Skip to content

Commit 7596920

Browse files
wdsun1008jialez0
authored andcommitted
doc: update api doc for audit
Signed-off-by: Weidong Sun <sunweidong@linux.alibaba.com>
1 parent 9ec18e0 commit 7596920

1 file changed

Lines changed: 56 additions & 26 deletions

File tree

trustee-gateway/trustee_gateway_api.md

Lines changed: 56 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,7 +1042,7 @@ curl -k -X DELETE http://<gateway-host>:<port>/api/rvps/delete/test-binary-1
10421042

10431043
* **端点:** `GET /api/audit/attestation`
10441044

1045-
* **说明:** 查询 `/api/kbs/v0/attest` 端点的调用记录 (存储在 Gateway 数据库中)。
1045+
* **说明:** 查询 `/api/kbs/v0/attest` `/api/attestation-service/attestation` 端点的调用记录 (存储在 Gateway 数据库中)。
10461046

10471047
* **调用方法:**
10481048

@@ -1052,8 +1052,10 @@ curl -k -X DELETE http://<gateway-host>:<port>/api/rvps/delete/test-binary-1
10521052
curl -k http://<gateway-host>:<port>/api/audit/attestation
10531053
# 按 session_id 过滤
10541054
curl -k http://<gateway-host>:<port>/api/audit/attestation?session_id=your-session-id
1055-
# 按请求类型过滤 (注意: Gateway 代码接收此参数,但可能未在 DB 查询中有效使用)
1056-
curl -k http://<gateway-host>:<port>/api/audit/attestation?request_type=some_type
1055+
# 按来源服务过滤
1056+
curl -k http://<gateway-host>:<port>/api/audit/attestation?source_service=kbs
1057+
# 按 AA 实例 ID 过滤
1058+
curl -k http://<gateway-host>:<port>/api/audit/attestation?instance_id=i-12345
10571059
# 查询成功的记录 (基于 KBS 返回的状态码是否为 200)
10581060
curl -k http://<gateway-host>:<port>/api/audit/attestation?successful=true
10591061
# 查询某个时间段的记录 (RFC3339 格式)
@@ -1066,7 +1068,9 @@ curl -k http://<gateway-host>:<port>/api/audit/attestation?limit=50&offset=50
10661068

10671069
* `session_id` (查询参数, string, 可选): 按 KBS 会话 ID 过滤。
10681070

1069-
* `request_type` (查询参数, string, 可选): 按请求类型过滤 (Gateway 代码读取此参数,但后端存储库可能未使用)。
1071+
* `source_service` (查询参数, string, 可选): 按来源服务过滤 (例如 "kbs", "attestation-service")。
1072+
1073+
* `instance_id` (查询参数, string, 可选): 按 AA 实例 ID 过滤。
10701074

10711075
* `successful` (查询参数, boolean, 可选): 按请求是否成功过滤 (`true``false`)。无效值将被忽略。
10721076

@@ -1097,26 +1101,37 @@ curl -k http://<gateway-host>:<port>/api/audit/attestation?limit=50&offset=50
10971101
{
10981102
"data": [
10991103
{
1100-
"id": 1, // 数据库自增 ID
1104+
"id": 1,
11011105
"client_ip": "192.168.1.101",
11021106
"session_id": "session-abc",
1103-
"request_body": "{\"tee-pubkey\":{...},\"tee-evidence\":{...}}", // 原始请求体
1104-
"status": 200, // KBS 返回的状态码
1105-
"successful": true, // 是否 status == 200
1106-
"timestamp": "2024-01-10T12:34:56Z" // Gateway 记录时间
1107+
"request_body": "{\"tee-pubkey\":{...},\"tee-evidence\":{...}}",
1108+
"claims": "{\"customized_claims\":{\"init_data\":null,\"runtime_data\":{\"nonce\":\"DfnnB6Geop0ymdqQQg88oR+hjNKe7NzWIqzssBqdVe0=\",\"tee-pubkey\":{\"alg\":\"RSA1_5\",\"e\":\"AQAB\",\"kty\":\"RSA\",\"n\":\"uOoYePWev5VF9uUzHlkED6MB-n5bS-iCoIIoBJsfEqYt9mHda-mhN0iPK91gYcC33ilHWDaGqMveevsJ9n8-e-qgu3r4-SpMdURxsuQY8RmUjxcStFhfH56ZEaziASyVi9G94kBIpS3ApOIMf-oOdgoOft2eCYnMzuY0dplQKNGS6rB_78SD9F0gaMQ_Q0JaxlXKXK8OhiaoFOjFMlVtEnrk5FI_WsWWMOitinBT9jng-JRRqCHihicF16_iAmktPPEn3MeY6NiLDxNhoQYw-72u_nhdfMwO2KXsjUwFTF_06wTeiGfiqNcR1sRco_H8_X-iFbZS4DZxxBos5KWHuQ\"}}},\"evaluation-reports\":[{\"policy-hash\":\"f5abdc02716d85a5ab28cf43500201591bbe4e5600751039462e5ec2e0ae2698d637c1f487f58bca182244eefdf3b4b1\",\"policy-id\":\"default\"}],\"exp\":1752589512,\"iat\":1752589212,\"iss\":\"CoCo-Attestation-Service\",\"jti\":\"BDbHikXUMj\",\"nbf\":1752589212,\"tcb-status\":\"{\\\"init_data\\\":\\\"\\\",\\\"report_data\\\":\\\"zQU7fRqrb5gE+NLN0bVOWkYZGZvNzTIkStwALFtpX5wawbYY4J6CCV7PC2TvfFFn\\\",\\\"sample.svn\\\":\\\"1\\\"}\",\"tee\":\"sample\"}",
1109+
"status": 200,
1110+
"successful": true,
1111+
"timestamp": "2024-01-10T12:34:56Z",
1112+
"source_service": "kbs",
1113+
"instance_id": "i-12345",
1114+
"image_id": "img-abc",
1115+
"instance_name": "my-instance",
1116+
"owner_account_id": "123456789"
11071117
},
11081118
{
11091119
"id": 2,
11101120
"client_ip": "10.0.0.5",
11111121
"session_id": "session-xyz",
1112-
"request_body": "{\"tee-pubkey\":{...},\"tee-evidence\":{...}}",
1122+
"request_body": "",
1123+
"claims": "{\"tee-pubkey\":{...},\"tee-evidence\":{...}}",
11131124
"status": 403,
11141125
"successful": false,
1115-
"timestamp": "2024-01-10T12:35:10Z"
1126+
"timestamp": "2024-01-10T12:35:10Z",
1127+
"source_service": "attestation-service",
1128+
"instance_id": "i-67890",
1129+
"image_id": "img-def",
1130+
"instance_name": "another-instance",
1131+
"owner_account_id": "987654321"
11161132
}
1117-
// ... more records
11181133
],
1119-
"total": 2 // 当前返回的记录数量
1134+
"total": 2
11201135
}
11211136
```
11221137

@@ -1138,6 +1153,8 @@ curl -k http://<gateway-host>:<port>/api/audit/resources
11381153
curl -k http://<gateway-host>:<port>/api/audit/resources?repository=my-repo&type=key
11391154
# 按方法过滤 (GET 请求)
11401155
curl -k http://<gateway-host>:<port>/api/audit/resources?method=GET
1156+
# 按 AA 实例 ID 过滤
1157+
curl -k http://<gateway-host>:<port>/api/audit/resources?instance_id=i-12345
11411158
# 查询失败的 POST 请求 (基于 KBS 返回的状态码)
11421159
curl -k http://<gateway-host>:<port>/api/audit/resources?method=POST&successful=false
11431160
# 其他参数同 /audit/attestation (session_id, tag, start_time, end_time, limit, offset)
@@ -1155,6 +1172,8 @@ curl -k http://<gateway-host>:<port>/api/audit/resources?method=POST&successful=
11551172

11561173
* `method` (查询参数, string, 可选): 按 HTTP 方法过滤 (e.g., "GET", "POST")。
11571174

1175+
* `instance_id` (查询参数, string, 可选): 按 AA 实例 ID 过滤。
1176+
11581177
* `successful` (查询参数, boolean, 可选): 按请求是否成功过滤 (`true``false`)。
11591178

11601179
* 对于 GET,成功意味着 KBS 返回 200。
@@ -1192,16 +1211,20 @@ curl -k http://<gateway-host>:<port>/api/audit/resources?method=POST&successful=
11921211
{
11931212
"data": [
11941213
{
1195-
"id": 1, // 数据库自增 ID
1214+
"id": 1,
11961215
"client_ip": "192.168.1.102",
1197-
"session_id": "session-def", // 可能为空
1216+
"session_id": "session-def",
11981217
"repository": "my-repo",
11991218
"type": "key",
12001219
"tag": "latest",
12011220
"method": "GET",
1202-
"status": 200, // KBS 返回的状态码
1203-
"successful": true, // 对 GET 来说 status == 200
1204-
"timestamp": "2024-01-11T09:15:00Z" // Gateway 记录时间
1221+
"status": 200,
1222+
"successful": true,
1223+
"timestamp": "2024-01-11T09:15:00Z",
1224+
"instance_id": "i-abcde",
1225+
"image_id": "img-123",
1226+
"instance_name": "resource-getter",
1227+
"owner_account_id": "1122334455"
12051228
},
12061229
{
12071230
"id": 2,
@@ -1211,9 +1234,13 @@ curl -k http://<gateway-host>:<port>/api/audit/resources?method=POST&successful=
12111234
"type": "config",
12121235
"tag": "prod",
12131236
"method": "POST",
1214-
"status": 201, // KBS 返回的状态码
1215-
"successful": true, // 对 POST 来说 status in (200, 201, 204)
1216-
"timestamp": "2024-01-11T09:20:00Z"
1237+
"status": 201,
1238+
"successful": true,
1239+
"timestamp": "2024-01-11T09:20:00Z",
1240+
"instance_id": "i-fghij",
1241+
"image_id": "img-456",
1242+
"instance_name": "resource-setter",
1243+
"owner_account_id": "6677889900"
12171244
},
12181245
{
12191246
"id": 3,
@@ -1223,13 +1250,16 @@ curl -k http://<gateway-host>:<port>/api/audit/resources?method=POST&successful=
12231250
"type": "data",
12241251
"tag": "v1",
12251252
"method": "GET",
1226-
"status": 404, // KBS 返回的状态码
1227-
"successful": false, // status != 200
1228-
"timestamp": "2024-01-11T09:25:00Z"
1253+
"status": 404,
1254+
"successful": false,
1255+
"timestamp": "2024-01-11T09:25:00Z",
1256+
"instance_id": "i-klmno",
1257+
"image_id": "img-789",
1258+
"instance_name": "resource-failed",
1259+
"owner_account_id": "123123123"
12291260
}
1230-
// ... more records
12311261
],
1232-
"total": 3 // 当前返回的记录数量
1262+
"total": 3
12331263
}
12341264
```
12351265

0 commit comments

Comments
 (0)