndAllowAccess(secretId, groupId, auditLog, user, new HashMap<>())));
    groupsToGroupIds(groupsToRemove).forEach((maybeGroupId) -> maybeGroupId.ifPresent((groupId) -> aclDAO.findAndRevokeAccess(secretId, groupId, auditLog, user, new HashMap<>())));
    return aclDAO.getGroupsFor(secret).stream().map(Group::getName).collect(toSet());
}