anbaric-cloud-hosting 1.2.2 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -17,15 +17,15 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.2.2",
-    "anbaric-tsapi": "^1.2.2",
+    "anbaric-data-store": "^1.4.0",
+    "anbaric-tsapi": "^1.4.0",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-cloud": "^1.2.2",
-    "anbaric-state-machine": "^1.2.2",
+    "anbaric-cloud": "^1.4.0",
+    "anbaric-state-machine": "^1.4.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/DockerBuildLayer.ts

@@ -59,6 +59,7 @@ class DockerBuildLayer extends BaseBuildLayer {
             "--env", "ANBARIC_QUEUE_TYPE=cloud",
             "--env", "ANBARIC_JSON_STORE_TYPE=cloud",
             "--env", "ANBARIC_SECRET_STORE_TYPE=cloud",
+            "--env", "ANBARIC_AUDITOR_TYPE=cloud",
             "--env", `ANBARIC_CONSUMER_PORT=${deployment.consumerPort}`,
             "--env", `ANBARIC_CONSUMER_URL=http://${container}:${deployment.consumerPort}`,
             image]);

package/src/app-management/FargateBuildLayer.ts

@@ -148,6 +148,7 @@ class FargateBuildLayer extends BaseBuildLayer {
                     { name: "ANBARIC_QUEUE_TYPE", value: "cloud" },
                     { name: "ANBARIC_JSON_STORE_TYPE", value: "cloud" },
                     { name: "ANBARIC_SECRET_STORE_TYPE", value: "cloud" },
+                    { name: "ANBARIC_AUDITOR_TYPE", value: "cloud" },
                     { name: "ANBARIC_CONSUMER_PORT", value: String(deployment.consumerPort) },
                     { name: "ANBARIC_CONSUMER_URL", value: `http://${deployment.appHost}:${deployment.consumerPort}` },
                 ],

package/src/auditing/AuditRecordStore.ts

@@ -0,0 +1,19 @@
+import {AuditChange, AuditRecord} from "anbaric-tsapi";
+
+type AuditFilter = {
+    jobId? : string,
+    actorId? : string,
+    change? : AuditChange,
+    search? : string,
+    pageSize? : number,
+    page? : number,
+};
+
+interface AuditRecordStore {
+
+    save(record : AuditRecord) : Promise<void>;
+    list(filter : AuditFilter) : Promise<Array<AuditRecord>>;
+
+}
+
+export type { AuditFilter, AuditRecordStore }

package/src/auditing/InMemoryAuditRecordStore.ts

@@ -0,0 +1,29 @@
+import {AuditRecord} from "anbaric-tsapi";
+import {randomUUID} from "node:crypto";
+import {AuditFilter, AuditRecordStore} from "./AuditRecordStore";
+
+class InMemoryAuditRecordStore implements AuditRecordStore {
+
+    private records = new Array<AuditRecord>();
+
+    async save(record : AuditRecord) : Promise<void> {
+        this.records.push({ ...record, id: randomUUID(), at: record.at ?? new Date().toISOString() });
+    }
+
+    async list(filter : AuditFilter) : Promise<Array<AuditRecord>> {
+        const pageSize = filter.pageSize ?? 100;
+        const page = filter.page ?? 0;
+
+        return this.records
+            .filter(record => !filter.jobId || record.jobId === filter.jobId)
+            .filter(record => !filter.actorId || record.actorId === filter.actorId)
+            .filter(record => !filter.change || record.change === filter.change)
+            .filter(record => !filter.search ||
+                record.description.toLowerCase().includes(filter.search.toLowerCase()))
+            .reverse()
+            .slice(page * pageSize, (page + 1) * pageSize);
+    }
+
+}
+
+export { InMemoryAuditRecordStore }

package/src/data-store/PostgresAuditRecordStore.ts

@@ -0,0 +1,66 @@
+import {AuditRecord} from "anbaric-tsapi";
+import {Pool} from "pg";
+import {AuditFilter, AuditRecordStore} from "../auditing/AuditRecordStore";
+
+class PostgresAuditRecordStore implements AuditRecordStore {
+
+    constructor(private pool : Pool) {}
+
+    async save(record : AuditRecord) : Promise<void> {
+        await this.pool.query(
+            `INSERT INTO anbaric_system.audit_records (job_id, actor_id, actor_type, change, description, details)
+             VALUES ($1, $2, $3, $4, $5, $6)`,
+            [record.jobId, record.actorId, record.actorType, record.change,
+                record.description, JSON.stringify(record.details ?? null)],
+        );
+    }
+
+    async list(filter : AuditFilter) : Promise<Array<AuditRecord>> {
+        const conditions : Array<string> = [];
+        const parameters : Array<any> = [];
+
+        if (filter.jobId) {
+            parameters.push(filter.jobId);
+            conditions.push(`job_id = $${parameters.length}`);
+        }
+        if (filter.actorId) {
+            parameters.push(filter.actorId);
+            conditions.push(`actor_id = $${parameters.length}`);
+        }
+        if (filter.change) {
+            parameters.push(filter.change);
+            conditions.push(`change = $${parameters.length}::anbaric_system.audit_change`);
+        }
+        if (filter.search) {
+            parameters.push(`%${filter.search}%`);
+            conditions.push(`description ILIKE $${parameters.length}`);
+        }
+
+        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+        parameters.push(filter.pageSize ?? 100);
+        const limit = `LIMIT $${parameters.length}`;
+        parameters.push((filter.page ?? 0) * (filter.pageSize ?? 100));
+        const offset = `OFFSET $${parameters.length}`;
+
+        const result = await this.pool.query(
+            `SELECT id, job_id, actor_id, actor_type, change, description, details, at
+             FROM anbaric_system.audit_records ${where}
+             ORDER BY at DESC, id DESC ${limit} ${offset}`,
+            parameters,
+        );
+
+        return result.rows.map(row => ({
+            id: String(row.id),
+            jobId: row.job_id,
+            actorId: row.actor_id,
+            actorType: row.actor_type,
+            change: row.change,
+            description: row.description,
+            details: row.details,
+            at: row.at.toISOString(),
+        }));
+    }
+
+}
+
+export { PostgresAuditRecordStore }

package/src/data-store/Schema.ts

@@ -52,6 +52,32 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
         )
     `);
     await pool.query("ALTER TABLE anbaric_system.cli_keys ADD COLUMN IF NOT EXISTS tenant TEXT");
+    await pool.query(`
+        DO $$ BEGIN
+            CREATE TYPE anbaric_system.audit_change AS ENUM ('CREATE', 'UPDATE_PROPERTIES', 'CHANGE_STATE', 'DELETE');
+        EXCEPTION WHEN duplicate_object THEN null;
+        END $$
+    `);
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS anbaric_system.audit_records (
+            id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            job_id      TEXT NOT NULL,
+            actor_id    TEXT NOT NULL,
+            actor_type  TEXT NOT NULL,
+            change      anbaric_system.audit_change NOT NULL,
+            description TEXT NOT NULL,
+            details     JSONB,
+            at          TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+    `);
+    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS change anbaric_system.audit_change");
+    await pool.query("UPDATE anbaric_system.audit_records SET change = 'UPDATE_PROPERTIES' WHERE change IS NULL");
+    await pool.query("UPDATE anbaric_system.audit_records SET actor_id = 'system' WHERE actor_id IS NULL");
+    await pool.query("UPDATE anbaric_system.audit_records SET actor_type = 'CODE' WHERE actor_type IS NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN change SET NOT NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN actor_id SET NOT NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN actor_type SET NOT NULL");
+    await pool.query("CREATE INDEX IF NOT EXISTS audit_records_job_id ON anbaric_system.audit_records (job_id)");
 };
 
 export { ensureSchema }

package/src/hosting/HostingServer.ts

@@ -2,6 +2,7 @@ import {createServer, IncomingMessage, Server, ServerResponse} from "node:http";
 import {AddressInfo} from "node:net";
 import {JobPersistence, JsonStore, SecretStore} from "anbaric-tsapi";
 import {BuildLayer} from "../app-management/BuildLayer";
+import {AuditRecordStore} from "../auditing/AuditRecordStore";
 import {Authenticator, SESSION_COOKIE} from "../auth/Authenticator";
 import {CliAuthorizer} from "../auth/CliAuthorizer";
 import {Tenant} from "../auth/Tenant";
@@ -11,7 +12,7 @@ import {ConfirmableQueue} from "../queuing/ConfirmableQueue";
 import {ConsumerRegistry} from "../queuing/ConsumerRegistry";
 import {Router} from "./Router";
 
-const INTERNAL_RESOURCES = new Set(["jobs", "queue", "consumers", "state-machines", "documents", "secrets"]);
+const INTERNAL_RESOURCES = new Set(["jobs", "queue", "consumers", "state-machines", "documents", "secrets", "audits"]);
 
 class HostingServer {
 
@@ -27,8 +28,9 @@ class HostingServer {
                 private authenticator? : Authenticator,
                 cliAuthorizer? : CliAuthorizer,
                 private tokenAuthenticator? : TokenAuthenticator,
-                private tenant? : string) {
-        this.router = new Router(persistence, queue, registry, buildLayer, documentStoreFor, secretStore, cliAuthorizer, tenant);
+                private tenant? : string,
+                auditRecords? : AuditRecordStore) {
+        this.router = new Router(persistence, queue, registry, buildLayer, documentStoreFor, secretStore, cliAuthorizer, tenant, auditRecords);
         this.server = this.serverFor((request, response) => this.handle(request, response));
         this.internalServer = this.serverFor((request, response) => this.handleInternal(request, response));
     }

package/src/hosting/Router.ts

@@ -1,7 +1,10 @@
 import {readFile} from "node:fs/promises";
 import {IncomingMessage, ServerResponse} from "node:http";
-import {JobPersistence, JsonStore, SecretStore, deserializeJob, serializeJob} from "anbaric-tsapi";
+import {AuditChange, JobPersistence, JsonStore, SecretStore, deserializeJob, serializeJob} from "anbaric-tsapi";
 import {BuildLayer} from "../app-management/BuildLayer";
+import {AuditRecordStore} from "../auditing/AuditRecordStore";
+
+const AUDIT_CHANGES = new Set(["CREATE", "UPDATE_PROPERTIES", "CHANGE_STATE", "DELETE"]);
 import {CliAuthorizer} from "../auth/CliAuthorizer";
 import {Tenant} from "../auth/Tenant";
 import {User} from "../auth/User";
@@ -29,7 +32,8 @@ class Router {
                 private documentStoreFor? : (collection : string) => JsonStore,
                 private secretStore? : SecretStore,
                 private cliAuthorizer? : CliAuthorizer,
-                private tenant? : string) {}
+                private tenant? : string,
+                private auditRecords? : AuditRecordStore) {}
 
     async route(request : IncomingMessage, response : ServerResponse, user? : User, sessionTenant? : Tenant) : Promise<void> {
         const url = new URL(request.url ?? "/", "http://localhost");
@@ -52,6 +56,33 @@ class Router {
             if (!user) return this.reply(response, 404, { error: "Not found" });
             return this.reply(response, 200, { id: user.id, roles: user.roles.map(role => role.id) });
         }
+        if (resource === "audits" && this.auditRecords && !id) {
+            if (method === "POST") {
+                const record = await readBody(request);
+                if (typeof record?.jobId !== "string" || typeof record?.description !== "string"
+                    || typeof record?.actorId !== "string" || typeof record?.actorType !== "string"
+                    || !AUDIT_CHANGES.has(record?.change)) {
+                    return this.reply(response, 400, { error: "Expected a body of { jobId, actorId, actorType, change, description, ... }" });
+                }
+                await this.auditRecords.save(record);
+                return this.reply(response, 204);
+            }
+            if (method === "GET") {
+                const change = url.searchParams.get("change");
+                const records = await this.auditRecords.list({
+                    jobId: url.searchParams.get("jobId") ?? undefined,
+                    actorId: url.searchParams.get("actorId") ?? undefined,
+                    change: change && AUDIT_CHANGES.has(change) ? change as AuditChange : undefined,
+                    search: url.searchParams.get("search") ?? undefined,
+                    pageSize: url.searchParams.has("pageSize") ? Number(url.searchParams.get("pageSize")) : undefined,
+                    page: url.searchParams.has("page") ? Number(url.searchParams.get("page")) : undefined,
+                });
+                return this.reply(response, 200, records);
+            }
+        }
+        if (resource === "audit" && method === "GET" && !id) {
+            return this.servePage(response);
+        }
         if (resource === "jobs") return this.handleJobs(method, id, subresource, url, request, response);
         if (resource === "queue" && method === "POST" && !subresource) return this.handleQueue(id, request, response);
         if (resource === "consumers" && method === "POST" && !id) {