Skip to content

Commit 4fe97fd

Browse files
c-r33dc-r33d
authored
fix(kas): populate rewrap audit log (#2861)
### Proposed Changes 1.) Populate kas rewrap audit message with attributes. 2.) Add keyID to `eventmetadata` #### Example Nano failure ```json { "time": "2025-10-30T10:13:30.270403-05:00", "level": "AUDIT", "msg": "rewrap", "namespace": "kas", "audit": { "object": { "type": "key_object", "id": "ff1a2fe2-a942-11f0-9751-a6a754e79d24", "name": "", "attributes": { "assertions": [], "attrs": [ "https://test.obligations/attr/test_attr_for_triggers/value/test_valu_for_trigger" ], "permissions": [] } }, "action": { "type": "rewrap", "result": "error" }, "actor": { "id": "031fe452-ddbb-4d36-b82f-c6b3dd4d122a", "attributes": [] }, "eventMetaData": { "algorithm": "ec:secp256r1", "keyID": "e1", "policyBinding": "", "tdfFormat": "Nano" }, "clientInfo": { "userAgent": "connect-go/1.18.1 (go1.24.6)", "platform": "kas", "requestIP": "None" }, "original": null, "updated": null, "requestID": "d56da397-3387-4a14-9955-73681e627e37", "timestamp": "2025-10-30T10:13:30-05:00" } } ``` #### Example ztdf success ```json { "time": "2025-10-31T11:58:40.892713-05:00", "level": "AUDIT", "msg": "rewrap", "namespace": "kas", "audit": { "object": { "type": "key_object", "id": "cd2f0354-a942-11f0-b197-a6a754e79d24", "name": "", "attributes": { "assertions": [], "attrs": [ "https://test.obligations/attr/test_attr_for_triggers/value/test_valu_for_trigger" ], "permissions": [] } }, "action": { "type": "rewrap", "result": "success" }, "actor": { "id": "031fe452-ddbb-4d36-b82f-c6b3dd4d122a", "attributes": [] }, "eventMetaData": { "algorithm": "rsa:2048", "keyID": "r1", "policyBinding": "YjEwNWMwZGVhMjkzYjBhZjU4MWNkOTE1MmU4N2NkNjkzNzQ2ODM5NDI0MGRjYjhmNjRiZjlhNmY0OWEzZjJlNw==", "tdfFormat": "tdf3" }, "clientInfo": { "userAgent": "connect-go/1.18.1 (go1.24.6)", "platform": "kas", "requestIP": "None" }, "original": null, "updated": null, "requestID": "73f131ae-cc21-490c-868d-260e58b8664d", "timestamp": "2025-10-31T11:58:40-05:00" } } ``` ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions
1 parent fb0b99d commit 4fe97fd

File tree

4 files changed

+67
-37
lines changed

4 files changed

+67
-37
lines changed

‎service/kas/access/rewrap.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ type kaoResult struct {
8383
// Optional: Present for EC wrapped responses
8484
EphemeralPublicKey []byte
8585
RequiredObligations []string
86+
87+
// Only populated for Nano auditing, since policy is encrypted
88+
KeyID string
8689
}
8790

8891
// From policy ID to KAO ID to result
@@ -800,6 +803,7 @@ func (p *Provider) tdf3Rewrap(ctx context.Context, requests []*kaspb.UnsignedRew
800803
TDFFormat: "tdf3",
801804
Algorithm: req.GetAlgorithm(),
802805
PolicyBinding: policyBinding,
806+
KeyID: kao.GetKeyAccessObject().GetKid(),
803807
}
804808

805809
if !access {
@@ -901,6 +905,7 @@ func (p *Provider) nanoTDFRewrap(ctx context.Context, requests []*kaspb.Unsigned
901905
IsSuccess: access,
902906
TDFFormat: "Nano",
903907
Algorithm: req.GetAlgorithm(),
908+
KeyID: kaoInfo.KeyID,
904909
}
905910

906911
if !access {
@@ -992,8 +997,9 @@ func (p *Provider) verifyNanoRewrapRequests(ctx context.Context, req *kaspb.Unsi
992997
return nil, results
993998
}
994999
results[kao.GetKeyAccessObjectId()] = kaoResult{
995-
ID: kao.GetKeyAccessObjectId(),
996-
DEK: symmetricKey,
1000+
ID: kao.GetKeyAccessObjectId(),
1001+
DEK: symmetricKey,
1002+
KeyID: kid,
9971003
}
9981004
return policy, results
9991005
}

‎service/logger/audit/logger_test.go‎

Lines changed: 38 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,36 @@ import (
1414
"github.com/opentdf/platform/protocol/go/authorization"
1515
)
1616

17+
// Params
18+
var rewrapAttrs = []string{
19+
"https://example1.com",
20+
"https://example2.com",
21+
}
22+
23+
const rewrapAttrsJSON = `["https://example1.com", "https://example2.com"]`
24+
25+
var rewrapParams = RewrapAuditEventParams{
26+
Policy: KasPolicy{
27+
UUID: uuid.New(),
28+
Body: KasPolicyBody{
29+
DataAttributes: []KasAttribute{
30+
{URI: rewrapAttrs[0]},
31+
{URI: rewrapAttrs[1]},
32+
},
33+
},
34+
},
35+
TDFFormat: "test-tdf-format",
36+
Algorithm: "test-algorithm",
37+
PolicyBinding: "test-policy-binding",
38+
KeyID: "r1",
39+
}
40+
41+
var policyCRUDParams = PolicyEventParams{
42+
ActionType: ActionTypeUpdate,
43+
ObjectID: "test-object-id",
44+
ObjectType: ObjectTypeKeyObject,
45+
}
46+
1747
func createTestLogger() (*Logger, *bytes.Buffer) {
1848
var buf bytes.Buffer
1949

@@ -66,29 +96,6 @@ func extractLogEntry(t *testing.T, logBuffer *bytes.Buffer) (logEntryStructure,
6696
return entry, entryTime
6797
}
6898

69-
// Params
70-
71-
var rewrapParams = RewrapAuditEventParams{
72-
Policy: KasPolicy{
73-
UUID: uuid.New(),
74-
Body: KasPolicyBody{
75-
DataAttributes: []KasAttribute{
76-
{URI: "https://example1.com"},
77-
{URI: "https://example2.com"},
78-
},
79-
},
80-
},
81-
TDFFormat: "test-tdf-format",
82-
Algorithm: "test-algorithm",
83-
PolicyBinding: "test-policy-binding",
84-
}
85-
86-
var policyCRUDParams = PolicyEventParams{
87-
ActionType: ActionTypeUpdate,
88-
ObjectID: "test-object-id",
89-
ObjectType: ObjectTypeKeyObject,
90-
}
91-
9299
func TestAuditRewrapSuccess(t *testing.T) {
93100
l, buf := createTestLogger()
94101

@@ -104,7 +111,7 @@ func TestAuditRewrapSuccess(t *testing.T) {
104111
"name": "",
105112
"attributes": {
106113
"assertions": [],
107-
"attrs": [],
114+
"attrs": %s,
108115
"permissions": []
109116
}
110117
},
@@ -118,7 +125,7 @@ func TestAuditRewrapSuccess(t *testing.T) {
118125
},
119126
"eventMetaData": {
120127
"algorithm": "%s",
121-
"keyID": "",
128+
"keyID": "%s",
122129
"policyBinding": "%s",
123130
"tdfFormat": "%s"
124131
},
@@ -134,8 +141,10 @@ func TestAuditRewrapSuccess(t *testing.T) {
134141
}
135142
`,
136143
rewrapParams.Policy.UUID.String(),
144+
rewrapAttrsJSON,
137145
TestActorID,
138146
rewrapParams.Algorithm,
147+
rewrapParams.KeyID,
139148
rewrapParams.PolicyBinding,
140149
rewrapParams.TDFFormat,
141150
TestUserAgent,
@@ -168,7 +177,7 @@ func TestAuditRewrapFailure(t *testing.T) {
168177
"name": "",
169178
"attributes": {
170179
"assertions": [],
171-
"attrs": [],
180+
"attrs": %s,
172181
"permissions": []
173182
}
174183
},
@@ -182,7 +191,7 @@ func TestAuditRewrapFailure(t *testing.T) {
182191
},
183192
"eventMetaData": {
184193
"algorithm": "%s",
185-
"keyID": "",
194+
"keyID": "%s",
186195
"policyBinding": "%s",
187196
"tdfFormat": "%s"
188197
},
@@ -198,8 +207,10 @@ func TestAuditRewrapFailure(t *testing.T) {
198207
}
199208
`,
200209
rewrapParams.Policy.UUID.String(),
210+
rewrapAttrsJSON,
201211
TestActorID,
202212
rewrapParams.Algorithm,
213+
rewrapParams.KeyID,
203214
rewrapParams.PolicyBinding,
204215
rewrapParams.TDFFormat,
205216
TestUserAgent,

‎service/logger/audit/rewrap.go‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ type RewrapAuditEventParams struct {
2525
TDFFormat string
2626
Algorithm string
2727
PolicyBinding string
28+
KeyID string
2829
}
2930

3031
func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams) (*EventObject, error) {
@@ -36,14 +37,19 @@ func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams)
3637
auditEventActionResult = ActionResultSuccess
3738
}
3839

40+
attrFQNS := make([]string, len(params.Policy.Body.DataAttributes))
41+
for i, attr := range params.Policy.Body.DataAttributes {
42+
attrFQNS[i] = attr.URI
43+
}
44+
3945
return &EventObject{
4046
Object: auditEventObject{
4147
Type: ObjectTypeKeyObject,
4248
ID: params.Policy.UUID.String(),
4349
Attributes: eventObjectAttributes{
44-
Assertions: []string{},
45-
Attrs: []string{},
46-
Permissions: []string{},
50+
Assertions: []string{}, // Assertions aren't passed in the rewrap policy body
51+
Attrs: attrFQNS,
52+
Permissions: []string{}, // Currently always empty
4753
},
4854
},
4955
Action: eventAction{
@@ -55,7 +61,7 @@ func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams)
5561
Attributes: make([]any, 0),
5662
},
5763
EventMetaData: auditEventMetadata{
58-
"keyID": "", // TODO: keyID once implemented
64+
"keyID": params.KeyID,
5965
"policyBinding": params.PolicyBinding,
6066
"tdfFormat": params.TDFFormat,
6167
"algorithm": params.Algorithm,

‎service/logger/audit/rewrap_test.go‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,18 @@ import (
88
)
99

1010
func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
11+
attrs := []string{
12+
"https://example1.com",
13+
"https://example2.com",
14+
}
15+
keyID := "r1"
16+
1117
kasPolicy := KasPolicy{
1218
UUID: uuid.New(),
1319
Body: KasPolicyBody{
1420
DataAttributes: []KasAttribute{
15-
{URI: "https://example1.com"},
16-
{URI: "https://example2.com"},
21+
{URI: attrs[0]},
22+
{URI: attrs[1]},
1723
},
1824
Dissem: []string{"dissem1", "dissem2"},
1925
},
@@ -25,6 +31,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
2531
TDFFormat: TestTDFFormat,
2632
Algorithm: TestAlgorithm,
2733
PolicyBinding: TestPolicyBinding,
34+
KeyID: keyID,
2835
}
2936

3037
event, err := CreateRewrapAuditEvent(createTestContext(), params)
@@ -37,7 +44,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
3744
ID: kasPolicy.UUID.String(),
3845
Attributes: eventObjectAttributes{
3946
Assertions: []string{},
40-
Attrs: []string{},
47+
Attrs: attrs,
4148
Permissions: []string{},
4249
},
4350
}
@@ -62,7 +69,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
6269
}
6370

6471
expectedEventMetaData := auditEventMetadata{
65-
"keyID": "",
72+
"keyID": keyID,
6673
"policyBinding": TestPolicyBinding,
6774
"tdfFormat": TestTDFFormat,
6875
"algorithm": TestAlgorithm,

0 commit comments

Comments
 (0)