feature: 审计事件支持上报 scope_type 和 scope_id #22

TencentBlueKing · Nov 10, 2023 · 31e4929 · 31e4929
1 parent 44623cc
commit 31e4929
Show file tree

Hide file tree

Showing 30 changed files with 540 additions and 47 deletions.
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/AuditClient.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/AuditClient.java
@@ -59,9 +59,10 @@ public void stopAudit() {
 
             // 输出审计事件
             List<AuditEvent> auditEvents = currentAuditContext.getEvents();
-            if (CollectionUtils.isNotEmpty(auditEvents)) {
-                eventExporter.export(auditEvents);
+            if (CollectionUtils.isEmpty(auditEvents)) {
+                return;
             }
+            eventExporter.export(auditEvents);
         } finally {
             LazyAuditContextHolder.get().reset();
         }

diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/DefaultAuditEventBuilder.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/DefaultAuditEventBuilder.java
@@ -41,13 +41,29 @@ public List<AuditEvent> build() {
                 Object originInstance = safeGetElement(originInstanceList, index);
                 Object instance = safeGetElement(instanceList, index);
                 Map<String, Object> attributes = buildMergedEventAttributes(instanceId, instanceName);
-                AuditEvent auditEvent = buildAuditEvent(instanceId, instanceName, originInstance, instance,
-                        attributes, actionAuditContext.getExtendData());
+                AuditEvent auditEvent = buildAuditEvent(
+                        instanceId,
+                        instanceName,
+                        originInstance,
+                        instance,
+                        attributes,
+                        actionAuditContext.getExtendData(),
+                        actionAuditContext.getScopeType(),
+                        actionAuditContext.getScopeId()
+                );
                 events.add(auditEvent);
             }
         } else {
-            AuditEvent auditEvent = buildAuditEvent(null, null, null, null,
-                    actionAuditContext.getAttributes(), actionAuditContext.getExtendData());
+            AuditEvent auditEvent = buildAuditEvent(
+                    null,
+                    null,
+                    null,
+                    null,
+                    actionAuditContext.getAttributes(),
+                    actionAuditContext.getExtendData(),
+                    actionAuditContext.getScopeType(),
+                    actionAuditContext.getScopeId()
+            );
             events.add(auditEvent);
         }
         return events;
@@ -69,12 +85,14 @@ protected <T> T safeGetElement(List<T> list, int index) {
         return list != null && list.size() > index ? list.get(index) : null;
     }
 
-    protected AuditEvent buildAuditEvent(String instanceId,
-                                         String instanceName,
-                                         Object originInstance,
-                                         Object instance,
-                                         Map<String, Object> attributes,
-                                         Map<String, Object> extendData) {
+    private AuditEvent buildAuditEvent(String instanceId,
+                                       String instanceName,
+                                       Object originInstance,
+                                       Object instance,
+                                       Map<String, Object> attributes,
+                                       Map<String, Object> extendData,
+                                       String scopeType,
+                                       String scopeId) {
         AuditEvent auditEvent = buildBasicAuditEvent();
 
         // 审计记录 - 原始数据
@@ -86,6 +104,8 @@ protected AuditEvent buildAuditEvent(String instanceId,
         auditEvent.setInstanceName(instanceName);
         auditEvent.setContent(resolveAttributes(actionAuditContext.getContent(), attributes));
         auditEvent.setExtendData(extendData);
+        auditEvent.setScopeType(scopeType);
+        auditEvent.setScopeId(scopeId);
         return auditEvent;
     }
 

diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/ActionAuditContext.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/ActionAuditContext.java
@@ -140,4 +140,13 @@ default AuditRunnable wrapActionRunnable(AuditRunnable auditRunnable) {
 
     Object getExtendDataValue(String key);
 
+    ActionAuditContext setScopeType(String scopeType);
+
+    ActionAuditContext setScopeId(String scopeType);
+
+    String getScopeType();
+
+    String getScopeId();
+
+
 }
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/ActionAuditContextBuilder.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/ActionAuditContextBuilder.java
@@ -50,6 +50,16 @@ public class ActionAuditContextBuilder {
      */
     private Map<String, Object> attributes = new HashMap<>();
 
+    /**
+     * 管理空间类型（比如 project/biz等）
+     */
+    private String scopeType;
+
+    /**
+     * 管理空间ID（比如项目ID、cmdb业务ID）
+     */
+    private String scopeId;
+
     public static ActionAuditContextBuilder builder(String actionId) {
         return new ActionAuditContextBuilder(actionId);
     }
@@ -127,8 +137,18 @@ public ActionAuditContextBuilder addAttribute(String attrName, Object attrValue)
         return this;
     }
 
+    public ActionAuditContextBuilder setScopeType(String scopeType) {
+        this.scopeType = scopeType;
+        return this;
+    }
+
+    public ActionAuditContextBuilder setScopeId(String scopeId) {
+        this.scopeId = scopeId;
+        return this;
+    }
+
     public ActionAuditContext build() {
         return new SdkActionAuditContext(actionId, resourceType, instanceIdList, instanceNameList,
-                originInstanceList, instanceList, content, eventBuilder, attributes);
+                originInstanceList, instanceList, content, eventBuilder, attributes, scopeType, scopeId);
     }
 }
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/InvalidActionAuditContext.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/InvalidActionAuditContext.java
@@ -152,4 +152,24 @@ public Map<String, Object> getExtendData() {
     public Object getExtendDataValue(String key) {
         return null;
     }
+
+    @Override
+    public ActionAuditContext setScopeType(String scopeType) {
+        return this;
+    }
+
+    @Override
+    public ActionAuditContext setScopeId(String scopeType) {
+        return this;
+    }
+
+    @Override
+    public String getScopeType() {
+        return null;
+    }
+
+    @Override
+    public String getScopeId() {
+        return null;
+    }
 }
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/SdkActionAuditContext.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/SdkActionAuditContext.java
@@ -81,6 +81,16 @@ public class SdkActionAuditContext implements ActionAuditContext {
      */
     private boolean disabled;
 
+    /**
+     * 管理空间类型（比如 project/biz等）
+     */
+    private String scopeType;
+
+    /**
+     * 管理空间ID（比如项目ID、cmdb业务ID）
+     */
+    private String scopeId;
+
     SdkActionAuditContext(String actionId,
                           String resourceType,
                           List<String> instanceIdList,
@@ -89,7 +99,9 @@ public class SdkActionAuditContext implements ActionAuditContext {
                           List<Object> instanceList,
                           String content,
                           Class<? extends AuditEventBuilder> eventBuilderClass,
-                          Map<String, Object> attributes) {
+                          Map<String, Object> attributes,
+                          String scopeType,
+                          String scopeId) {
         this.actionId = actionId;
         this.startTime = System.currentTimeMillis();
         this.resourceType = resourceType;
@@ -100,6 +112,8 @@ public class SdkActionAuditContext implements ActionAuditContext {
         this.content = content;
         this.eventBuilderClass = eventBuilderClass == null ? DefaultAuditEventBuilder.class : eventBuilderClass;
         this.attributes = (attributes == null ? new HashMap<>() : attributes);
+        this.scopeType = scopeType;
+        this.scopeId = scopeId;
     }
 
     @Override
@@ -291,6 +305,28 @@ public Object getExtendDataValue(String key) {
         return extendData == null ? null : extendData.get(key);
     }
 
+    @Override
+    public ActionAuditContext setScopeType(String scopeType) {
+        this.scopeType = scopeType;
+        return this;
+    }
+
+    @Override
+    public ActionAuditContext setScopeId(String scopeId) {
+        this.scopeId = scopeId;
+        return this;
+    }
+
+    @Override
+    public String getScopeType() {
+        return this.scopeType;
+    }
+
+    @Override
+    public String getScopeId() {
+        return this.scopeId;
+    }
+
     @Override
     public String toString() {
         return new StringJoiner(", ", SdkActionAuditContext.class.getSimpleName() + "[", "]")
@@ -308,6 +344,8 @@ public String toString() {
                 .add("events=" + events)
                 .add("disabled=" + disabled)
                 .add("extendData=" + extendData)
+                .add("scopeType=" + scopeType)
+                .add("scopeId=" + scopeId)
                 .toString();
     }
 }
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/SdkAuditContext.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/context/SdkAuditContext.java
@@ -4,9 +4,12 @@
 import com.tencent.bk.audit.constants.AuditEventKey;
 import com.tencent.bk.audit.constants.Constants;
 import com.tencent.bk.audit.constants.UserIdentifyTypeEnum;
+import com.tencent.bk.audit.filter.AuditPostFilter;
+import com.tencent.bk.audit.filter.AuditPostFilters;
 import com.tencent.bk.audit.model.AuditEvent;
 import com.tencent.bk.audit.model.AuditHttpRequest;
 import com.tencent.bk.audit.utils.EventIdGenerator;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 
 import java.util.*;
@@ -111,6 +114,10 @@ public void addActionAuditContext(ActionAuditContext actionAuditContext) {
     public void end() {
         this.endTime = System.currentTimeMillis();
         buildAuditEvents();
+        List<AuditPostFilter> filters = AuditPostFilters.getFilters();
+        if (CollectionUtils.isNotEmpty(filters)) {
+            filters.forEach(filter -> this.events.forEach(filter::map));
+        }
     }
 
     private void buildAuditEvents() {

diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/filter/AuditPostFilter.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/filter/AuditPostFilter.java
@@ -0,0 +1,18 @@
+package com.tencent.bk.audit.filter;
+
+import com.tencent.bk.audit.model.AuditEvent;
+
+/**
+ * 审计结束之前触发的 Filter，允许修改最终的审计事件。
+ */
+public interface AuditPostFilter {
+    /**
+     * 修改审计事件
+     *
+     * @param auditEvent 审计事件
+     * @return 修改之后的审计事件
+     */
+    default AuditEvent map(AuditEvent auditEvent) {
+        return auditEvent;
+    }
+}
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/filter/AuditPostFilters.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/filter/AuditPostFilters.java
@@ -0,0 +1,24 @@
+package com.tencent.bk.audit.filter;
+
+import lombok.extern.slf4j.Slf4j;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * AuditPostFilter 管理
+ */
+@Slf4j
+public class AuditPostFilters {
+    private static final List<AuditPostFilter> filters = new ArrayList<>();
+
+    public static void addFilter(AuditPostFilter filter) {
+        log.info("Add AuditPostFilter: {}", filter);
+        filters.add(filter);
+    }
+
+    public static List<AuditPostFilter> getFilters() {
+        return filters;
+    }
+
+}
diff --git a/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/model/AuditEvent.java b/bk-audit-java-sdk/src/main/java/com/tencent/bk/audit/model/AuditEvent.java
@@ -28,7 +28,7 @@ public class AuditEvent {
     @JsonProperty("event_content")
     private String content;
 
-    /**
+    /** 6；lL2
      * 请求ID
      */
     @JsonProperty("request_id")
@@ -150,6 +150,17 @@ public class AuditEvent {
 
     @JsonProperty("audit_event_signature")
     private String auditEventSignature = Constants.AUDIT_EVENT_SIGNATURE;
+    /**
+     * 管理空间类型（比如 project/biz等）
+     */
+    @JsonProperty("scope_type")
+    private String scopeType;
+
+    /**
+     * 管理空间ID（比如项目ID、cmdb业务ID）
+     */
+    @JsonProperty("scope_id")
+    private String scopeId;
 
     public AuditEvent() {
     }