log http status codes

Author: david-crespo

nexus/db-model/src/audit_log.rs

@@ -5,6 +5,7 @@
 // Copyright 2025 Oxide Computer Company
 
 use crate::schema::{audit_log, audit_log_complete};
+use crate::SqlU16;
 use chrono::{DateTime, Utc};
 use diesel::prelude::*;
 use nexus_types::external_api::views;
@@ -71,6 +72,7 @@ pub struct AuditLogEntry {
     // Fields that are not present on init
     /// Time log entry was completed with info about result of operation
     pub time_completed: DateTime<Utc>,
+    pub http_status_code: SqlU16,
 
     // Error information if the action failed
     pub error_code: Option<String>,
@@ -108,11 +110,15 @@ impl AuditLogEntryInit {
 #[diesel(table_name = audit_log)]
 pub struct AuditLogCompletion {
     pub time_completed: DateTime<Utc>,
+    pub http_status_code: SqlU16,
 }
 
 impl AuditLogCompletion {
-    pub fn new() -> Self {
-        Self { time_completed: Utc::now() }
+    pub fn new(http_status_code: u16) -> Self {
+        Self {
+            time_completed: Utc::now(),
+            http_status_code: SqlU16(http_status_code),
+        }
     }
 }
 
@@ -138,6 +144,7 @@ impl From<AuditLogEntry> for views::AuditLogEntry {
             actor_silo_id: entry.actor_silo_id,
             access_method: entry.access_method,
             time_completed: entry.time_completed,
+            http_status_code: entry.http_status_code.0,
             error_code: entry.error_code,
             error_message: entry.error_message,
         }

nexus/db-model/src/schema.rs

@@ -2144,6 +2144,7 @@ table! {
         access_method -> Nullable<Text>,
         resource_id -> Nullable<Uuid>,
         time_completed -> Nullable<Timestamptz>,
+        http_status_code -> Nullable<Int4>, // SqlU16
         error_code -> Nullable<Text>,
         error_message -> Nullable<Text>
     }
@@ -2162,6 +2163,7 @@ table! {
         access_method -> Nullable<Text>,
         resource_id -> Nullable<Uuid>,
         time_completed -> Timestamptz,
+        http_status_code -> Int4, // SqlU16
         error_code -> Nullable<Text>,
         error_message -> Nullable<Text>
     }

nexus/db-queries/src/db/datastore/audit_log.rs

@@ -154,7 +154,7 @@ mod tests {
 
         let t1 = Utc::now();
 
-        let completion = AuditLogCompletion::new();
+        let completion = AuditLogCompletion::new(201);
         datastore
             .audit_log_entry_complete(opctx, &entry1, completion)
             .await
@@ -187,7 +187,7 @@ mod tests {
         assert_eq!(audit_log[0].request_id, "req-1");
 
         // now complete entry2
-        let completion = AuditLogCompletion::new();
+        let completion = AuditLogCompletion::new(204);
         datastore
             .audit_log_entry_complete(opctx, &entry2.clone(), completion)
             .await
@@ -202,7 +202,9 @@ mod tests {
             .expect("retrieve audit log");
         assert_eq!(audit_log.len(), 2);
         assert_eq!(audit_log[0].request_id, "req-1");
+        assert_eq!(audit_log[0].http_status_code.0, 201);
         assert_eq!(audit_log[1].request_id, "req-2");
+        assert_eq!(audit_log[1].http_status_code.0, 204);
 
         // Only get first entry
         let audit_log = datastore
@@ -254,7 +256,7 @@ mod tests {
             None,
             None,
         );
-        let completion = AuditLogCompletion::new();
+        let completion = AuditLogCompletion::new(201);
 
         let id1 = "1710a22e-b29b-4cfc-9e79-e8c93be187d7";
         let id2 = "5d25e766-e026-44b4-8b42-5f90f43c26bc";

nexus/src/app/audit_log.rs

@@ -3,7 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 use chrono::{DateTime, Utc};
-use dropshot::RequestContext;
+use dropshot::{HttpError, HttpResponse, RequestContext};
 use nexus_db_model::{AuditLogCompletion, AuditLogEntry, AuditLogEntryInit};
 use nexus_db_queries::context::OpContext;
 use omicron_common::api::external::{
@@ -48,12 +48,18 @@ impl super::Nexus {
     }
 
     // set duration and result on an existing entry
-    pub(crate) async fn audit_log_entry_complete(
+    pub(crate) async fn audit_log_entry_complete<R: HttpResponse>(
         &self,
         opctx: &OpContext,
         entry: &AuditLogEntryInit,
+        result: &Result<R, HttpError>,
     ) -> UpdateResult<()> {
-        let update = AuditLogCompletion::new();
+        let status_code = match result {
+            Ok(response) => response.status_code(),
+            Err(error) => error.status_code.as_status(),
+        }
+        .as_u16();
+        let update = AuditLogCompletion::new(status_code);
         self.db_datastore.audit_log_entry_complete(opctx, &entry, update).await
     }
 }

nexus/src/external_api/http_entrypoints.rs

@@ -873,7 +873,8 @@ impl NexusExternalApi for NexusExternalApiImpl {
             }
             .await;
 
-            let _ = nexus.audit_log_entry_complete(&opctx, &audit).await;
+            let _ =
+                nexus.audit_log_entry_complete(&opctx, &audit, &result).await;
             result
         };
         apictx
@@ -6672,7 +6673,8 @@ impl NexusExternalApi for NexusExternalApiImpl {
             }
             .await;
 
-            let _ = nexus.audit_log_entry_complete(&opctx, &audit).await;
+            let _ =
+                nexus.audit_log_entry_complete(&opctx, &audit, &result).await;
 
             result
         };
@@ -6742,7 +6744,8 @@ impl NexusExternalApi for NexusExternalApiImpl {
                 Ok(response)
             }
             .await;
-            let _ = nexus.audit_log_entry_complete(&opctx, &audit).await;
+            let _ =
+                nexus.audit_log_entry_complete(&opctx, &audit, &result).await;
             result
         };
         apictx

nexus/tests/integration_tests/audit_log.rs

@@ -141,17 +141,17 @@ async fn test_audit_log_login_local(ctx: &ControlPlaneTestContext) {
     assert_eq!(e1.request_uri, "/v1/login/test-silo/local");
     assert_eq!(e1.operation_id, "login_local");
     assert_eq!(e1.source_ip, "127.0.0.1");
+    assert_eq!(e1.http_status_code, 401);
     assert!(e1.timestamp >= t1 && e1.timestamp <= t2);
     assert!(e1.time_completed > e1.timestamp);
-    // TODO: assert error result
 
     // Verify second entry (successful login)
     assert_eq!(e2.request_uri, "/v1/login/test-silo/local");
     assert_eq!(e2.operation_id, "login_local");
     assert_eq!(e2.source_ip, "127.0.0.1");
+    assert_eq!(e2.http_status_code, 204);
     assert!(e2.timestamp >= t2 && e2.timestamp <= t3);
     assert!(e2.time_completed > e2.timestamp);
-    // TODO: assert success result
 
     // Time filtering works
     let audit_log = fetch_log(client, t2, Some(t2)).await;

nexus/types/src/external_api/views.rs

@@ -1061,6 +1061,9 @@ pub struct AuditLogEntry {
     /// Time operation completed
     pub time_completed: DateTime<Utc>,
 
+    /// HTTP status code
+    pub http_status_code: u16,
+
     /// Error information if the action failed
     pub error_code: Option<String>,
     pub error_message: Option<String>,

schema/crdb/audit-log/up01.sql

@@ -14,6 +14,7 @@ CREATE TABLE IF NOT EXISTS audit_log (
     -- fields we can only fill in after the operation
     resource_id UUID,
     time_completed TIMESTAMPTZ,
+    http_status_code INT4,
     error_code STRING,
     error_message STRING,
     -- this stuff avoids table scans when filtering and sorting by timestamp

schema/crdb/audit-log/up02.sql

@@ -11,6 +11,7 @@ SELECT
     access_method,
     resource_id,
     time_completed,
+    http_status_code,
     error_code,
     error_message
 FROM audit_log

schema/crdb/dbinit.sql

@@ -4815,6 +4815,7 @@ CREATE TABLE IF NOT EXISTS audit_log (
     -- fields we can only fill in after the operation
     resource_id UUID,
     time_completed TIMESTAMPTZ,
+    http_status_code INT4,
     error_code STRING,
     error_message STRING,
     -- this stuff avoids table scans when filtering and sorting by timestamp
@@ -4849,6 +4850,7 @@ SELECT
     access_method,
     resource_id,
     time_completed,
+    http_status_code,
     error_code,
     error_message
 FROM audit_log