Add audit log feature for recording all actions
Adds audit logging that records all authorized actions performed by users and API keys. The audit log is automatically populated whenever the authorizer approves an action, and is queryable via GraphQL, MCP, and CLI interfaces. Permission checks are excluded via a dry-run flag to avoid phantom entries on page loads. Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
@@ -3312,3 +3312,50 @@ func (r *Resolver) GetAuditReportUrlTool(ctx context.Context, req *mcp.CallToolR
|
||||
URL: *url,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (r *Resolver) ListAuditLogEntriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditLogEntriesInput) (*mcp.CallToolResult, types.ListAuditLogEntriesOutput, error) {
|
||||
r.MustAuthorize(ctx, input.OrganizationID, iam.ActionAuditLogEntryList)
|
||||
|
||||
pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
|
||||
Field: coredata.AuditLogEntryOrderFieldCreatedAt,
|
||||
Direction: page.OrderDirectionDesc,
|
||||
}
|
||||
|
||||
cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
|
||||
|
||||
filter := coredata.NewAuditLogEntryFilter()
|
||||
if input.Filter != nil {
|
||||
if input.Filter.Action != nil {
|
||||
filter.WithAction(*input.Filter.Action)
|
||||
}
|
||||
if input.Filter.ActorID != nil {
|
||||
filter.WithActorID(*input.Filter.ActorID)
|
||||
}
|
||||
if input.Filter.ResourceType != nil {
|
||||
filter.WithResourceType(*input.Filter.ResourceType)
|
||||
}
|
||||
if input.Filter.ResourceID != nil {
|
||||
filter.WithResourceID(*input.Filter.ResourceID)
|
||||
}
|
||||
}
|
||||
|
||||
p, err := r.iamSvc.OrganizationService.ListAuditLogEntries(ctx, input.OrganizationID, cursor, filter)
|
||||
if err != nil {
|
||||
panic(fmt.Errorf("cannot list audit log entries: %w", err))
|
||||
}
|
||||
|
||||
return nil, types.NewListAuditLogEntriesOutput(p), nil
|
||||
}
|
||||
|
||||
func (r *Resolver) GetAuditLogEntryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditLogEntryInput) (*mcp.CallToolResult, types.GetAuditLogEntryOutput, error) {
|
||||
r.MustAuthorize(ctx, input.ID, iam.ActionAuditLogEntryGet)
|
||||
|
||||
entry, err := r.iamSvc.OrganizationService.GetAuditLogEntry(ctx, input.ID)
|
||||
if err != nil {
|
||||
panic(fmt.Errorf("cannot get audit log entry: %w", err))
|
||||
}
|
||||
|
||||
return nil, types.GetAuditLogEntryOutput{
|
||||
AuditLogEntry: types.NewAuditLogEntry(entry),
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -6428,6 +6428,110 @@ components:
|
||||
organization_context:
|
||||
$ref: "#/components/schemas/OrganizationContext"
|
||||
|
||||
GetAuditLogEntryInput:
|
||||
type: object
|
||||
required:
|
||||
- id
|
||||
properties:
|
||||
id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Audit log entry ID
|
||||
|
||||
GetAuditLogEntryOutput:
|
||||
type: object
|
||||
required:
|
||||
- audit_log_entry
|
||||
properties:
|
||||
audit_log_entry:
|
||||
$ref: "#/components/schemas/AuditLogEntry"
|
||||
|
||||
ListAuditLogEntriesInput:
|
||||
type: object
|
||||
required:
|
||||
- organization_id
|
||||
properties:
|
||||
organization_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Organization ID
|
||||
size:
|
||||
type: integer
|
||||
description: Page size
|
||||
cursor:
|
||||
$ref: "#/components/schemas/CursorKey"
|
||||
description: Page cursor
|
||||
filter:
|
||||
type: object
|
||||
properties:
|
||||
action:
|
||||
type: string
|
||||
description: Filter by action (e.g. "core:vendor:create")
|
||||
actor_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Filter by actor ID
|
||||
resource_type:
|
||||
type: string
|
||||
description: Filter by resource type (e.g. "Vendor")
|
||||
resource_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Filter by resource ID
|
||||
|
||||
ListAuditLogEntriesOutput:
|
||||
type: object
|
||||
required:
|
||||
- audit_log_entries
|
||||
properties:
|
||||
next_cursor:
|
||||
$ref: "#/components/schemas/CursorKey"
|
||||
description: Next cursor
|
||||
audit_log_entries:
|
||||
type: array
|
||||
items:
|
||||
$ref: "#/components/schemas/AuditLogEntry"
|
||||
|
||||
AuditLogEntry:
|
||||
type: object
|
||||
required:
|
||||
- id
|
||||
- organization_id
|
||||
- actor_id
|
||||
- actor_type
|
||||
- action
|
||||
- resource_type
|
||||
- resource_id
|
||||
- created_at
|
||||
properties:
|
||||
id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Audit log entry ID
|
||||
organization_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: Organization ID
|
||||
actor_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: ID of the actor who performed the action
|
||||
actor_type:
|
||||
type: string
|
||||
enum: [USER, API_KEY, SYSTEM]
|
||||
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.AuditLogActorType
|
||||
description: Type of actor
|
||||
action:
|
||||
type: string
|
||||
description: Action performed (e.g. "core:vendor:create")
|
||||
resource_type:
|
||||
type: string
|
||||
description: Type of resource affected (e.g. "Vendor")
|
||||
resource_id:
|
||||
$ref: "#/components/schemas/GID"
|
||||
description: ID of the affected resource
|
||||
metadata:
|
||||
type: object
|
||||
description: Additional metadata about the action
|
||||
created_at:
|
||||
type: string
|
||||
format: date-time
|
||||
go.probo.inc/mcpgen/type: time.Time
|
||||
description: When the action was performed
|
||||
|
||||
tools:
|
||||
- name: listOrganizations
|
||||
description: List all organizations the user has access to
|
||||
@@ -7572,3 +7676,21 @@ tools:
|
||||
$ref: "#/components/schemas/UpdateOrganizationContextInput"
|
||||
outputSchema:
|
||||
$ref: "#/components/schemas/UpdateOrganizationContextOutput"
|
||||
- name: getAuditLogEntry
|
||||
description: Get an audit log entry by ID
|
||||
hints:
|
||||
readonly: true
|
||||
idempotent: true
|
||||
inputSchema:
|
||||
$ref: "#/components/schemas/GetAuditLogEntryInput"
|
||||
outputSchema:
|
||||
$ref: "#/components/schemas/GetAuditLogEntryOutput"
|
||||
- name: listAuditLogEntries
|
||||
description: List audit log entries for the organization. Audit log entries record write actions (create, update, delete) performed by users and API keys.
|
||||
hints:
|
||||
readonly: true
|
||||
idempotent: true
|
||||
inputSchema:
|
||||
$ref: "#/components/schemas/ListAuditLogEntriesInput"
|
||||
outputSchema:
|
||||
$ref: "#/components/schemas/ListAuditLogEntriesOutput"
|
||||
|
||||
51
pkg/server/api/mcp/v1/types/audit_log_entry.go
Normal file
51
pkg/server/api/mcp/v1/types/audit_log_entry.go
Normal file
@@ -0,0 +1,51 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
"go.probo.inc/probo/pkg/coredata"
|
||||
"go.probo.inc/probo/pkg/page"
|
||||
)
|
||||
|
||||
func NewAuditLogEntry(e *coredata.AuditLogEntry) *AuditLogEntry {
|
||||
return &AuditLogEntry{
|
||||
ID: e.ID,
|
||||
OrganizationID: e.OrganizationID,
|
||||
ActorID: e.ActorID,
|
||||
ActorType: AuditLogEntryActorType(e.ActorType),
|
||||
Action: e.Action,
|
||||
ResourceType: e.ResourceType,
|
||||
ResourceID: e.ResourceID,
|
||||
CreatedAt: e.CreatedAt,
|
||||
}
|
||||
}
|
||||
|
||||
func NewListAuditLogEntriesOutput(p *page.Page[*coredata.AuditLogEntry, coredata.AuditLogEntryOrderField]) ListAuditLogEntriesOutput {
|
||||
entries := make([]*AuditLogEntry, 0, len(p.Data))
|
||||
for _, e := range p.Data {
|
||||
entries = append(entries, NewAuditLogEntry(e))
|
||||
}
|
||||
|
||||
var nextCursor *page.CursorKey
|
||||
if len(p.Data) > 0 {
|
||||
cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
|
||||
nextCursor = &cursorKey
|
||||
}
|
||||
|
||||
return ListAuditLogEntriesOutput{
|
||||
NextCursor: nextCursor,
|
||||
AuditLogEntries: entries,
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user