Class: CommandTower::Configuration::Registry::Audit::Config

Inherits:
Object
  • Object
show all
Defined in:
lib/command_tower/configuration/registry/audit/config.rb

Constant Summary collapse

PLATFORM_EVENTS = 
{
  user_registered: {
    label: "User registered",
    tags: %w[identity account registration],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  role_assigned: {
    label: "Role assigned",
    tags: %w[identity rbac authorization],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[role],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  role_revoked: {
    label: "Role revoked",
    tags: %w[identity rbac authorization],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[role],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  password_changed: {
    label: "Password changed",
    tags: %w[identity password security],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  account_deleted: {
    label: "Account deleted",
    tags: %w[identity account deletion security],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  email_verified: {
    label: "Email verified",
    tags: %w[identity verification email],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  admin_user_name_changed: {
    label: "Admin user name changed",
    tags: %w[identity admin users],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[first_name last_name],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  admin_user_username_changed: {
    label: "Admin user username changed",
    tags: %w[identity admin users],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[username],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  admin_user_email_changed: {
    label: "Admin user email changed",
    tags: %w[identity admin users email],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  admin_user_email_validation_changed: {
    label: "Admin user email validation changed",
    tags: %w[identity admin users verification email],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[email_validated],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  phone_updated: {
    label: "Phone updated",
    tags: %w[identity phone profile],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: %i[phone],
    allowed_changes: %i[phone],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  phone_cleared: {
    label: "Phone cleared",
    tags: %w[identity phone profile],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: %i[phone],
    allowed_changes: %i[phone],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  phone_verified: {
    label: "Phone verified",
    tags: %w[identity verification phone],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  announcement_produced: {
    label: "Announcement produced",
    tags: %w[messaging announcement admin],
    enabled: true,
    enablement_configurable: false,
    user_history: false,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: false,
    affected_user_required: false
  },
  session_created: {
    label: "Session created",
    tags: %w[authentication session security],
    enabled: true,
    enablement_configurable: true,
    user_history: false,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :ninety_days,
    subject_required: false,
    affected_user_required: true
  },
  session_cleared: {
    label: "Session cleared",
    tags: %w[authentication session security],
    enabled: false,
    enablement_configurable: true,
    user_history: false,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :ninety_days,
    subject_required: false,
    affected_user_required: true
  },
  login_failed: {
    label: "Login failed",
    tags: %w[authentication login security],
    enabled: false,
    enablement_configurable: true,
    user_history: false,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :ninety_days,
    subject_required: false,
    affected_user_required: false
  },
  impersonation_started: {
    label: "Impersonation started",
    tags: %w[authentication impersonation security],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: [],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  },
  impersonation_ended: {
    label: "Impersonation ended",
    tags: %w[authentication impersonation security],
    enabled: true,
    enablement_configurable: false,
    user_history: true,
    sensitive_fields: [],
    allowed_changes: %i[reason],
    retention: :permanent,
    subject_required: true,
    subject_type: "User",
    affected_user_required: true,
    global_visible_in_host_scope: true
  }
}.freeze

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Config

Returns a new instance of Config.



271
272
273
274
275
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 271

def initialize
  @definitions = {}
  @finalized = false
  seed_platform_events!
end

Instance Method Details

#definitions ⇒ Object 



337
338
339
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 337

def definitions
  @definitions.dup.freeze
end

#event(name, owner: :host) {|definition| ... } ⇒ Object

Yields:

  • (definition)

Raises:



277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 277

def event(name, owner: :host)
  raise CommandTower::Audit::FrozenRegistryError, "audit registry is frozen" if @finalized

  normalized = normalize_name!(name)
  existing = @definitions[normalized]
  if existing
    if existing.owner == :command_tower && owner == :host
      raise CommandTower::Audit::HostOverrideError,
        "host cannot redefine CommandTower-owned audit event #{normalized}"
    end

    raise CommandTower::Audit::DuplicateEventError,
      "audit event #{normalized} is already registered"
  end

  definition = EventDefinition.new
  yield definition if block_given?
  definition.owner = owner
  definition.validate_policy!(name: normalized)
  @definitions[normalized] = definition
  definition
end

#fetch(name) ⇒ Object 



320
321
322
323
324
325
326
327
328
329
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 320

def fetch(name)
  normalized = normalize_name!(name)
  definition = @definitions[normalized]
  if definition.nil?
    raise CommandTower::Audit::UnregisteredEventError,
      "audit event #{normalized} is not registered"
  end

  definition
end

#finalize! ⇒ Object 



341
342
343
344
345
346
347
348
349
350
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 341

def finalize!
  @definitions.each_value do |definition|
    next unless definition.respond_to?(:class_composer_freeze_objects!)

    definition.class_composer_freeze_objects!(behavior: :raise, children: true)
  end
  @definitions.freeze
  @finalized = true
  self
end

#finalized? ⇒ Boolean

Returns:

  • (Boolean) 


352
353
354
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 352

def finalized?
  @finalized
end

#registered?(name) ⇒ Boolean

Returns:

  • (Boolean) 


331
332
333
334
335
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 331

def registered?(name)
  @definitions.key?(normalize_name!(name))
rescue CommandTower::Audit::InvalidEventNameError
  false
end

#reset_host_definitions! ⇒ Object 



356
357
358
359
360
361
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 356

def reset_host_definitions!
  thaw_for_test!
  @definitions.delete_if { |_name, definition| definition.owner == :host }
  restore_platform_enablement!
  self
end

#set_enabled!(name, value) ⇒ Object

Raises:



300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
 
# File 'lib/command_tower/configuration/registry/audit/config.rb', line 300

def set_enabled!(name, value)
  raise CommandTower::Audit::FrozenRegistryError, "audit registry is frozen" if @finalized
  unless [true, false].include?(value)
    raise CommandTower::Audit::InvalidEventDefinitionError, "enabled must be true or false"
  end

  definition = fetch(name)
  if definition.owner != :command_tower
    raise CommandTower::Audit::HostOverrideError,
      "set_enabled! is only for CommandTower-owned audit events"
  end
  unless definition.enablement_configurable?
    raise CommandTower::Audit::EnablementNotConfigurableError,
      "audit event #{normalize_name!(name)} enablement is not configurable"
  end

  definition.enabled = value
  definition
end