mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 07:41:27 +00:00
feat: activity feed — enriched audit events + global/project timelines (#45)
* feat(branding): white-label — public /branding, admin write, shell theming app_settings branding.* keys (product name, logo/favicon URLs, accent color, docs/support links). Public GET /branding so login and shell theme pre-auth; admin writes via PUT /settings. useBranding() applies document.title, accent CSS var and favicon; BrandWordmark replaces hardcoded wordmarks; admin Platform settings gain a Branding form. MCP containr_branding_get + settings_update. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat(invites): team invite links — admin create/revoke, public accept Admins mint single-use invite links (sha256-hashed token at rest, optional email binding, configurable TTL). Public endpoints let the accept page validate the link and register — working even while public signup is disabled. - migration + sqlc queries/model for user_invites - POST /admin/invites (returns one-time token+url), GET list, DELETE revoke - GET /auth/invites/:token public validation, POST /auth/accept-invite - CLI containr invites list|create|revoke; MCP invites tools - /auth/accept-invite page (expired/used/invalid states, bound-email lock) - Admin page Team invites section: create, copy link, revoke - OpenAPI + generated types + CLI guide Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat(admin): impersonate user — 15-min token, audit-logged POST /admin/users/:id/impersonate mints a short-lived bearer token (impersonated_by claim) for support/debugging. Admin accounts cannot be impersonated; every mint is audit-logged with actor + target. - CLI: containr admin impersonate <user-id> (works via CONTAINR_TOKEN) - MCP: containr_admin_impersonate - Admin UI: per-user Impersonate action → token modal with usage hint - OpenAPI + generated types Verified live: token resolves to target, admin target 403, audit row. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat(git): GitHub App manifest self-provisioning + app-level webhook Admins create the instance GitHub App in-browser instead of hand- setting GITHUB_APP_* env vars: - POST /admin/git/github-app/manifest builds the manifest + URL; the frontend auto-submits it to github.com - /git/github-app/callback page exchanges the code via POST /admin/git/github-app/convert; credentials persist in app_settings (precedence over env) - GET /admin/git/github-app reports configured/source - POST /api/git/github-app/webhook — single app-level push receiver, HMAC-verified, dispatches via extracted dispatchPushToServices - install-url + installation-token paths resolve settings→env - CLI: containr admin github-app status|manifest|convert; MCP tools - Git providers UI shows "Set up GitHub App" for admins when unconfigured Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * feat: activity feed — enriched audit events, global + per-project timelines audit_logs gains severity/category/label columns derived from resource+action at write time; legacy rows are classified on read and backfilled at boot in batches. - GET /activity: global feed scoped to the caller's visible projects (admins see all); severity/category/resource/project_id/since filters, page+limit - GET /projects/:id/activity: timeline correlated to the project's services, deployments, databases and the project record; access mirrors project read rules - Retention worker prunes rows older than AUDIT_RETENTION_DAYS (default 90, 0 disables), running once at boot then daily - project.create/delete now audited so timelines aren't empty - CLI `containr activity` with filter flags; MCP tools containr_activity_list + containr_project_activity - Frontend: /activity page (severity chips, icon per category) under Operate nav; project workspace gains an Activity view tab - OpenAPI + generated types + CLI docs Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Tomáš DvořákandDevin authored and GitHub committed
1 parent
00e69b3733
commit
5eac4a382b
19 files changed
+905
-11
No files matched your search
@@ -23,9 +23,67 @@ type AuditLog struct {
|
||||
Details string `json:"details" db:"details"`
|
||||
IPAddress string `json:"ip_address" db:"ip_address"`
|
||||
UserAgent string `json:"user_agent" db:"user_agent"`
|
||||
Severity string `json:"severity" db:"severity"`
|
||||
Category string `json:"category" db:"category"`
|
||||
Label string `json:"label" db:"label"`
|
||||
CreatedAt time.Time `json:"created_at" db:"created_at"`
|
||||
}
|
||||
|
||||
// auditVerbs maps action verbs to past-tense words for feed labels.
|
||||
var auditVerbs = map[string]string{
|
||||
"create": "created", "delete": "deleted", "update": "updated",
|
||||
"deploy": "deployed", "clone": "cloned", "move": "moved",
|
||||
"backup": "backed up", "restore": "restored", "revoke": "revoked",
|
||||
"impersonate": "impersonated", "provision": "provisioned",
|
||||
"accept": "accepted", "login": "logged in", "scale": "scaled",
|
||||
"sleep": "put to sleep", "wake": "woke", "approve": "approved",
|
||||
"set_admin": "admin flag changed", "provisioned": "provisioned",
|
||||
}
|
||||
|
||||
// classifyAuditEvent derives severity/category/label for the activity feed.
|
||||
// Actions may already carry the resource prefix ("service.clone") — it is
|
||||
// stripped before matching.
|
||||
func classifyAuditEvent(resource, action string) (severity, category, label string) {
|
||||
verb := action
|
||||
if idx := strings.LastIndex(verb, "."); idx >= 0 {
|
||||
verb = verb[idx+1:]
|
||||
}
|
||||
|
||||
category = resource
|
||||
switch resource {
|
||||
case "user_invite", "invite", "github_app", "banner", "settings":
|
||||
category = "system"
|
||||
case "user_token", "agent_token", "registry_credential":
|
||||
category = "security"
|
||||
}
|
||||
|
||||
severity = "info"
|
||||
switch {
|
||||
case strings.Contains(verb, "fail"), strings.Contains(verb, "error"), strings.Contains(verb, "denied"):
|
||||
severity = "error"
|
||||
case strings.Contains(verb, "delete"), strings.Contains(verb, "revoke"),
|
||||
strings.Contains(verb, "remove"), strings.Contains(verb, "disable"),
|
||||
strings.Contains(verb, "impersonate"):
|
||||
severity = "warning"
|
||||
case strings.Contains(verb, "create"), strings.Contains(verb, "success"),
|
||||
strings.Contains(verb, "complete"), strings.Contains(verb, "accept"),
|
||||
strings.Contains(verb, "provision"), strings.Contains(verb, "clone"),
|
||||
strings.Contains(verb, "deploy"), strings.Contains(verb, "approve"):
|
||||
severity = "success"
|
||||
}
|
||||
|
||||
past := verb
|
||||
if v, ok := auditVerbs[verb]; ok {
|
||||
past = v
|
||||
}
|
||||
resName := strings.ReplaceAll(resource, "_", " ")
|
||||
if resName != "" {
|
||||
resName = strings.ToUpper(resName[:1]) + resName[1:]
|
||||
}
|
||||
label = resName + " " + past
|
||||
return severity, category, label
|
||||
}
|
||||
|
||||
type AuditLogDetail struct {
|
||||
OldValue interface{} `json:"old_value,omitempty"`
|
||||
NewValue interface{} `json:"new_value,omitempty"`
|
||||
@@ -42,12 +100,13 @@ func LogAudit(userID, resource, resourceID, action string, details map[string]in
|
||||
detailsJSON, _ := json.Marshal(details)
|
||||
resourceUUID := parseUUIDOrNil(resourceID)
|
||||
userUUID := parseUUIDOrNil(userID)
|
||||
severity, category, label := classifyAuditEvent(resource, action)
|
||||
|
||||
auditID := uuid.New().String()
|
||||
_, err := db.Exec(
|
||||
`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, created_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7)`,
|
||||
auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), time.Now().UTC(),
|
||||
`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, severity, category, label, created_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
|
||||
auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), severity, category, label, time.Now().UTC(),
|
||||
)
|
||||
|
||||
if err != nil {
|
||||
@@ -59,6 +118,9 @@ func LogAudit(userID, resource, resourceID, action string, details map[string]in
|
||||
func LogAuditWithRequest(c *gin.Context, resource, resourceID, action string, details map[string]interface{}) {
|
||||
userID, _ := c.Get("user_id")
|
||||
|
||||
if details == nil {
|
||||
details = map[string]interface{}{}
|
||||
}
|
||||
details["ip_address"] = c.ClientIP()
|
||||
details["user_agent"] = c.GetHeader("User-Agent")
|
||||
|
||||
@@ -71,12 +133,13 @@ func LogAuditWithRequest(c *gin.Context, resource, resourceID, action string, de
|
||||
}
|
||||
userUUID := parseUUIDOrNil(userIDStr)
|
||||
resourceUUID := parseUUIDOrNil(resourceID)
|
||||
severity, category, label := classifyAuditEvent(resource, action)
|
||||
|
||||
auditID := uuid.New().String()
|
||||
_, err := db.Exec(
|
||||
`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, ip_address, user_agent, created_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9)`,
|
||||
auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), c.ClientIP(), c.GetHeader("User-Agent"), time.Now().UTC(),
|
||||
`INSERT INTO audit_logs (id, user_id, resource, resource_id, action, details, ip_address, user_agent, severity, category, label, created_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9, $10, $11, $12)`,
|
||||
auditID, userUUID, resource, resourceUUID, action, string(detailsJSON), c.ClientIP(), c.GetHeader("User-Agent"), severity, category, label, time.Now().UTC(),
|
||||
)
|
||||
|
||||
if err != nil {
|
||||
@@ -155,6 +218,9 @@ func handleGetAuditLogs(c *gin.Context) {
|
||||
COALESCE(a.details::text, '{}'),
|
||||
COALESCE(a.ip_address::text, ''),
|
||||
COALESCE(a.user_agent, ''),
|
||||
COALESCE(a.severity, 'info'),
|
||||
COALESCE(a.category, ''),
|
||||
COALESCE(a.label, ''),
|
||||
a.created_at
|
||||
FROM audit_logs a
|
||||
LEFT JOIN users u ON u.id = a.user_id
|
||||
@@ -173,7 +239,7 @@ func handleGetAuditLogs(c *gin.Context) {
|
||||
var logs []AuditLog
|
||||
for rows.Next() {
|
||||
var log AuditLog
|
||||
err := rows.Scan(&log.ID, &log.UserID, &log.UserEmail, &log.Resource, &log.ResourceID, &log.Action, &log.Details, &log.IPAddress, &log.UserAgent, &log.CreatedAt)
|
||||
err := rows.Scan(&log.ID, &log.UserID, &log.UserEmail, &log.Resource, &log.ResourceID, &log.Action, &log.Details, &log.IPAddress, &log.UserAgent, &log.Severity, &log.Category, &log.Label, &log.CreatedAt)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user