record access request create and review events

lib/usagereporter/teleport/aggregating/reporter.go

@@ -186,7 +186,9 @@ func (r *Reporter) AnonymizeAndSubmit(events ...usagereporter.Anonymizable) {
 			*usagereporter.ResourceHeartbeatEvent,
 			*usagereporter.UserCertificateIssuedEvent,
 			*usagereporter.BotJoinEvent,
-			*usagereporter.SPIFFESVIDIssuedEvent:
+			*usagereporter.SPIFFESVIDIssuedEvent,
+			*usagereporter.AccessRequestCreateEvent,
+			*usagereporter.AccessRequestReviewEvent:
 			filtered = append(filtered, event)
 		}
 	}
@@ -388,6 +390,10 @@ Ingest:
 		case *usagereporter.UserLoginEvent:
 			// Bots never generate tp.user.login events.
 			userRecord(te.UserName, prehogv1alpha.UserKind_USER_KIND_HUMAN).Logins++
+		case *usagereporter.AccessRequestCreateEvent:
+			userRecord(te.UserName, prehogv1alpha.UserKind_USER_KIND_HUMAN).AccessRequestsCreated++
+		case *usagereporter.AccessRequestReviewEvent:
+			userRecord(te.UserName, prehogv1alpha.UserKind_USER_KIND_HUMAN).AccessRequestsReviewed++
 		case *usagereporter.SessionStartEvent:
 			switch te.SessionType {
 			case string(types.SSHSessionKind):

lib/usagereporter/teleport/aggregating/reporter_test.go

@@ -107,6 +107,14 @@ func TestReporter(t *testing.T) {
 	r.AnonymizeAndSubmit(&usagereporter.SPIFFESVIDIssuedEvent{
 		UserName: "alice",
 	})
+	r.AnonymizeAndSubmit(&usagereporter.AccessRequestCreateEvent{
+		UserName: "alice",
+	})
+	r.AnonymizeAndSubmit(&usagereporter.AccessRequestReviewEvent{
+		UserName: "alice",
+	})
+	recvIngested()
+	recvIngested()
 	recvIngested()
 	recvIngested()
 	recvIngested()
@@ -125,6 +133,8 @@ func TestReporter(t *testing.T) {
 	require.Equal(t, uint64(1), record.Logins)
 	require.Equal(t, uint64(2), record.SshSessions)
 	require.Equal(t, uint64(1), record.SpiffeSvidsIssued)
+	require.Equal(t, uint64(1), record.GetAccessRequestsCreated())
+	require.Equal(t, uint64(1), record.GetAccessRequestsReviewed())
 
 	r.AnonymizeAndSubmit(&usagereporter.ResourceHeartbeatEvent{
 		Name:   "srv01",

lib/usagereporter/teleport/audit.go

@@ -19,6 +19,7 @@
 package usagereporter
 
 import (
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
@@ -80,6 +81,31 @@ func ConvertAuditEvent(event apievents.AuditEvent) Anonymizable {
 			RequiredPrivateKeyPolicy: e.RequiredPrivateKeyPolicy,
 		}
 
+	case *apievents.AccessRequestCreate:
+		// The access request audit event emitter uses ClientUserMetadata function to
+		// deduce username. The ClientUserMetadata function may return teleport.UserSystem
+		// if it cannot find user identity in the context. Since we want to record
+		// user activity, event containing teleport.UserSystem should be filtered as
+		// it does not refer to an actual user account.
+		switch e.GetType() {
+		case events.AccessRequestCreateEvent:
+			if e.User == "" || e.User == teleport.UserSystem {
+				return nil
+			}
+			return &AccessRequestCreateEvent{
+				UserName: e.User,
+			}
+		case events.AccessRequestReviewEvent:
+			if e.Reviewer == "" || e.Reviewer == teleport.UserSystem {
+				return nil
+			}
+			return &AccessRequestReviewEvent{
+				UserName: e.Reviewer,
+			}
+		default:
+			// Ignore Access Request update event.
+			return nil
+		}
 	case *apievents.SessionStart:
 		// Note: session.start is only SSH and Kubernetes.
 		sessionType := types.SSHSessionKind

lib/usagereporter/teleport/types.go

@@ -59,6 +59,32 @@ func (u *UserLoginEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequ
 	}
 }
 
+// AccessRequestCreateEvent is emitted when Access Request is created.
+type AccessRequestCreateEvent prehogv1a.AccessRequestEvent
+
+func (e *AccessRequestCreateEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_AccessRequestCreateEvent{
+			AccessRequestCreateEvent: &prehogv1a.AccessRequestEvent{
+				UserName: a.AnonymizeString(e.UserName),
+			},
+		},
+	}
+}
+
+// AccessRequestCreateEvent is emitted when Access Request is reviewed.
+type AccessRequestReviewEvent prehogv1a.AccessRequestEvent
+
+func (e *AccessRequestReviewEvent) Anonymize(a utils.Anonymizer) prehogv1a.SubmitEventRequest {
+	return prehogv1a.SubmitEventRequest{
+		Event: &prehogv1a.SubmitEventRequest_AccessRequestReviewEvent{
+			AccessRequestReviewEvent: &prehogv1a.AccessRequestEvent{
+				UserName: a.AnonymizeString(e.UserName),
+			},
+		},
+	}
+}
+
 // BotJoinEvent is an event emitted when a user logs into Teleport,
 // potentially via SSO.
 type BotJoinEvent prehogv1a.BotJoinEvent

proto/prehog/v1/teleport.proto

@@ -124,6 +124,10 @@ message UserActivityRecord {
   uint64 certificates_issued = 17;
   // counter of SVIDs issued for each SPIFFE ID.
   repeated SPIFFEIDRecord spiffe_ids_issued = 18;
+  // counter of Access Requests created by this user.
+  uint64 access_requests_created = 19;
+  // counter of Access Requests reviewed by this user.
+  uint64 access_requests_reviewed = 20;
 }
 
 // the kind of a "resource" (e.g. a node, a database, a desktop, etc.)

proto/prehog/v1alpha/teleport.proto

@@ -1556,6 +1556,12 @@ message UserTaskStateEvent {
   int32 instances_count = 4;
 }
 
+// AccessRequestEvent emitted for Access Request audit events.
+message AccessRequestEvent {
+  // Teleport user name. Anonymized.
+  string user_name = 1;
+}
+
 message SubmitEventRequest {
   // anonymized, 32 bytes (HMAC-SHA-256) encoded in base64
   //
@@ -1723,6 +1729,9 @@ message SubmitEventRequest {
     // note that 95 is used for "teleport_version" above.
 
     UIIntegrationEnrollStepEvent ui_integration_enroll_step_event = 96;
+
+    AccessRequestEvent access_request_create_event = 97;
+    AccessRequestEvent access_request_review_event = 98;
   }
 
   reserved 8; // UIOnboardGetStartedClickEvent