Add a core.audit package emitting one Elastic Common Schema JSON line per
security-relevant action on a dedicated "audit" logger. Only lasuite.*
and entity.target.raw.* extends on ECS core fields. Each event names
the data stream it belongs to (data_stream.*, event.dataset) and carries
a unique event.id.
The audit logs reads the actor, auth method, tenant and network fields from
the request it is given, else from the request being served, which
AuditLogMiddleware keeps in a context variable so that a service needs
no request argument.
A person is identified by primary key, OIDC sub when the account has one
and email domain, with its privileges as user.roles; an internal peer
calling the backend by service.origin.name. The tenant is the
application client id, else that domain. The client IP is DRF's throttle
ident, which now honours a NUM_PROXIES setting.
The middleware also replaces the inbound X-Request-ID with a fresh id,
unless REQUEST_ID_TRUST_HEADER says the ingress overwrites it, and echoes
it in the response and the gunicorn access log. Audit events carry it as
http.request.id, next to the client's user agent.
An action is defined with a dotted name with its default ECS category
and types, validated at import against the types ECS expects in that
category, so a call site only names what was attempted. A category or
types given to audit.log win over them, and a bare dotted name is
accepted too.
Meet declares all of the events core/auditing.py:
- audit.register lists the fields describing a model as a target, an
ECS entity.target, and its ECS entity type. Every target carries its
model name and primary key, so an unregistered one is still
identified, and a user target its OIDC sub.
- audit.register_auth_method names the lasuite.auth.method of a DRF
authentication class
AuditViewMixin audits every response of the CRUD actions a view maps in
audit_actions, and of the extra actions naming theirs with
@action(audit_action=...), from finalize_response: the outcome, reason
and status come from the response. An exception DRF does not handle is recorded
as an internal error before it propagates. The core.audit app also
records Django's login, failed login and logout signals.
Recordings were failing to download in the local stack because of
several small issues stacked together:
* nginx: add a `/media/recordings/` location that authorizes
against `recordings/media-auth/`. Before, every media request
went to `files/media-auth/`, which returned 403 for recording
paths.
* nginx: call `proxy_hide_header Content-Disposition` before
`add_header Content-Disposition "attachment"`. Garage stored the
header as `inline`, which combined with nginx's value into
`inline, attachment` and broke browser downloads.
* frontend: `mediaUrl()` now uses the frontend origin, so
recording links go through the Vite `/media` proxy instead of
hitting Django directly on `:8071`.
* frontend: include the file extension in the download filename.
co-author: cameldev
The development stacks now run Garage instead of MinIO which is
deprecated.
Garage is a bit stricter than MinIO:
- key IDs and secrets must be at least 8 and 16 characters long
- requests must be signed for its region, so every development env now sets
AWS_S3_REGION_NAME=local;
- cross-origin requests are denied unless the bucket CORS rules allow
them, so a one-shot aws-cli container allows the frontend origin to
upload files straight to the bucket.
Include the time taken by each request in the Gunicorn worker
access logs, so we can spot slow endpoints and correlate latency
patterns directly from the logs.
For the coming features we will need to store files on the meet side.
(for instance user backgrounds).
This commits adds a new Model to manage files, and the associated
serializers & viewsets. All are tested.
This work was heavily inspired by the work done by our friends at
https://github.com/suitenumerique/drive
It build on the same architecture design (upload directly to S3 but
download goes through our proxy), but model is much much simplier
(no folders, no file sharing, etc.).
Renamed docker/files/usr/local/etc/gunicorn/impress.py to .../meet.py to match the updated
backend source filenames. This resolves the issue where the Dockerfile was attempting
to copy a non-existent file, causing the build to fail.
This commit introduces a boilerplate inspired by https://github.com/numerique-gouv/impress.
The code has been cleaned to remove unnecessary Impress logic and dependencies.
Changes made:
- Removed Minio, WebRTC, and create bucket from the stack.
- Removed the Next.js frontend (it will be replaced by Vite).
- Cleaned up impress-specific backend logics.
The whole stack remains functional:
- All tests pass.
- Linter checks pass.
- Agent Connexion sources are already set-up.
Why clear out the code?
To adhere to the KISS principle, we aim to maintain a minimalist codebase. Cloning Impress
allowed us to quickly inherit its code quality tools and deployment configurations for staging,
pre-production, and production environments.
What’s broken?
- The tsclient is not functional anymore.
- Some make commands need to be fixed.
- Helm sources are outdated.
- Naming across the project sources are inconsistent (impress, visio, etc.)
- CI is not configured properly.
This list might be incomplete. Let's grind it.
briquet