audit: record dashboard actions and token lifecycle

已关闭
  • 哪里不对？
#994 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
30/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
活跃
技术栈
grpc, rust
领域
authentication, backend-api-design, databases, security

调研方向

Start by reading dashboard/auth/middleware.rs, dashboard/auth/gate.rs, and grpc/audit/layer.rs to compare authentication and audit coverage. Trace flexiq-server token create|revoke and the three audit_log backends, then determine whether SDK shells are in scope. Done means the scope, principal attribution, migration impact, and covered state-changing actions are agreed and tested.

由索引模型根据 Issue 内容生成。

描述

area/server dashboard P2 security

Follow-up to #840 (PR #991).

The audit trail covers token-authorised calls on the gRPC door and its JSON facade. It does not cover changes made from the dashboard: pause a queue, replay or purge dead letters, drain a worker, edit periodic tasks or overrides, mint or revoke tokens, change settings. Those requests authenticate with a session, not a token, so today nothing records who made them.

Design points:

  • Attribution. Record the dashboard user (username or user id) rather than a token id. Either add a principal_kind (token / user) to audit_log, or reuse token_id / principal with a clear convention. Changing audit_log means a migration on all three backends.
  • Choke point. The dashboard has its own gate (dashboard/auth/middleware.rs, dashboard/auth/gate.rs). A layer there mirroring grpc/audit/layer.rs would cover every state-changing route by default.
  • Token lifecycle. Minting and revoking tokens from the dashboard, and from flexiq-server token create|revoke, are the most security-relevant events and are not recorded today.
  • Shells. Each SDK shell carries its own dashboard implementation. Decide whether this is a flexiq-server-only feature or a cross-SDK contract.
主要语言
Rust
星标
20
派生
2
平均合并
1 天 1 小时
30 天内合并 PR
11

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ByteVeda/flexiq 的其他 Issue

查看 ByteVeda/flexiq 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。