feat: initial audit logging to rmapi

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 1.12.2
+current_version = 1.13.0
 commit = False
 tag = False
 

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rasenmaeher_api"
-version = "1.12.2"
+version = "1.13.0"
 description = "python-rasenmaeher-api"
 authors = [
     "Aciid <703382+Aciid@users.noreply.github.com>",
@@ -86,8 +86,8 @@ requests = "^2.31"
 multikeyjwt = "^1.0"
 uvicorn = {version = "^0.20", extras = ["standard"]}
 gunicorn = "^20.1"
-pyopenssl = ">=25.3"
-libpvarki = { version="^2.0", source="nexuslocal"}
+pyopenssl = "^25.3"
+libpvarki = { version="^2.2", source="nexuslocal"}
 openapi-readme = "^0.2"
 python-multipart = ">=0.0.21,<1.0.0"
 aiohttp = ">=3.11.10,<4.0"
@@ -114,7 +114,6 @@ bump2version = "^1.0"
 detect-secrets = "^1.2"
 httpx = ">=0.23,<1.0" # caret behaviour on 0.x is to lock to 0.x.*
 types-requests = "^2.31"
-types-pyopenssl = "^23.1"
 async-asgi-testclient = "^1.4"
 pytest-docker = "^2.0"
 flaky = "^3.8"

src/rasenmaeher_api/__init__.py

@@ -1,3 +1,3 @@
 """python-rasenmaeher-api"""
 
-__version__ = "1.12.2"  # NOTE Use `bump2version --config-file patch` to bump versions correctly
+__version__ = "1.13.0"  # NOTE Use `bump2version --config-file patch` to bump versions correctly

src/rasenmaeher_api/web/api/enduserpfx/views.py

@@ -2,11 +2,12 @@
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, Request, HTTPException, Depends
 from fastapi.responses import FileResponse
 
 from ....db import Person
 from ..middleware.user import ValidUser
+from ..utils.auditcontext import build_audit_extra
 from ....rmsettings import RMSettings
 
 router = APIRouter()
@@ -16,6 +17,7 @@
 @router.get(f"/{{callsign}}_{RMSettings.singleton().deployment_name}.pem")
 @router.get("/{callsign}.pem")
 async def get_user_pem(
+    request: Request,
     callsign: str,
     person: Person = Depends(ValidUser(auto_error=True)),
 ) -> FileResponse:
@@ -27,10 +29,33 @@ async def get_user_pem(
         callsign = callsign[:-4]
     LOGGER.debug("PEM: Called with callsign={}".format(callsign))
     if person.callsign != callsign:
+        LOGGER.audit(  # type: ignore[attr-defined]
+            "Certificate download denied - callsign mismatch",
+            extra=build_audit_extra(
+                action="certificate_download",
+                outcome="failure",
+                actor=person.callsign,
+                target=callsign,
+                request=request,
+                error_code="CALLSIGN_MISMATCH",
+                certificate_type="pem",
+            ),
+        )
         raise HTTPException(status_code=403, detail="Callsign must match authenticated user")
     # Make sure the pfx exists, this is no-op if it does
     await person.create_pfx()
 
+    LOGGER.audit(  # type: ignore[attr-defined]
+        "Certificate downloaded",
+        extra=build_audit_extra(
+            action="certificate_download",
+            outcome="success",
+            actor=person.callsign,
+            request=request,
+            certificate_type="pem",
+        ),
+    )
+
     return FileResponse(
         path=person.certfile,
         media_type="application/x-pem-file",
@@ -42,6 +67,7 @@ async def get_user_pem(
 @router.get("/{callsign}.pfx")
 @router.get("/{callsign}")
 async def get_user_pfx(
+    request: Request,
     callsign: str,
     person: Person = Depends(ValidUser(auto_error=True)),
 ) -> FileResponse:
@@ -57,13 +83,36 @@ async def get_user_pfx(
         callsign = callsign[:-4]
     if callsign.endswith(".pem"):
         LOGGER.debug("PFX: got .pem suffix, delegating")
-        return await get_user_pem(callsign, person)
+        return await get_user_pem(request, callsign, person)
     LOGGER.debug("PFX: Called with callsign={}".format(callsign))
     if person.callsign != callsign:
+        LOGGER.audit(  # type: ignore[attr-defined]
+            "Certificate download denied - callsign mismatch",
+            extra=build_audit_extra(
+                action="certificate_download",
+                outcome="failure",
+                actor=person.callsign,
+                target=callsign,
+                request=request,
+                error_code="CALLSIGN_MISMATCH",
+                certificate_type="pfx",
+            ),
+        )
         raise HTTPException(status_code=403, detail="Callsign must match authenticated user")
     # Make sure the pfx exists, this is no-op if it does
     await person.create_pfx()
 
+    LOGGER.audit(  # type: ignore[attr-defined]
+        "Certificate downloaded",
+        extra=build_audit_extra(
+            action="certificate_download",
+            outcome="success",
+            actor=person.callsign,
+            request=request,
+            certificate_type="pfx",
+        ),
+    )
+
     return FileResponse(
         path=person.pfxfile,
         media_type="application/x-pkcs12",