Prepare GitAuditEvent to handle deploy token actors

What does this MR do and why?

This MR prepares the Rails side to handle deploy token actors in the git audit event flow. It is the third step in a four-part plan to fix the 404/401 errors that caused the log_git_streaming_audit_events feature flag to be reverted.

Background

When a deploy token performs a git operation (e.g. git clone), Workhorse sends an audit event request to the /internal/shellhorse/git_audit_event endpoint. This fails with a 404 because the endpoint cannot resolve the deploy token actor.

Plan

The fix consists of four MRs, deployed in this order:

  1. !223145 (merged) (merged) - Fix the deserializer (Gitlab::Identifier#identify and GitAccessActor.from_identifier) to resolve "deploy-token-{id}" back to a DeployToken object.

  2. !222599 (merged) (merged) - Fix the serializer (Gitlab::GlId.gl_id) to produce "deploy-token-{id}" instead of "user-{id}" for deploy tokens.

  3. This MR - Prepare the shellhorse endpoint and GitAuditEvent to handle deploy token actors:

    • Update enabled? and send_audit_event to check author.blank? instead of user.blank?, since deploy token actors have user set to nil
    • Rename deploy_key_or_user to resolved_identity to reflect it can return DeployToken, DeployKey, or User
    • Add deploy token to key_or_user so the shellhorse access check (access_checker_for) can resolve deploy token actors
    • Prioritize identifier over username in from_params so deploy token identifiers are resolved correctly when Workhorse sends both params
  4. Next MR - Send GL_ID as identifier from Workhorse to the shellhorse audit event endpoint. This is the final MR that completes the fix for the HTTP path.

References

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Emma Park

Merge request reports

Loading