bvandeusen
d86af7397d
Server half of the active-sessions surface. Web UI follows. The operator wants this specifically to notice a compromised account, which sets the bar: the addresses have to be trustworthy, or the feature is worse than absent because it looks like evidence. Migration 0052 adds created_ip + last_ip. Two columns, not one, and the pair is the signal: a session issued at home and now being used from elsewhere is the shape of a stolen token, and neither column alone can show that. Typed text, matching the user_agent column beside it — these are displayed, never queried by subnet, and inet round-trips through pgx as a netip.Prefix that renders "1.2.3.4/32". The rest of the schema was already waiting. Migration 0004 anticipated this exactly: "last_seen_at enables an 'active sessions' UI later (not wired in this plan) without schema churn." last_seen_at is live data — the auth middleware already touches it per request — so last_ip rides that same UPDATE for free. Getting the address right is the substance here. Nothing extracted a client IP anywhere before, and both obvious approaches are wrong: - RemoteAddr alone shows the reverse proxy on every session, which is the normal self-hosted deployment. Noise shaped like data. - Trusting X-Forwarded-For lets any client choose what its victim sees. A security surface an attacker can write to is worse than none. So auth.ClientIP trusts the header only when the request actually arrived from a proxy range. Public RemoteAddr means a direct connection, so XFF is attacker-controlled and ignored outright. Private RemoteAddr means we walk XFF right-to-left — proxies append, so the right end is what our own infrastructure wrote — and take the first non-proxy address. A forged XFF only prepends to the left end, which that walk never reaches. Unit-tested, including both spoofing shapes. Fails closed on a public-addressed proxy (separate host, CDN): we report the proxy rather than trusting a forgeable header. Documented at the function. Endpoints, all scoped by user_id per rule #47: GET /api/me/sessions → list, flagging the current row DELETE /api/me/sessions/{id} → 204, or 404 if not yours POST /api/me/sessions/logout-others → {"revoked": n} Keyed on session id alone, any household member could revoke another's session by guessing a uuid, so the delete carries user_id in its WHERE and :execrows distinguishes "not yours" (404) from a false 204. There's a test that asserts the row actually survives, not merely that we returned 404. The middleware now also puts the session id in context. logout-others is defined by exclusion, and without knowing which session is ours the safe-looking action deletes everything including the caller's — so it refuses rather than guesses when the id is absent, and that refusal is tested for non-deletion too. audit_log.action is plain text with no CHECK, so the two new actions need no migration (rule #36 checked, not assumed). Codegen is real sqlc 1.31.1 via the container in `make generate` — docker is present on this workstation even though Go and sqlc aren't — rather than the hand-written .sql.go shortcut used in milestone #268.
98 lines
3.7 KiB
Go
98 lines
3.7 KiB
Go
// Package audit writes admin-driven user-management events to audit_log.
|
|
// Thin wrapper over the sqlc-generated WriteAuditLog query — the value
|
|
// is centralizing the action-name vocabulary and the metadata
|
|
// marshaling so callers don't repeat boilerplate.
|
|
//
|
|
// Audit writes are best-effort from the caller's perspective: a failed
|
|
// audit write must NOT fail the user-facing operation. Callers
|
|
// log-and-continue. The audit log is observability, not a transaction
|
|
// participant.
|
|
package audit
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"log/slog"
|
|
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
|
|
)
|
|
|
|
// Action is the discriminator stored in audit_log.action. New values
|
|
// added in U2/U3 + future tasks; declare them here so callers don't
|
|
// stringly-type and so a future audit-search UI has a single source
|
|
// of truth for the vocabulary.
|
|
type Action string
|
|
|
|
const (
|
|
// U1
|
|
ActionRegister Action = "register"
|
|
ActionPromoteAdmin Action = "promote_admin"
|
|
ActionDemoteAdmin Action = "demote_admin"
|
|
ActionInviteCreate Action = "invite_create"
|
|
ActionInviteRedeem Action = "invite_redeem"
|
|
ActionInviteRevoke Action = "invite_revoke"
|
|
|
|
// U2 (declared early; callers in U1 don't use them yet, but
|
|
// having them here means U2's diff is purely additive on the
|
|
// caller side, not also touching this file).
|
|
ActionCreateUserAdmin Action = "create_user_admin"
|
|
ActionDeleteUser Action = "delete_user"
|
|
ActionPasswordResetAdmin Action = "password_reset_admin"
|
|
ActionAutoApproveToggle Action = "auto_approve_toggle"
|
|
|
|
// U3
|
|
ActionPasswordChangeSelf Action = "password_change_self"
|
|
ActionTokenRegenerate Action = "token_regenerate"
|
|
ActionForgotPasswordInit Action = "forgot_password_initiated"
|
|
ActionPasswordResetByEmail Action = "password_reset_via_email"
|
|
|
|
// Active-sessions surface (#370). Worth auditing rather than silent:
|
|
// revoking sessions is what a user does when they think an account is
|
|
// compromised, so the audit trail is most useful precisely when it's
|
|
// exercised.
|
|
ActionSessionRevoke Action = "session_revoke"
|
|
ActionSessionRevokeOthers Action = "session_revoke_others"
|
|
)
|
|
|
|
// Write inserts one audit_log row. metadata is marshaled as JSON;
|
|
// nil metadata writes SQL NULL. Errors are returned so callers can
|
|
// log them — but per package doc, callers should NOT fail user-facing
|
|
// operations on audit-write failures.
|
|
//
|
|
// actorID may be a zero/invalid pgtype.UUID for system actions
|
|
// (e.g. self-registration where the new user is both actor and
|
|
// target — pass them as the same id, or pass invalid for actor and
|
|
// the new user as target).
|
|
func Write(ctx context.Context, pool *pgxpool.Pool, actorID, targetID pgtype.UUID, action Action, metadata map[string]any) error {
|
|
q := dbq.New(pool)
|
|
var jsonMeta []byte
|
|
if metadata != nil {
|
|
b, err := json.Marshal(metadata)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
jsonMeta = b
|
|
}
|
|
return q.WriteAuditLog(ctx, dbq.WriteAuditLogParams{
|
|
ActorID: actorID,
|
|
TargetID: targetID,
|
|
Action: string(action),
|
|
Metadata: jsonMeta,
|
|
})
|
|
}
|
|
|
|
// WriteOrLog writes the audit row; on error, logs at Warn and swallows
|
|
// (audit failures must not break user-facing operations — see package doc).
|
|
// Use this when the audit is observability, not gating; use Write directly
|
|
// when the caller needs strict semantics (e.g. tests).
|
|
func WriteOrLog(ctx context.Context, pool *pgxpool.Pool, logger *slog.Logger, actorID, targetID pgtype.UUID, action Action, metadata map[string]any) {
|
|
if err := Write(ctx, pool, actorID, targetID, action, metadata); err != nil {
|
|
if logger != nil {
|
|
logger.Warn("audit failed", "action", string(action), "err", err)
|
|
}
|
|
}
|
|
}
|