Organizations: show audit logs #8588

stsewd · 2021-10-14T20:56:17Z

Similar to the user security logs, but from all the organization and according to their plan.
I was able to re-use the listing from the user security log :D.

Didn't want to overload the UI with all the information from each record (but you can get everything with the download button), still you can see some information when hovering over some places.

stsewd · 2021-10-18T21:23:48Z

readthedocs/audit/filters.py

@@ -21,4 +21,18 @@ class UserSecurityLogFilter(FilterSet):

    class Meta:
        model = AuditLog
-        fields = ['ip', 'project', 'action']
+        fields = []


this wasn't needed, as these values are defined as attributes, but you still need to declare fields

ericholscher

This looks like a good start, but I think we definitely want the ability to filter by dates by the user. It doesn't need to be in the UI yet, but at least GET args.

readthedocs/audit/templates/audit/list_logs.html

readthedocs/audit/filters.py

readthedocs/organizations/templates/organizations/security_log.html

ericholscher · 2021-10-20T21:31:58Z

readthedocs/organizations/templates/organizations/security_log.html

+{% block edit_content %}
+
+{% if not enabled %}
+  {% include 'projects/includes/feature_disabled.html' with organization=organization %}


Should we be passing in something like plan=Pro in order to clarify what plan is required?

I think we could pass the feature type and check from the other template what plan is required?

Yea, not a huge priority though. 👍

readthedocs/organizations/templates/organizations/security_log.html

readthedocs/organizations/views/private.py

ericholscher · 2021-10-20T21:41:06Z

readthedocs/organizations/views/private.py

+            ('IP', 'ip'),
+            ('Browser', 'browser'),
+        ]
+        data = self._get_queryset().values_list(*[value for _, value in values])


This could potentially be huge for a user with pageviews. We are likely going to need something async that emails this to users, or uploads it to storage, or something. We can worry about that later though.

readthedocs/organizations/views/private.py

stsewd · 2021-10-21T21:08:21Z

@ericholscher I have added some docs and filtering by dates (date_before/date_after query args).
Some questions:

Should we document the available query args and mention they can be combined? currently, they are implicit
Should the download button respect the current filters? Right now it always downloads all records, without using the filters.
I saw that github does respects the filters when you click on "export" https://github.com/settings/security-log.

ericholscher · 2021-10-28T22:01:19Z

@ericholscher I have added some docs and filtering by dates (date_before/date_after query args). Some questions:

Awesome! I looked over it, and it seems good to me.

Should we document the available query args and mention they can be combined? currently, they are implicit

I think it's fine for now that we don't document them. I do think we should probably make them work with a GET arg though.

Should the download button respect the current filters? Right now it always downloads all records, without using the filters.

I think so. I think otherwise some users won't be able to download anything because the view will time out, and it will be confusing to filter the data and not have the download respect that.

I saw that github does respects the filters when you click on "export" https://github.com/settings/security-log.

Yea -- I think updating the export/download link is probably the easiest way to handle this.

docs/security-log.rst

ericholscher · 2021-10-28T21:43:49Z

docs/security-log.rst

+User security log
+-----------------
+
+We store user security logs from the last 90 days, and track the following events:


Does this vary by plan on .com? If so, we should probably put this in a small table comparing each site. I dislike having the tabs where you have to click to see the Commercial one, so a small table seems best?

User securtiy logs are 90 days for both, we could respect the max period set by the organizations they belong on .com, but I have some questions if that happens, should we show those type of logs to org owners as well? #8620 (comment)

docs/security-log.rst

ericholscher · 2021-10-28T21:55:43Z

readthedocs/organizations/views/private.py

-            days_ago = timezone.now() - timezone.timedelta(days=retention_limit)
+            return creation_date
+        start_date = timezone.now().date() - timezone.timedelta(days=retention_limit)
+        # The max we can go back is to the creation of the organization.


ericholscher · 2021-10-28T22:02:01Z

readthedocs/profiles/views.py

@@ -189,9 +187,17 @@ def get(self, request, *args, **kwargs):
            return self._get_csv_data()
        return super().get(request, *args, **kwargs)

+    def _get_start_date(self):


Seems like we want to get the request.GET.start_date here?

That's already handled by the filter, the filter acts on top of this query.

Co-authored-by: Eric Holscher <[email protected]>

stsewd · 2021-11-01T19:35:51Z

Download button now uses the current filters. But had to use a link instead of a form, as the form removes all query args from the forms' action attribute. To make the link look like a button, used the button class, but looks like that class doesn't exist on .com, so we need to figure out that first before merging...

stsewd · 2021-11-01T21:48:41Z

Fixed :D
It overlaps a little, but that looks like that happens in other elements on .com.

ericholscher

Changes look good 👍

Let's get this shipped and deployed.

stsewd force-pushed the expose-org-audit-log branch from 99dbdf3 to 80963c9 Compare October 18, 2021 19:33

Base automatically changed from move-orgs-vies to master October 18, 2021 19:55

stsewd force-pushed the expose-org-audit-log branch 3 times, most recently from 0233b15 to 9ad62c0 Compare October 18, 2021 21:20

stsewd commented Oct 18, 2021

View reviewed changes

Organizations: show audit logs

5bd1f63

stsewd force-pushed the expose-org-audit-log branch from 9ad62c0 to 5bd1f63 Compare October 18, 2021 21:44

stsewd marked this pull request as ready for review October 18, 2021 23:34

stsewd requested a review from a team October 18, 2021 23:34

ericholscher approved these changes Oct 20, 2021

View reviewed changes

stsewd added 3 commits October 21, 2021 10:47

Improvements from review

31d2e66

Docs

5c4a3a9

Allow filtering by date

56b8129

stsewd requested a review from a team as a code owner October 21, 2021 20:59

stsewd requested a review from ericholscher October 26, 2021 20:58

stsewd added 2 commits October 28, 2021 11:48

Merge branch 'master' into expose-org-audit-log

f06ad81

Include download action

2a63958

ericholscher reviewed Oct 28, 2021

View reviewed changes

stsewd and others added 2 commits November 1, 2021 12:05

Apply suggestions from code review

f97970c

Co-authored-by: Eric Holscher <[email protected]>

Download using the current filters

6075b57

Fix download button

10ddab7

Update docs

7ab1acc

stsewd requested a review from ericholscher November 3, 2021 16:28

ericholscher approved these changes Nov 8, 2021

View reviewed changes

Merge branch 'master' into expose-org-audit-log

60ffb95

Merge branch 'master' into expose-org-audit-log

47b7cb9

stsewd enabled auto-merge (squash) November 8, 2021 22:25

stsewd merged commit 4e87dfc into master Nov 8, 2021

stsewd deleted the expose-org-audit-log branch November 8, 2021 22:49

Uh oh!

Organizations: show audit logs #8588

Organizations: show audit logs #8588

Uh oh!

Conversation

stsewd commented Oct 14, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericholscher left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ericholscher Oct 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

stsewd commented Oct 21, 2021

Uh oh!

ericholscher commented Oct 28, 2021

Uh oh!

Uh oh!

ericholscher Oct 28, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stsewd commented Nov 1, 2021

Uh oh!

stsewd commented Nov 1, 2021

Uh oh!

ericholscher left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stsewd commented Oct 14, 2021 •

edited

Loading

ericholscher left a comment •

edited

Loading

ericholscher Oct 20, 2021 •

edited

Loading

ericholscher Oct 28, 2021 •

edited

Loading