#234 Check audit entity consistency

Author: To-om

thehive-backend/app/models/Audit.scala

@@ -6,23 +6,23 @@ import javax.inject.{ Inject, Singleton }
 import scala.collection.immutable
 import play.api.{ Configuration, Logger }
 import play.api.libs.json.JsObject
-import org.elastic4play.models.{ Attribute, AttributeDef, EntityDef, EnumerationAttributeFormat, ModelDef, MultiAttributeFormat, ObjectAttributeFormat, OptionalAttributeFormat, StringAttributeFormat, AttributeFormat ⇒ F, AttributeOption ⇒ O }
+import org.elastic4play.models.{ Attribute, AttributeFormat, AttributeDef, EntityDef, EnumerationAttributeFormat, ListEnumeration, ModelDef, MultiAttributeFormat, ObjectAttributeFormat, OptionalAttributeFormat, StringAttributeFormat, AttributeOption ⇒ O }
 import org.elastic4play.services.AuditableAction
 import org.elastic4play.services.JsonFormat.auditableActionFormat
 import services.AuditedModel
 
 trait AuditAttributes { _: AttributeDef ⇒
   def detailsAttributes: Seq[Attribute[_]]
 
-  val operation: A[AuditableAction.Value] = attribute("operation", F.enumFmt(AuditableAction), "Operation", O.readonly)
-  val details: A[JsObject] = attribute("details", F.objectFmt(detailsAttributes), "Details", JsObject(Nil), O.readonly)
-  val otherDetails: A[Option[String]] = optionalAttribute("otherDetails", F.textFmt, "Other details", O.readonly)
-  val objectType: A[String] = attribute("objectType", F.stringFmt, "Table affected by the operation", O.readonly)
-  val objectId: A[String] = attribute("objectId", F.stringFmt, "Object targeted by the operation", O.readonly)
-  val base: A[Boolean] = attribute("base", F.booleanFmt, "Indicates if this operation is the first done for a http query", O.readonly)
-  val startDate: A[Date] = attribute("startDate", F.dateFmt, "Date and time of the operation", new Date, O.readonly)
-  val rootId: A[String] = attribute("rootId", F.stringFmt, "Root element id (routing id)", O.readonly)
-  val requestId: A[String] = attribute("requestId", F.stringFmt, "Id of the request that do the operation", O.readonly)
+  val operation: A[AuditableAction.Value] = attribute("operation", AttributeFormat.enumFmt(AuditableAction), "Operation", O.readonly)
+  val details: A[JsObject] = attribute("details", AttributeFormat.objectFmt(detailsAttributes), "Details", JsObject(Nil), O.readonly)
+  val otherDetails: A[Option[String]] = optionalAttribute("otherDetails", AttributeFormat.textFmt, "Other details", O.readonly)
+  val objectType: A[String] = attribute("objectType", AttributeFormat.stringFmt, "Table affected by the operation", O.readonly)
+  val objectId: A[String] = attribute("objectId", AttributeFormat.stringFmt, "Object targeted by the operation", O.readonly)
+  val base: A[Boolean] = attribute("base", AttributeFormat.booleanFmt, "Indicates if this operation is the first done for a http query", O.readonly)
+  val startDate: A[Date] = attribute("startDate", AttributeFormat.dateFmt, "Date and time of the operation", new Date, O.readonly)
+  val rootId: A[String] = attribute("rootId", AttributeFormat.stringFmt, "Root element id (routing id)", O.readonly)
+  val requestId: A[String] = attribute("requestId", AttributeFormat.stringFmt, "Id of the request that do the operation", O.readonly)
 }
 
 @Singleton
@@ -37,46 +37,64 @@ class AuditModel(
       configuration.getString("audit.name").get,
       auditedModels)
 
-  lazy val log = Logger(getClass)
+  lazy val logger = Logger(getClass)
 
-  def detailsAttributes: Seq[Attribute[_]] = {
-    auditedModels
-      .flatMap(_.attributes)
-      .flatMap {
-        // if attribute is object, add sub attributes
-        case attr @ Attribute(_, _, ObjectAttributeFormat(subAttributes), _, _, _) ⇒ attr +: subAttributes
-        case attr ⇒ Seq(attr)
-      }
-      .filter(_.isModel)
-      .map {
-        case attr @ Attribute(_, _, OptionalAttributeFormat(_), _, _, _) ⇒ attr
-        case attr @ Attribute(_, _, MultiAttributeFormat(_), _, _, _)    ⇒ attr
-        case attr                                                        ⇒ attr.toOptional
-      }
+  def mergeAttributeFormat(context: String, format1: AttributeFormat[_], format2: AttributeFormat[_]): Option[AttributeFormat[_]] = {
+    (format1, format2) match {
+      case (OptionalAttributeFormat(f1), f2)                                              ⇒ mergeAttributeFormat(context, f1, f2)
+      case (f1, OptionalAttributeFormat(f2))                                              ⇒ mergeAttributeFormat(context, f1, f2)
+      case (MultiAttributeFormat(f1), MultiAttributeFormat(f2))                           ⇒ mergeAttributeFormat(context, f1, f2).map(MultiAttributeFormat(_))
+      case (f1, EnumerationAttributeFormat(_) | ListEnumeration(_))                       ⇒ mergeAttributeFormat(context, f1, StringAttributeFormat)
+      case (EnumerationAttributeFormat(_) | ListEnumeration(_), f2)                       ⇒ mergeAttributeFormat(context, StringAttributeFormat, f2)
+      case (ObjectAttributeFormat(subAttributes1), ObjectAttributeFormat(subAttributes2)) ⇒ mergeAttributes(context, subAttributes1 ++ subAttributes2)
+      case (f1, f2) if f1 == f2                                                           ⇒ Some(f1)
+      case (f1, f2) ⇒
+        logger.warn(s"$f1 != $f2")
+        None
+
+    }
+  }
+
+  def mergeAttributes(context: String, attributes: Seq[Attribute[_]]): Option[ObjectAttributeFormat] = {
+    val mergeAttributes: Iterable[Option[Attribute[_]]] = attributes
       .groupBy(_.name)
-      .flatMap {
-        // if only one attribute is found for a name, get it
-        case (_, attribute @ Seq(_)) ⇒ attribute
-        // otherwise, check if attribute format is compatible
-        case (_, attributes) ⇒
-          attributes.headOption.foreach { first ⇒
-            val isSensitive = first.isSensitive
-            val formatName = first.format.name
-            if (!attributes.forall(a ⇒ a.isSensitive == isSensitive && a.format.name == formatName)) {
-              log.error("Mapping is not consistent :")
-              attributes.foreach { attr ⇒
-                val s = if (attr.isSensitive) " (is sensitive)" else ""
-                log.error(s"\t${attr.name} : ${attr.format.name} $s")
-              }
-            }
-          }
-          attributes.headOption
-      }
       .map {
-        case attr @ Attribute(_, _, EnumerationAttributeFormat(_), _, _, _) ⇒ attr.copy(format = StringAttributeFormat, defaultValue = None)
-        case attr                                                           ⇒ attr
+        case (_name, _attributes) ⇒
+          _attributes
+            .map(a ⇒ Some(a.format))
+            .reduce[Option[AttributeFormat[_]]] {
+              case (Some(f1), Some(f2)) ⇒ mergeAttributeFormat(context + "." + _name, f1, f2)
+              case _                    ⇒ None
+            }
+            .map {
+              case oaf: OptionalAttributeFormat[_] ⇒ oaf: AttributeFormat[_]
+              case maf: MultiAttributeFormat[_]    ⇒ maf: AttributeFormat[_]
+              case f                               ⇒ OptionalAttributeFormat(f): AttributeFormat[_]
+            }
+            .map(format ⇒ Attribute("audit", _name, format, Nil, None, ""))
+            .orElse {
+              logger.error(s"Mapping is not consistent on attribute $context:\n${_attributes.map(a ⇒ a.modelName + "/" + a.name + ": " + a.format.name).mkString("\n")}")
+              None
+            }
       }
-      .toSeq
+
+    if (mergeAttributes.exists(_.isEmpty))
+      None
+    else
+      Some(ObjectAttributeFormat(mergeAttributes.flatten.toSeq))
+  }
+  def detailsAttributes: Seq[Attribute[_]] = {
+    mergeAttributes("audit", auditedModels
+      .flatMap(_.attributes)
+      .filter(a ⇒ a.isModel && !a.isUnaudited)
+      .toSeq)
+      .map(_.subAttributes)
+      .getOrElse(Nil)
+  }
+
+  logger.info("Audit attributes:")
+  detailsAttributes.foreach { a ⇒
+    logger.info(s"\t${a.name}: ${a.format}")
   }
   override def apply(attributes: JsObject): Audit = new Audit(this, attributes)
 }