Skip to content

fix(kas): populate rewrap audit log #2861

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
c-r33d merged 4 commits into from
Nov 3, 2025
Merged

fix(kas): populate rewrap audit log #2861

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a2944f4
fix(kas): Rewrap audit records.
c-r33d Oct 30, 2025
38689c6
add tests.
c-r33d Oct 31, 2025
e571f78
remove test files.
c-r33d Oct 31, 2025
14f288b
Merge branch 'main' into fix/populate-rewrap-audit-log
c-r33d Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions service/kas/access/rewrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,9 @@ type kaoResult struct {
// Optional: Present for EC wrapped responses
EphemeralPublicKey []byte
RequiredObligations []string

// Only populated for Nano auditing, since policy is encrypted
KeyID string
}

// From policy ID to KAO ID to result
Expand Down Expand Up @@ -800,6 +803,7 @@ func (p *Provider) tdf3Rewrap(ctx context.Context, requests []*kaspb.UnsignedRew
TDFFormat: "tdf3",
Algorithm: req.GetAlgorithm(),
PolicyBinding: policyBinding,
KeyID: kao.GetKeyAccessObject().GetKid(),
}

if !access {
Expand Down Expand Up @@ -901,6 +905,7 @@ func (p *Provider) nanoTDFRewrap(ctx context.Context, requests []*kaspb.Unsigned
IsSuccess: access,
TDFFormat: "Nano",
Algorithm: req.GetAlgorithm(),
KeyID: kaoInfo.KeyID,
}

if !access {
Expand Down Expand Up @@ -992,8 +997,9 @@ func (p *Provider) verifyNanoRewrapRequests(ctx context.Context, req *kaspb.Unsi
return nil, results
}
results[kao.GetKeyAccessObjectId()] = kaoResult{
ID: kao.GetKeyAccessObjectId(),
DEK: symmetricKey,
ID: kao.GetKeyAccessObjectId(),
DEK: symmetricKey,
KeyID: kid,
}
return policy, results
}
Expand Down
65 changes: 38 additions & 27 deletions service/logger/audit/logger_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,36 @@ import (
"github.com/opentdf/platform/protocol/go/authorization"
)

// Params
var rewrapAttrs = []string{
"https://example1.com",
"https://example2.com",
}

const rewrapAttrsJSON = `["https://example1.com", "https://example2.com"]`

var rewrapParams = RewrapAuditEventParams{
Policy: KasPolicy{
UUID: uuid.New(),
Body: KasPolicyBody{
DataAttributes: []KasAttribute{
{URI: rewrapAttrs[0]},
{URI: rewrapAttrs[1]},
},
},
},
TDFFormat: "test-tdf-format",
Algorithm: "test-algorithm",
PolicyBinding: "test-policy-binding",
KeyID: "r1",
}

var policyCRUDParams = PolicyEventParams{
ActionType: ActionTypeUpdate,
ObjectID: "test-object-id",
ObjectType: ObjectTypeKeyObject,
}

func createTestLogger() (*Logger, *bytes.Buffer) {
var buf bytes.Buffer

Expand Down Expand Up @@ -66,29 +96,6 @@ func extractLogEntry(t *testing.T, logBuffer *bytes.Buffer) (logEntryStructure,
return entry, entryTime
}

// Params

var rewrapParams = RewrapAuditEventParams{
Policy: KasPolicy{
UUID: uuid.New(),
Body: KasPolicyBody{
DataAttributes: []KasAttribute{
{URI: "https://example1.com"},
{URI: "https://example2.com"},
},
},
},
TDFFormat: "test-tdf-format",
Algorithm: "test-algorithm",
PolicyBinding: "test-policy-binding",
}

var policyCRUDParams = PolicyEventParams{
ActionType: ActionTypeUpdate,
ObjectID: "test-object-id",
ObjectType: ObjectTypeKeyObject,
}

func TestAuditRewrapSuccess(t *testing.T) {
l, buf := createTestLogger()

Expand All @@ -104,7 +111,7 @@ func TestAuditRewrapSuccess(t *testing.T) {
"name": "",
"attributes": {
"assertions": [],
"attrs": [],
"attrs": %s,
"permissions": []
}
},
Expand All @@ -118,7 +125,7 @@ func TestAuditRewrapSuccess(t *testing.T) {
},
"eventMetaData": {
"algorithm": "%s",
"keyID": "",
"keyID": "%s",
"policyBinding": "%s",
"tdfFormat": "%s"
},
Expand All @@ -134,8 +141,10 @@ func TestAuditRewrapSuccess(t *testing.T) {
}
`,
rewrapParams.Policy.UUID.String(),
rewrapAttrsJSON,
TestActorID,
rewrapParams.Algorithm,
rewrapParams.KeyID,
rewrapParams.PolicyBinding,
rewrapParams.TDFFormat,
TestUserAgent,
Expand Down Expand Up @@ -168,7 +177,7 @@ func TestAuditRewrapFailure(t *testing.T) {
"name": "",
"attributes": {
"assertions": [],
"attrs": [],
"attrs": %s,
"permissions": []
}
},
Expand All @@ -182,7 +191,7 @@ func TestAuditRewrapFailure(t *testing.T) {
},
"eventMetaData": {
"algorithm": "%s",
"keyID": "",
"keyID": "%s",
"policyBinding": "%s",
"tdfFormat": "%s"
},
Expand All @@ -198,8 +207,10 @@ func TestAuditRewrapFailure(t *testing.T) {
}
`,
rewrapParams.Policy.UUID.String(),
rewrapAttrsJSON,
TestActorID,
rewrapParams.Algorithm,
rewrapParams.KeyID,
rewrapParams.PolicyBinding,
rewrapParams.TDFFormat,
TestUserAgent,
Expand Down
14 changes: 10 additions & 4 deletions service/logger/audit/rewrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ type RewrapAuditEventParams struct {
TDFFormat string
Algorithm string
PolicyBinding string
KeyID string
}

func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams) (*EventObject, error) {
Expand All @@ -36,14 +37,19 @@ func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams)
auditEventActionResult = ActionResultSuccess
}

attrFQNS := make([]string, len(params.Policy.Body.DataAttributes))
for i, attr := range params.Policy.Body.DataAttributes {
attrFQNS[i] = attr.URI
}

return &EventObject{
Object: auditEventObject{
Type: ObjectTypeKeyObject,
ID: params.Policy.UUID.String(),
Attributes: eventObjectAttributes{
Assertions: []string{},
Attrs: []string{},
Permissions: []string{},
Assertions: []string{}, // Assertions aren't passed in the rewrap policy body
Attrs: attrFQNS,
Permissions: []string{}, // Currently always empty
},
},
Action: eventAction{
Expand All @@ -55,7 +61,7 @@ func CreateRewrapAuditEvent(ctx context.Context, params RewrapAuditEventParams)
Attributes: make([]any, 0),
},
EventMetaData: auditEventMetadata{
"keyID": "", // TODO: keyID once implemented
"keyID": params.KeyID,
"policyBinding": params.PolicyBinding,
"tdfFormat": params.TDFFormat,
"algorithm": params.Algorithm,
Expand Down
15 changes: 11 additions & 4 deletions service/logger/audit/rewrap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,18 @@ import (
)

func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
attrs := []string{
"https://example1.com",
"https://example2.com",
}
keyID := "r1"

kasPolicy := KasPolicy{
UUID: uuid.New(),
Body: KasPolicyBody{
DataAttributes: []KasAttribute{
{URI: "https://example1.com"},
{URI: "https://example2.com"},
{URI: attrs[0]},
{URI: attrs[1]},
},
Dissem: []string{"dissem1", "dissem2"},
},
Expand All @@ -25,6 +31,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
TDFFormat: TestTDFFormat,
Algorithm: TestAlgorithm,
PolicyBinding: TestPolicyBinding,
KeyID: keyID,
}

event, err := CreateRewrapAuditEvent(createTestContext(), params)
Expand All @@ -37,7 +44,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
ID: kasPolicy.UUID.String(),
Attributes: eventObjectAttributes{
Assertions: []string{},
Attrs: []string{},
Attrs: attrs,
Permissions: []string{},
},
}
Expand All @@ -62,7 +69,7 @@ func TestCreateRewrapAuditEventHappyPath(t *testing.T) {
}

expectedEventMetaData := auditEventMetadata{
"keyID": "",
"keyID": keyID,
"policyBinding": TestPolicyBinding,
"tdfFormat": TestTDFFormat,
"algorithm": TestAlgorithm,
Expand Down
Loading