100 lines
3.2 KiB
Python
100 lines
3.2 KiB
Python
"""Create append-only, redacted audit event storage."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision = "0005_audit_events"
|
|
down_revision = "0004_space_data_policy"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
_TRIGGER_FUNCTION = "prevent_audit_event_mutation"
|
|
_ROW_TRIGGER = "trg_audit_events_append_only_row"
|
|
_TRUNCATE_TRIGGER = "trg_audit_events_append_only_truncate"
|
|
|
|
|
|
def upgrade() -> None:
|
|
"""Create audit storage and reject database-level mutation attempts."""
|
|
|
|
op.execute(sa.text("CREATE SCHEMA IF NOT EXISTS audit"))
|
|
op.create_table(
|
|
"audit_events",
|
|
sa.Column("id", sa.Uuid(), primary_key=True),
|
|
sa.Column("workspace_id", sa.Uuid(), nullable=False),
|
|
sa.Column("event_type", sa.String(128), nullable=False),
|
|
sa.Column("occurred_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("trace_id", sa.String(128), nullable=False),
|
|
sa.Column("correlation_id", sa.String(128), nullable=True),
|
|
sa.Column("actor_id", sa.Uuid(), nullable=True),
|
|
sa.Column("application_id", sa.Uuid(), nullable=True),
|
|
sa.Column("resource_type", sa.String(128), nullable=True),
|
|
sa.Column("resource_id", sa.Uuid(), nullable=True),
|
|
sa.Column("details", sa.JSON(), nullable=False),
|
|
sa.ForeignKeyConstraint(
|
|
["workspace_id"], ["control.workspaces.id"], ondelete="RESTRICT"
|
|
),
|
|
schema="audit",
|
|
)
|
|
op.create_index(
|
|
"ix_audit_events_workspace_occurred",
|
|
"audit_events",
|
|
["workspace_id", "occurred_at"],
|
|
schema="audit",
|
|
)
|
|
op.create_index(
|
|
"ix_audit_events_workspace_type",
|
|
"audit_events",
|
|
["workspace_id", "event_type"],
|
|
schema="audit",
|
|
)
|
|
op.execute(
|
|
sa.text(
|
|
f"""
|
|
CREATE FUNCTION audit.{_TRIGGER_FUNCTION}()
|
|
RETURNS trigger
|
|
LANGUAGE plpgsql
|
|
AS $$
|
|
BEGIN
|
|
RAISE EXCEPTION 'audit events are append-only';
|
|
END;
|
|
$$
|
|
"""
|
|
)
|
|
)
|
|
op.execute(
|
|
sa.text(
|
|
f"""
|
|
CREATE TRIGGER {_ROW_TRIGGER}
|
|
BEFORE UPDATE OR DELETE ON audit.audit_events
|
|
FOR EACH ROW EXECUTE FUNCTION audit.{_TRIGGER_FUNCTION}()
|
|
"""
|
|
)
|
|
)
|
|
op.execute(
|
|
sa.text(
|
|
f"""
|
|
CREATE TRIGGER {_TRUNCATE_TRIGGER}
|
|
BEFORE TRUNCATE ON audit.audit_events
|
|
FOR EACH STATEMENT EXECUTE FUNCTION audit.{_TRIGGER_FUNCTION}()
|
|
"""
|
|
)
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
"""Remove only the audit objects introduced by this migration."""
|
|
|
|
op.execute(sa.text(f"DROP TRIGGER IF EXISTS {_TRUNCATE_TRIGGER} ON audit.audit_events"))
|
|
op.execute(sa.text(f"DROP TRIGGER IF EXISTS {_ROW_TRIGGER} ON audit.audit_events"))
|
|
op.drop_index(
|
|
"ix_audit_events_workspace_type", table_name="audit_events", schema="audit"
|
|
)
|
|
op.drop_index(
|
|
"ix_audit_events_workspace_occurred", table_name="audit_events", schema="audit"
|
|
)
|
|
op.drop_table("audit_events", schema="audit")
|
|
op.execute(sa.text(f"DROP FUNCTION IF EXISTS audit.{_TRIGGER_FUNCTION}()"))
|
|
op.execute(sa.text("DROP SCHEMA IF EXISTS audit"))
|