|
| 1 | +use super::middleware::Message; |
| 2 | +use actix_web::{ |
| 3 | + body::MessageBody, |
| 4 | + dev::{ServiceRequest, ServiceResponse}, |
| 5 | + middleware::Next, |
| 6 | +}; |
| 7 | +use actix_web_httpauth::extractors::basic::BasicAuth; |
| 8 | +use ulid::Ulid; |
| 9 | + |
| 10 | +use crate::{ |
| 11 | + audit::{ActorLog, AuditLogBuilder, RequestLog}, |
| 12 | + handlers::{KINESIS_COMMON_ATTRIBUTES_KEY, STREAM_NAME_HEADER_KEY}, |
| 13 | + rbac::{map::SessionKey, Users}, |
| 14 | +}; |
| 15 | + |
| 16 | +const DROP_HEADERS: [&str; 4] = ["authorization", "cookie", "user-agent", "x-p-stream"]; |
| 17 | + |
| 18 | +pub async fn audit_log_middleware( |
| 19 | + mut req: ServiceRequest, |
| 20 | + next: Next<impl MessageBody>, |
| 21 | +) -> Result<ServiceResponse<impl MessageBody>, actix_web::Error> { |
| 22 | + // Ensures that log will be pushed to subscriber on drop |
| 23 | + let mut log_builder = AuditLogBuilder::default(); |
| 24 | + |
| 25 | + if let Some(kinesis_common_attributes) = |
| 26 | + req.request().headers().get(KINESIS_COMMON_ATTRIBUTES_KEY) |
| 27 | + { |
| 28 | + let attribute_value: &str = kinesis_common_attributes.to_str().unwrap(); |
| 29 | + let message: Message = serde_json::from_str(attribute_value).unwrap(); |
| 30 | + log_builder.set_stream_name(message.common_attributes.x_p_stream); |
| 31 | + } else if let Some(stream) = req.match_info().get("logstream") { |
| 32 | + log_builder.set_stream_name(stream.to_owned()); |
| 33 | + } else if let Some(value) = req.headers().get(STREAM_NAME_HEADER_KEY) { |
| 34 | + if let Ok(stream) = value.to_str() { |
| 35 | + log_builder.set_stream_name(stream.to_owned()); |
| 36 | + } |
| 37 | + } |
| 38 | + let mut username = "Unknown".to_owned(); |
| 39 | + let mut authorization_method = "None".to_owned(); |
| 40 | + |
| 41 | + // Extract authorization details from request, either from basic auth |
| 42 | + // header or cookie, else use default value. |
| 43 | + if let Ok(creds) = req.extract::<BasicAuth>().into_inner() { |
| 44 | + username = creds.user_id().trim().to_owned(); |
| 45 | + authorization_method = "Basic Auth".to_owned(); |
| 46 | + } else if let Some(cookie) = req.cookie("session") { |
| 47 | + authorization_method = "Session Cookie".to_owned(); |
| 48 | + if let Some(user_id) = Ulid::from_string(cookie.value()) |
| 49 | + .ok() |
| 50 | + .and_then(|ulid| Users.get_username_from_session(&SessionKey::SessionId(ulid))) |
| 51 | + { |
| 52 | + username = user_id; |
| 53 | + } |
| 54 | + } |
| 55 | + |
| 56 | + log_builder.request = RequestLog { |
| 57 | + method: req.method().to_string(), |
| 58 | + path: req.path().to_string(), |
| 59 | + protocol: req.connection_info().scheme().to_owned(), |
| 60 | + headers: req |
| 61 | + .headers() |
| 62 | + .iter() |
| 63 | + .filter_map(|(name, value)| match name.as_str() { |
| 64 | + // NOTE: drop headers that are not required |
| 65 | + name if DROP_HEADERS.contains(&name.to_lowercase().as_str()) => None, |
| 66 | + name => { |
| 67 | + // NOTE: Drop headers that can't be parsed as string |
| 68 | + value |
| 69 | + .to_str() |
| 70 | + .map(|value| (name.to_owned(), value.to_string())) |
| 71 | + .ok() |
| 72 | + } |
| 73 | + }) |
| 74 | + .collect(), |
| 75 | + }; |
| 76 | + log_builder.actor = ActorLog { |
| 77 | + remote_host: req |
| 78 | + .connection_info() |
| 79 | + .realip_remote_addr() |
| 80 | + .unwrap_or_default() |
| 81 | + .to_owned(), |
| 82 | + user_agent: req |
| 83 | + .headers() |
| 84 | + .get("User-Agent") |
| 85 | + .and_then(|a| a.to_str().ok()) |
| 86 | + .unwrap_or_default() |
| 87 | + .to_owned(), |
| 88 | + username, |
| 89 | + authorization_method, |
| 90 | + }; |
| 91 | + log_builder.set_deployment_id().await; |
| 92 | + |
| 93 | + let res = next.call(req).await; |
| 94 | + |
| 95 | + // Capture status_code and error information from response |
| 96 | + match &res { |
| 97 | + Ok(res) => { |
| 98 | + let status = res.status(); |
| 99 | + log_builder.response.status_code = status.as_u16(); |
| 100 | + // Use error information from reponse object if an error |
| 101 | + if let Some(err) = res.response().error() { |
| 102 | + log_builder.set_response_error(err.to_string()); |
| 103 | + } |
| 104 | + } |
| 105 | + Err(err) => log_builder.set_response_error(err.to_string()), |
| 106 | + } |
| 107 | + |
| 108 | + res |
| 109 | +} |
0 commit comments