a2096c6f68
Introduce a dedicated `audit` log channel (daily rotation, configurable retention via LOG_AUDIT_DAYS) and a small `auditLog()` / `auditLogWebhookFailure()` helper used to record state-changing API operations and webhook events. Instrumented: - API mutation endpoints (create / update / delete / start / stop / restart) across applications, services, databases (incl. backups, env vars, storage), servers, projects + environments, scheduled tasks, private keys, GitHub apps, cloud provider tokens, Hetzner server provisioning, instance enable/disable. - Webhook signature verification outcomes for GitHub, GitLab, Bitbucket, Gitea and Stripe, plus the Sentinel push endpoint. - Authentication and authorization outcomes via the global exception handler and the `ApiAbility` middleware (unauthenticated, ability-denied, policy-denied). The helper is wrapped in try/catch so logging failures never affect the request path. Successful operations log at `info`; suspicious/denied requests log at `warning`. Operators wanting a failures-only feed can set `LOG_AUDIT_LEVEL=warning`. Includes a feature test suite covering the helper, the webhook providers and the new auth/authorization log paths. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
39 lines
1.2 KiB
PHP
39 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Illuminate\Auth\AuthenticationException;
|
|
use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;
|
|
|
|
class ApiAbility extends CheckForAnyAbility
|
|
{
|
|
public function handle($request, $next, ...$abilities)
|
|
{
|
|
try {
|
|
if ($request->user()->tokenCan('root')) {
|
|
return $next($request);
|
|
}
|
|
|
|
return parent::handle($request, $next, ...$abilities);
|
|
} catch (AuthenticationException $e) {
|
|
auditLog('api.auth.unauthenticated', [
|
|
'reason' => $e->getMessage(),
|
|
'required_abilities' => $abilities,
|
|
], 'warning');
|
|
|
|
return response()->json([
|
|
'message' => 'Unauthenticated.',
|
|
], 401);
|
|
} catch (\Exception $e) {
|
|
auditLog('api.auth.ability_denied', [
|
|
'required_abilities' => $abilities,
|
|
'token_id' => $request->user()?->currentAccessToken()?->id,
|
|
'reason' => $e->getMessage(),
|
|
], 'warning');
|
|
|
|
return response()->json([
|
|
'message' => 'Missing required permissions: '.implode(', ', $abilities),
|
|
], 403);
|
|
}
|
|
}
|
|
}
|