bvandeusenandClaude Opus 5.5
680a6bf3b6
MCP-6 #4970 "Automation tools: playbooks, runs, schedules, alert actions". Viewer: list_playbooks, get_playbook (secret defaults masked), list_inventory (variable names only), list_ansible_runs, get_ansible_run (log tail + grep), list_schedules, wait_for_run (polls, 120s cap). Operator: run_playbook (check mode unless check=false; a steward:confirm playbook applies only with confirmed=true; secret variables reach the run but are never stored, audited or returned), cancel_ansible_run, and create/update/delete_schedule (secrets refused, check by default). Admin: set_alert_action, and the docker plugin's prune_docker, which previews from the disk report unless check=false (Ansible's check mode skips the prune commands, so a check run would show nothing). Every write is audited as "<user> via MCP" with the token id; the audit tool's user filter includes those rows. prune_extra_vars moves to the docker service so the page and the tool share it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
2.7 KiB
Python
75 lines
2.7 KiB
Python
"""The audit log: who changed what in Steward, including changes made through MCP."""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
|
|
from sqlalchemy import or_, select
|
|
|
|
from steward.models.audit import AuditEvent
|
|
from steward.models.users import UserRole
|
|
|
|
from ._audit import mcp_username
|
|
from ._shape import age_s, bounded, clamp_limit, db_session, iso, lookback
|
|
|
|
|
|
async def list_audit_events(action: str = "", user: str = "", entity_type: str = "",
|
|
range: str = "7d", limit: int = 50) -> dict:
|
|
"""Changes recorded in Steward's audit log, newest first.
|
|
|
|
action: a prefix of the action name, e.g. "monitor." or "ansible.run";
|
|
empty for all.
|
|
user: a username, exactly; "system" for automated changes. Includes the
|
|
changes that user made through MCP, which are recorded as "<user> via MCP".
|
|
entity_type: e.g. "monitor", "host", "alert_rule"; empty for all.
|
|
range: "1h", "6h", "24h", "7d" (default) or "30d".
|
|
limit: default 50, max 500.
|
|
|
|
Answers "what changed before this broke?": line an event's `at` up against
|
|
a monitor's down_since or an alert's since.
|
|
"""
|
|
since, key = lookback(range)
|
|
limit = clamp_limit(limit, 50, 500)
|
|
stmt = (select(AuditEvent).where(AuditEvent.timestamp >= since)
|
|
.order_by(AuditEvent.timestamp.desc()).limit(limit + 1))
|
|
if action:
|
|
esc = action.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
|
|
stmt = stmt.where(AuditEvent.action.like(esc + "%", escape="\\"))
|
|
if user:
|
|
stmt = stmt.where(or_(AuditEvent.username == user,
|
|
AuditEvent.username == mcp_username(user)))
|
|
if entity_type:
|
|
stmt = stmt.where(AuditEvent.entity_type == entity_type)
|
|
async with db_session() as db:
|
|
rows = list((await db.execute(stmt)).scalars())
|
|
|
|
def _detail(raw):
|
|
if not raw:
|
|
return None
|
|
try:
|
|
return json.loads(raw)
|
|
except ValueError:
|
|
return raw[:500]
|
|
|
|
events = [
|
|
{
|
|
"at": iso(e.timestamp),
|
|
"age_s": age_s(e.timestamp),
|
|
"user": e.username,
|
|
"action": e.action,
|
|
"entity_type": e.entity_type,
|
|
"entity_id": e.entity_id,
|
|
"detail": _detail(e.detail_json),
|
|
}
|
|
for e in rows
|
|
]
|
|
out = {"range": key, **bounded(events, limit, key="events")}
|
|
if out["truncated"]:
|
|
out["total"] = None
|
|
out["more"] = (f"More than {limit} events in range. Pass a larger `limit` (max 500), "
|
|
"a shorter `range`, or filter by `action`, `user` or `entity_type`.")
|
|
return out
|
|
|
|
|
|
def register(register_tool) -> None:
|
|
register_tool(list_audit_events, role=UserRole.viewer, read_only=True)
|