179 logVaultAccess

v1/resources/vault_record.cfc

@@ -56,9 +56,9 @@
 		</cfif>
 		
 		<!--- <cfdump var=#local.qCurrentState#/><cfabort/> --->
-		
+		<cfset var vaultUrl=""/>
 		<cftry>		
-			<cfset var vaultUrl=""/>
+			
 			<cfset var instanceData=#deserializeJson(local.qCurrentState.instance_data)#/>
 			<cfif structKeyExists(instanceData,"vaultUrl")>
 				<cfset vaultUrl=instanceData.vaultUrl/>	<!--- v001 --->
@@ -120,6 +120,16 @@
 			</cfcatch>
 		</cftry>
 		
+		<!--- логируем успешную попытку доступа. (если логировать сначала - неизвестен результат. *** Можно в catch логировать неуспешный --->
+		<cfset logVaultAccess(
+			this.iamUrl,
+			request.auth_header,
+			arguments.instanceUid,
+			arguments.secretName,
+			vaultUrl,			
+			arguments.login,
+			arguments.clientID,
+			arguments.isImpersonated)/>
 		
 		<cfset var out = structNew("linked")/>
 		<cfset "out.name" = #arguments.secretName#/>
@@ -127,6 +137,73 @@
 		<cfset "out.queryDurationMs"=getTickCount() - request.startTickCount/>	
 		<cfset "out.runDurationMs"=getTickCount() - request.startTickCount/>
 		<cfreturn representationOf(out) />
+	</cffunction>
+
+	<cffunction name="logVaultAccess" returntype="void">
+		<cfargument name="iamUrl" type="string" required=true hint=""/>
+		<cfargument name="authHeader" type="string" required=true hint="type:string"/>
+		<cfargument name="instanceUid" type="string" required=true hint="type:UUID"/>
+		<cfargument name="secretName" type="string" required=true hint="type:string"/>
+		<cfargument name="vaultUrl" type="string" required=true hint="type:string"/>		
+		<cfargument name="login" type="string" required=true hint="type:string"/>
+		<cfargument name="wz" type="string" required=true hint="type:string WZ"/>
+		<cfargument name="isImpersonated" type="string" required=true hint="type:boolean"/>
+		
+		<cftry>
+		<cfset var local={}/>
+		<!--- расшифруем некоторые данные пользователя для читабельности --->
+		<!--- нужно еще учесть имперсонирование --->
+<!--- 		<cfquery name="local.qUsr" result="local.result">
+			select 
+			u.usr_id
+			u.login
+			u.email
+			k.contragent_id
+			k.external_uid::text as external_uid
+			k.contragent
+			from usr u 
+			left outer join contragent k on (u.contragent_id=k.contragent_id)
+			where u.usr_id=<cfqueryparam cfsqltype="cf_sql_integer" value=#ARGUMENTS.usrId#/>
+		</cfquery> --->
+		
+		
+			<cfset var msg = {
+				"event_type": "credentials_access",
+				"ip_address": "#CGI.REMOTE_ADDR#",
+				"user_agent": "#CGI.HTTP_USER_AGENT#",
+				"metadata": {
+					"credentials_type": "instance_secret",
+					"vault_url": "#arguments.vaultUrl#",
+					"secretName": "#arguments.secretName#",
+					"action": "view",
+					"instance_uid": "#arguments.instanceUid#",
+					"environment": "#getStand()#",
+					"usr_id": "#arguments.usrId#",
+					"contragent_id": "#arguments.contragentId#",
+					"login": "#arguments.login#",
+					"wz": "#arguments.wz#",
+					"isImpersonated": "#arguments.isImpersonated#"
+				}
+			}/>
+			<!--- <cfdump var=#msg#/><cfabort/> --->
+			
+			<cfhttp method="post" 
+				url="#arguments.iamUrl#" 
+				timeout="3"
+				charset="utf-8"	
+				result="local.res"
+			>				
+				<cfhttpparam type="HEADER" name="Authorization" value="#arguments.authHeader#">
+				<cfhttpparam type="HEADER" name="Content-Type" value="application/json"/>
+				<cfhttpparam type="BODY" value="#serializeJson(msg)#"/>					
+			</cfhttp>
+		
+			<!--- <cfdump var=#local.res#/><cfabort/> --->
+			<cfcatch type="any">
+				<cfrethrow/><!--- на этапе отладки лучше тут падать --->
+			</cfcatch>
+		</cftry>
+		
 	</cffunction>	
 
 </cfcomponent>