[server] audit log service

[svenefftinge]

Description

Introduces generic audit logging, that can be turned on through a feature flag.

It only works for user that have an organizationId. For testing you need to manually update the db entry and then log out and in again.
Just ping me after you signed up and I will do that for you.

Related Issue(s)

Fixes #

How to test

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

• 🏷️ Name - se-audit-logs
• 🔗 URL - se-audit-logs.preview.gitpod-dev.com/workspaces.
• 📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
• 📦 Version -
• 🗒️ Logs - GCP Logs Explorer

Build Options

Build
• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test
Publish
• /werft publish-to-npm
• /werft publish-to-jb-marketplace
Installer
• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated
Preview Environment / Integration Tests
• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[filiptronicek]

Took a quick look at the code and left some comments. I am happy to test and have signed up in the preview environment.

[Siddhant-K-code]

It only works for user that have an organizationId. For testing you need to manually update the db entry and then log out and in again.
Just ping me after you signed up and I will do that for you.

@svenefftinge can you do that for me 🙏🏼

temp orgId: 4ac145ee-ad57-431e-9503-2fa5bb745310
temp userId: b64e91b6-0a78-4147-ada6-5cb282022ea3

[svenefftinge]

@Siddhant-K-code @filiptronicek I changed your users to enable audit logs

You can try the API with this:

curl -X POST \
  "https://api.$GITPOD_DOMAIN/gitpod.v1.AuditLogService/ListAuditLogs" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'content-type: application/json' \
  --data-raw '{
    "organizationId": "<organization_id>",
    "pagination": {
        "pageSize": 200,
        "page": 0
    },
    "from": "2024-01-13T07:06:45.659Z",
    "to": "2024-07-13T07:06:48.659Z"
}'

[filiptronicek]

I can get audit logs correctly for basically everything I did in the preview environment, it's very nice.

I assume the next step is filtering this down to non-personal write events? Do we have a ticket for that?

{
  "pagination": {
    "total": 118
  },
  "auditLogs": [
    {
      "id": "5c62c015-834d-45a6-9090-07716335e22a",
      "timestamp": "2024-06-24T14:16:40.612Z",
      "action": "gitpod.v1.OrganizationService/listOrganizationMembers",
      "organizationId": "1ea2a67e-cc3a-468a-b776-30fe0504f201",
      "actorId": "010529b6-17e5-4289-b9e5-7446e9393164",
      "args": "[{\"pagination\":{\"page\":0,\"token\":\"\",\"pageSize\":1000},\"organizationId\":\"1ea2a67e-cc3a-468a-b776-30fe0504f201\"}]"
    },
    {
      "id": "f1464525-8f33-4f05-97d8-5862dda4bae1",
      "timestamp": "2024-06-24T14:16:40.611Z",
      "action": "gitpod.v1.OrganizationService/getOrganizationInvitation",
      "organizationId": "1ea2a67e-cc3a-468a-b776-30fe0504f201",
      "actorId": "010529b6-17e5-4289-b9e5-7446e9393164",
      "args": "[{\"organizationId\":\"1ea2a67e-cc3a-468a-b776-30fe0504f201\"}]"
    },
    {
      "id": "47dc651d-f6f9-4e20-9491-94584afdb007",
      "timestamp": "2024-06-24T14:16:39.465Z",
      "action": "gitpod.v1.WorkspaceService/listWorkspaces",
      "organizationId": "1ea2a67e-cc3a-468a-b776-30fe0504f201",
      "actorId": "010529b6-17e5-4289-b9e5-7446e9393164",
      "args": "[{\"pinned\":true,\"pagination\":{\"page\":0,\"token\":\"\",\"pageSize\":50},\"searchTerm\":\"\",\"organizationId\":\"1ea2a67e-cc3a-468a-b776-30fe0504f201\"}]"
    },
  ]
}

[svenefftinge]

/unhold