Skip to content

Commit 6be3a09

Browse files
flown4qqqqflown4qqqq
authored
25-1: Cherry pick audit logs (#17114)
1 parent 54775d3 commit 6be3a09

File tree

8 files changed

+213
-57
lines changed

8 files changed

+213
-57
lines changed

‎ydb/core/tx/schemeshard/schemeshard_audit_log.cpp

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,9 @@ void AuditLogModifySchemeOperation(const NKikimrSchemeOp::TModifyScheme& operati
128128
AUDIT_PART(name, (!value.empty() ? value : EmptyValue))
129129
}
130130

131-
AUDIT_PART("cloud_id", cloud_id, !cloud_id.empty());
132-
AUDIT_PART("folder_id", folder_id, !folder_id.empty());
133-
AUDIT_PART("resource_id", database_id, !database_id.empty());
131+
AUDIT_PART("cloud_id", cloud_id, !cloud_id.empty())
132+
AUDIT_PART("folder_id", folder_id, !folder_id.empty())
133+
AUDIT_PART("resource_id", database_id, !database_id.empty())
134134

135135
// Additionally:
136136

@@ -140,21 +140,23 @@ void AuditLogModifySchemeOperation(const NKikimrSchemeOp::TModifyScheme& operati
140140
// 1. explicit operation ESchemeOpModifyACL -- to modify ACL on a path
141141
// 2. ESchemeOpMkDir or ESchemeOpCreate* operations -- to set rights to newly created paths/entities
142142
// 3. ESchemeOpCopyTable -- to be checked against acl size limit, not to be applied in any way
143-
AUDIT_PART("new_owner", logEntry.NewOwner, !logEntry.NewOwner.empty());
144-
AUDIT_PART("acl_add", RenderList(logEntry.ACLAdd), !logEntry.ACLAdd.empty());
145-
AUDIT_PART("acl_remove", RenderList(logEntry.ACLRemove), !logEntry.ACLRemove.empty());
143+
AUDIT_PART("new_owner", logEntry.NewOwner, !logEntry.NewOwner.empty())
144+
AUDIT_PART("acl_add", RenderList(logEntry.ACLAdd), !logEntry.ACLAdd.empty())
145+
AUDIT_PART("acl_remove", RenderList(logEntry.ACLRemove), !logEntry.ACLRemove.empty())
146146

147147
// AlterUserAttributes.
148148
// 1. explicit operation ESchemeOpAlterUserAttributes -- to modify user attributes on a path
149149
// 2. ESchemeOpMkDir or some ESchemeOpCreate* operations -- to set user attributes for newly created paths/entities
150-
AUDIT_PART("user_attrs_add", RenderList(logEntry.UserAttrsAdd), !logEntry.UserAttrsAdd.empty());
151-
AUDIT_PART("user_attrs_remove", RenderList(logEntry.UserAttrsRemove), !logEntry.UserAttrsRemove.empty());
150+
AUDIT_PART("user_attrs_add", RenderList(logEntry.UserAttrsAdd), !logEntry.UserAttrsAdd.empty())
151+
AUDIT_PART("user_attrs_remove", RenderList(logEntry.UserAttrsRemove), !logEntry.UserAttrsRemove.empty())
152152

153153
// AlterLogin.
154154
// explicit operation ESchemeOpAlterLogin -- to modify user and groups
155-
AUDIT_PART("login_user", logEntry.LoginUser);
156-
AUDIT_PART("login_group", logEntry.LoginGroup);
157-
AUDIT_PART("login_member", logEntry.LoginMember);
155+
AUDIT_PART("login_user", logEntry.LoginUser)
156+
AUDIT_PART("login_group", logEntry.LoginGroup)
157+
AUDIT_PART("login_member", logEntry.LoginMember)
158+
159+
AUDIT_PART("login_user_change", RenderList(logEntry.LoginUserChange), logEntry.LoginUserChange)
158160
);
159161
}
160162

‎ydb/core/tx/schemeshard/schemeshard_audit_log_fragment.cpp

Lines changed: 55 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -678,40 +678,74 @@ struct TChangeLogin {
678678
TString LoginUser;
679679
TString LoginGroup;
680680
TString LoginMember;
681+
TVector<TString> LoginUserChange;
681682
};
682683

683684
TChangeLogin ExtractLoginChange(const NKikimrSchemeOp::TModifyScheme& tx) {
684685
if (tx.HasAlterLogin()) {
686+
const auto& alter = tx.GetAlterLogin();
687+
685688
TChangeLogin result;
686689
switch (tx.GetAlterLogin().GetAlterCase()) {
687-
case NKikimrSchemeOp::TAlterLogin::kCreateUser:
688-
result.LoginUser = tx.GetAlterLogin().GetCreateUser().GetUser();
690+
case NKikimrSchemeOp::TAlterLogin::kCreateUser: {
691+
result.LoginUser = alter.GetCreateUser().GetUser();
689692
break;
690-
case NKikimrSchemeOp::TAlterLogin::kModifyUser:
691-
result.LoginUser = tx.GetAlterLogin().GetModifyUser().GetUser();
693+
}
694+
695+
case NKikimrSchemeOp::TAlterLogin::kModifyUser: {
696+
const auto& modify = alter.GetModifyUser();
697+
result.LoginUser = modify.GetUser();
698+
699+
if (modify.HasPassword()) { // there is no difference beetwen password and password's hash
700+
result.LoginUserChange.push_back("password");
701+
}
702+
703+
if (modify.HasCanLogin() && modify.GetCanLogin()) {
704+
result.LoginUserChange.push_back("unblocking");
705+
}
706+
707+
if (modify.HasCanLogin() && !modify.GetCanLogin()) {
708+
result.LoginUserChange.push_back("blocking");
709+
}
710+
692711
break;
693-
case NKikimrSchemeOp::TAlterLogin::kRemoveUser:
694-
result.LoginUser = tx.GetAlterLogin().GetRemoveUser().GetUser();
712+
}
713+
714+
case NKikimrSchemeOp::TAlterLogin::kRemoveUser: {
715+
result.LoginUser = alter.GetRemoveUser().GetUser();
695716
break;
696-
case NKikimrSchemeOp::TAlterLogin::kCreateGroup:
697-
result.LoginGroup = tx.GetAlterLogin().GetCreateGroup().GetGroup();
717+
}
718+
719+
case NKikimrSchemeOp::TAlterLogin::kCreateGroup: {
720+
result.LoginGroup = alter.GetCreateGroup().GetGroup();
698721
break;
699-
case NKikimrSchemeOp::TAlterLogin::kAddGroupMembership:
700-
result.LoginGroup = tx.GetAlterLogin().GetAddGroupMembership().GetGroup();
701-
result.LoginMember = tx.GetAlterLogin().GetAddGroupMembership().GetMember();
722+
}
723+
724+
case NKikimrSchemeOp::TAlterLogin::kAddGroupMembership: {
725+
result.LoginGroup = alter.GetAddGroupMembership().GetGroup();
726+
result.LoginMember = alter.GetAddGroupMembership().GetMember();
702727
break;
703-
case NKikimrSchemeOp::TAlterLogin::kRemoveGroupMembership:
704-
result.LoginGroup = tx.GetAlterLogin().GetRemoveGroupMembership().GetGroup();
705-
result.LoginMember = tx.GetAlterLogin().GetRemoveGroupMembership().GetMember();
728+
}
729+
730+
case NKikimrSchemeOp::TAlterLogin::kRemoveGroupMembership: {
731+
result.LoginGroup = alter.GetRemoveGroupMembership().GetGroup();
732+
result.LoginMember = alter.GetRemoveGroupMembership().GetMember();
706733
break;
707-
case NKikimrSchemeOp::TAlterLogin::kRenameGroup:
708-
result.LoginGroup = tx.GetAlterLogin().GetRenameGroup().GetGroup();
734+
}
735+
736+
case NKikimrSchemeOp::TAlterLogin::kRenameGroup: {
737+
result.LoginGroup = alter.GetRenameGroup().GetGroup();
709738
break;
710-
case NKikimrSchemeOp::TAlterLogin::kRemoveGroup:
711-
result.LoginGroup = tx.GetAlterLogin().GetRemoveGroup().GetGroup();
739+
}
740+
741+
case NKikimrSchemeOp::TAlterLogin::kRemoveGroup: {
742+
result.LoginGroup = alter.GetRemoveGroup().GetGroup();
712743
break;
713-
default:
744+
}
745+
746+
default: {
714747
Y_ABORT("switch should cover all operation types");
748+
}
715749
}
716750
return result;
717751
}
@@ -725,7 +759,7 @@ namespace NKikimr::NSchemeShard {
725759
TAuditLogFragment MakeAuditLogFragment(const NKikimrSchemeOp::TModifyScheme& tx) {
726760
auto [aclAdd, aclRemove] = ExtractACLChange(tx);
727761
auto [userAttrsAdd, userAttrsRemove] = ExtractUserAttrChange(tx);
728-
auto [loginUser, loginGroup, loginMember] = ExtractLoginChange(tx);
762+
auto [loginUser, loginGroup, loginMember, loginUserChange] = ExtractLoginChange(tx);
729763

730764
return {
731765
.Operation = DefineUserOperationName(tx),
@@ -738,6 +772,7 @@ TAuditLogFragment MakeAuditLogFragment(const NKikimrSchemeOp::TModifyScheme& tx)
738772
.LoginUser = loginUser,
739773
.LoginGroup = loginGroup,
740774
.LoginMember = loginMember,
775+
.LoginUserChange = loginUserChange
741776
};
742777
}
743778

‎ydb/core/tx/schemeshard/schemeshard_audit_log_fragment.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ struct TAuditLogFragment {
2121
TString LoginUser;
2222
TString LoginGroup;
2323
TString LoginMember;
24+
TVector<TString> LoginUserChange;
2425
};
2526

2627
TAuditLogFragment MakeAuditLogFragment(const NKikimrSchemeOp::TModifyScheme& tx);

‎ydb/core/tx/schemeshard/ut_helpers/helpers.cpp

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2059,20 +2059,41 @@ namespace NSchemeShardUT_Private {
20592059
return event->Record;
20602060
}
20612061

2062-
void ChangeIsEnabledUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, const TString& user, bool isEnabled) {
2062+
void ModifyUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, std::function<void(::NKikimrSchemeOp::TLoginModifyUser*)>&& initiator) {
20632063
auto modifyTx = std::make_unique<TEvSchemeShard::TEvModifySchemeTransaction>(txId, TTestTxConfig::SchemeShard);
20642064
auto transaction = modifyTx->Record.AddTransaction();
20652065
transaction->SetWorkingDir(database);
20662066
transaction->SetOperationType(NKikimrSchemeOp::EOperationType::ESchemeOpAlterLogin);
20672067

20682068
auto alterUser = transaction->MutableAlterLogin()->MutableModifyUser();
20692069

2070-
alterUser->SetUser(user);
2071-
alterUser->SetCanLogin(isEnabled);
2070+
initiator(alterUser);
20722071

20732072
AsyncSend(runtime, TTestTxConfig::SchemeShard, modifyTx.release());
20742073
TAutoPtr<IEventHandle> handle;
2075-
[[maybe_unused]]auto event = runtime.GrabEdgeEvent<TEvSchemeShard::TEvModifySchemeTransactionResult>(handle); // wait()
2074+
[[maybe_unused]]auto event = runtime.GrabEdgeEvent<TEvSchemeShard::TEvModifySchemeTransactionResult>(handle); // wait()
2075+
}
2076+
2077+
void ChangeIsEnabledUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, const TString& user, bool isEnabled) {
2078+
ModifyUser(runtime, txId, database, [user, isEnabled](auto* alterUser) {
2079+
alterUser->SetUser(std::move(user));
2080+
alterUser->SetCanLogin(isEnabled);
2081+
});
2082+
}
2083+
2084+
void ChangePasswordUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, const TString& user, const TString& password) {
2085+
ModifyUser(runtime, txId, database, [user, password](auto* alterUser) {
2086+
alterUser->SetUser(std::move(user));
2087+
alterUser->SetPassword(std::move(password));
2088+
});
2089+
}
2090+
2091+
void ChangePasswordHashUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, const TString& user, const TString& hash) {
2092+
ModifyUser(runtime, txId, database, [user, hash](auto* alterUser) {
2093+
alterUser->SetUser(std::move(user));
2094+
alterUser->SetPassword(std::move(hash));
2095+
alterUser->SetIsHashedPassword(true);
2096+
});
20762097
}
20772098

20782099
// class TFakeDataReq {

‎ydb/core/tx/schemeshard/ut_helpers/helpers.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -551,9 +551,17 @@ namespace NSchemeShardUT_Private {
551551
NKikimrScheme::TEvLoginResult Login(TTestActorRuntime& runtime,
552552
const TString& user, const TString& password);
553553

554+
void ModifyUser(TTestActorRuntime& runtime, ui64 txId, const TString& database, std::function<void(::NKikimrSchemeOp::TLoginModifyUser*)>&& initiator);
555+
554556
void ChangeIsEnabledUser(TTestActorRuntime& runtime, ui64 txId, const TString& database,
555557
const TString& user, bool isEnabled);
556558

559+
void ChangePasswordUser(TTestActorRuntime& runtime, ui64 txId, const TString& database,
560+
const TString& user, const TString& password);
561+
562+
void ChangePasswordHashUser(TTestActorRuntime& runtime, ui64 txId, const TString& database,
563+
const TString& user, const TString& hash);
564+
557565
// Mimics data query to a single table with multiple partitions
558566
class TFakeDataReq {
559567
public:

0 commit comments

Comments
 (0)