deepen audit architecture seams

Author: ncode

cmd/auditServer.go

@@ -34,7 +34,11 @@ var auditServerCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		server, err := auditserver.New(logger)
+		settings, err := auditServerRuntimeSettings()
+		if err != nil {
+			return fmt.Errorf("failed to create audit server: %w", err)
+		}
+		server, err := auditserver.New(logger, settings)
 		if err != nil {
 			return fmt.Errorf("failed to create audit server: %w", err)
 		}

cmd/auditServer_test.go

@@ -16,8 +16,11 @@ limitations under the License.
 package cmd
 
 import (
+	"path/filepath"
 	"testing"
+	"time"
 
+	"github.com/ncode/vault-audit-filter/pkg/auditserver"
 	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -56,6 +59,76 @@ func TestAuditServerCmd_ValidConfig(t *testing.T) {
 	assert.NotNil(t, auditServerCmd.RunE)
 }
 
+func TestAuditServerRuntimeSettingsFromViper(t *testing.T) {
+	viper.Reset()
+	logPath := filepath.Join(t.TempDir(), "audit.log")
+	viper.Set("vault.audit_protocol", "tcp")
+	viper.Set("async.queue_size", 9)
+	viper.Set("async.workers", 3)
+	viper.Set("async.enqueue_mode", "wait")
+	viper.Set("async.enqueue_timeout", "13ms")
+	viper.Set("async.timeout", "19ms")
+	viper.Set("async.durable.enabled", true)
+	viper.Set("async.durable.dir", t.TempDir())
+	viper.Set("async.retry.max_attempts", 6)
+	viper.Set("async.retry.backoff", "29ms")
+	viper.Set("rule_groups", []map[string]interface{}{{
+		"name":     "configured",
+		"rules":    []string{"Request.Operation == 'read'"},
+		"log_file": map[string]interface{}{"file_path": logPath, "max_size": 1},
+	}})
+
+	settings, err := auditServerRuntimeSettings()
+	require.NoError(t, err)
+	assert.Equal(t, "tcp", settings.AuditProtocol)
+	assert.Equal(t, 9, settings.Async.QueueSize)
+	assert.Equal(t, 3, settings.Async.Workers)
+	assert.Equal(t, "wait", settings.Async.EnqueueMode)
+	assert.Equal(t, 13*time.Millisecond, settings.Async.EnqueueTimeout)
+	assert.Equal(t, 19*time.Millisecond, settings.Async.Timeout)
+	assert.True(t, settings.Async.Durable.Enabled)
+	assert.Equal(t, 6, settings.Async.Retry.MaxAttempts)
+	assert.Equal(t, 29*time.Millisecond, settings.Async.Retry.Backoff)
+	require.Len(t, settings.RuleGroups, 1)
+	assert.Equal(t, "configured", settings.RuleGroups[0].Name)
+	assert.Equal(t, logPath, settings.RuleGroups[0].LogFile.FilePath)
+}
+
+func TestAuditServerRuntimeSettings_InvalidAsyncValuesFallBackToDefaults(t *testing.T) {
+	viper.Reset()
+	viper.Set("vault.audit_protocol", "udp")
+	viper.Set("async.queue_size", 0)
+	viper.Set("async.workers", -1)
+	viper.Set("async.enqueue_mode", "invalid")
+	viper.Set("async.enqueue_timeout", "bad")
+	viper.Set("async.timeout", "also-bad")
+	viper.Set("async.durable.dir", "")
+	viper.Set("async.retry.max_attempts", 0)
+	viper.Set("async.retry.backoff", "worse")
+	viper.Set("rule_groups", []map[string]interface{}{})
+
+	settings, err := auditServerRuntimeSettings()
+	require.NoError(t, err)
+	defaults := auditserver.DefaultRuntimeSettings()
+	assert.Equal(t, defaults.Async.QueueSize, settings.Async.QueueSize)
+	assert.Equal(t, defaults.Async.Workers, settings.Async.Workers)
+	assert.Equal(t, defaults.Async.EnqueueMode, settings.Async.EnqueueMode)
+	assert.Equal(t, defaults.Async.EnqueueTimeout, settings.Async.EnqueueTimeout)
+	assert.Equal(t, defaults.Async.Timeout, settings.Async.Timeout)
+	assert.Equal(t, defaults.Async.Durable.Dir, settings.Async.Durable.Dir)
+	assert.Equal(t, defaults.Async.Retry.MaxAttempts, settings.Async.Retry.MaxAttempts)
+	assert.Equal(t, defaults.Async.Retry.Backoff, settings.Async.Retry.Backoff)
+}
+
+func TestAuditServerRuntimeSettings_InvalidProtocol(t *testing.T) {
+	viper.Reset()
+	viper.Set("vault.audit_protocol", "invalid")
+
+	_, err := auditServerRuntimeSettings()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unsupported vault.audit_protocol")
+}
+
 func TestAuditServerCmd_RunE_InvokesGnetRun(t *testing.T) {
 	viper.Reset()
 	viper.Set("vault.audit_address", "bad host")

cmd/audit_config.go

@@ -0,0 +1,62 @@
+package cmd
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/ncode/vault-audit-filter/pkg/auditserver"
+	"github.com/spf13/viper"
+)
+
+func auditServerRuntimeSettings() (auditserver.RuntimeSettings, error) {
+	defaults := auditserver.DefaultRuntimeSettings()
+	setAuditServerDefaults(defaults)
+
+	var ruleGroups []auditserver.RuleGroupConfig
+	if err := viper.UnmarshalKey("rule_groups", &ruleGroups); err != nil {
+		logger.Error("Failed to load rule groups", "error", err)
+		return auditserver.RuntimeSettings{}, fmt.Errorf("failed to load rule groups: %w", err)
+	}
+
+	protocol, err := vaultAuditProtocol()
+	if err != nil {
+		return auditserver.RuntimeSettings{}, err
+	}
+
+	settings := defaults
+	settings.RuleGroups = ruleGroups
+	settings.AuditProtocol = protocol
+	settings.Async.QueueSize = viper.GetInt("async.queue_size")
+	settings.Async.Workers = viper.GetInt("async.workers")
+	settings.Async.EnqueueMode = viper.GetString("async.enqueue_mode")
+	settings.Async.EnqueueTimeout = durationSetting("async.enqueue_timeout", defaults.Async.EnqueueTimeout)
+	settings.Async.Timeout = durationSetting("async.timeout", defaults.Async.Timeout)
+	settings.Async.Durable.Enabled = viper.GetBool("async.durable.enabled")
+	settings.Async.Durable.Dir = viper.GetString("async.durable.dir")
+	settings.Async.Retry.MaxAttempts = viper.GetInt("async.retry.max_attempts")
+	settings.Async.Retry.Backoff = durationSetting("async.retry.backoff", defaults.Async.Retry.Backoff)
+
+	return auditserver.NormalizeRuntimeSettings(settings, logger), nil
+}
+
+func setAuditServerDefaults(defaults auditserver.RuntimeSettings) {
+	viper.SetDefault("async.queue_size", defaults.Async.QueueSize)
+	viper.SetDefault("async.workers", defaults.Async.Workers)
+	viper.SetDefault("async.enqueue_mode", defaults.Async.EnqueueMode)
+	viper.SetDefault("async.enqueue_timeout", defaults.Async.EnqueueTimeout.String())
+	viper.SetDefault("async.timeout", defaults.Async.Timeout.String())
+	viper.SetDefault("async.durable.enabled", defaults.Async.Durable.Enabled)
+	viper.SetDefault("async.durable.dir", defaults.Async.Durable.Dir)
+	viper.SetDefault("async.retry.max_attempts", defaults.Async.Retry.MaxAttempts)
+	viper.SetDefault("async.retry.backoff", defaults.Async.Retry.Backoff.String())
+}
+
+func durationSetting(key string, fallback time.Duration) time.Duration {
+	raw := viper.GetString(key)
+	value, err := time.ParseDuration(raw)
+	if err != nil || value <= 0 {
+		logger.Warn("Invalid duration config; using default", "key", key, "value", raw)
+		return fallback
+	}
+	return value
+}

cmd/setup.go

@@ -43,17 +43,13 @@ var setupCmd = &cobra.Command{
 			return fmt.Errorf("unable to setup vault client: %w", err)
 		}
 
-		err = client.EnableAuditDevice(
-			viper.GetString("vault.audit_path"),
-			"socket",
-			viper.GetString("vault.audit_description"),
-			map[string]string{
-				"address":     viper.GetString("vault.audit_address"),
-				"socket_type": protocol,
-				"description": viper.GetString("vault.audit_description"),
-				"log_raw":     "false",
-			},
-		)
+		err = client.EnableSocketAuditDevice(vault.SocketAuditDeviceSpec{
+			Path:        viper.GetString("vault.audit_path"),
+			Address:     viper.GetString("vault.audit_address"),
+			Protocol:    protocol,
+			Description: viper.GetString("vault.audit_description"),
+			LogRaw:      false,
+		})
 		if err != nil {
 			return fmt.Errorf("unable to enable audit device: %w", err)
 		}