Wire up Node-RED instance audit events to FF

lib/auditLogger/index.js

@@ -0,0 +1,37 @@
+/*
+ * The below code should be kept in-sync with nr-launcher/lib/auditLogger/index.js
+ */
+
+const { default: got } = require('got')
+
+module.exports = (settings) => {
+    const loggingURL = settings.loggingURL
+    const token = settings.token
+    const logger = function (msg) {
+        if (/^(comms\.|.*\.get$)/.test(msg.event)) {
+            // Ignore comms events and any .get event that is just reading data
+            return
+        }
+        if (/^auth/.test(msg.event) && !/^auth.log/.test(msg.event)) {
+            return
+        }
+        if (msg.user) {
+            msg.user = msg.user.userId
+        }
+        delete msg.username
+        delete msg.level
+        got.post(loggingURL, {
+            json: msg,
+            responseType: 'json',
+            headers: {
+                'user-agent': 'FlowFuse Device Agent Audit Logging v0.1',
+                authorization: 'Bearer ' + token
+            }
+        }).catch(err => {
+            // ignore errors for now
+            console.log(err)
+        })
+    }
+
+    return logger
+}

lib/launcher.js

@@ -33,6 +33,8 @@ class Launcher {
         this.startTime = []
         this.state = 'stopped'
 
+        this.auditLogURL = `${this.config.forgeURL}/logging/device/${this.config.deviceId}/audit`
+
         // A callback function that will be set if the launcher is waiting
         // for Node-RED to exit
         this.exitCallback = null
@@ -184,6 +186,12 @@ class Launcher {
                 projectID: this.project || undefined,
                 applicationID: this.application || undefined,
                 teamID,
+                deviceId: this.config.deviceId,
+                auditLogger: {
+                    url: this.auditLogURL,
+                    token: this.config.token,
+                    bin: path.join(__dirname, 'auditLogger', 'index.js')
+                },
                 projectLink
             }
         }

lib/template/template-settings.js

@@ -119,6 +119,20 @@ const runtimeSettings = {
     editorTheme: { ...editorTheme }
 }
 
+if (settings.flowforge.auditLogger?.bin && settings.flowforge.auditLogger?.url) {
+    try {
+        runtimeSettings.logging.auditLogger = {
+            level: 'off',
+            audit: true,
+            handler: require(settings.flowforge.auditLogger.bin),
+            loggingURL: settings.flowforge.auditLogger.url,
+            token: settings.flowforge.auditLogger.token
+        }
+    } catch (e) {
+        console.warn('Could not initialise device audit logging. Audit events will not be logged to the platform')
+    }
+}
+
 if (settings.https) {
     ;['key', 'ca', 'cert'].forEach(key => {
         const filePath = settings.https[`${key}Path`]

package.json

@@ -3,7 +3,8 @@
     "version": "2.1.0",
     "description": "An Edge Agent for running Node-RED instances deployed from the FlowFuse Platform",
     "exports": {
-        "./libraryPlugin": "./lib/plugins/libraryPlugin.js"
+        "./libraryPlugin": "./lib/plugins/libraryPlugin.js",
+        "./auditLogger": "./lib/auditLogger/index.js"
     },
     "main": "index.js",
     "repository": {

test/unit/lib/launcher_spec.js

@@ -16,8 +16,16 @@ describe('Launcher', function () {
         verbose: true
     }
 
+    const configWithPlatformInfo = {
+        ...config,
+        forgeURL: 'https://test',
+        token: 'test-token',
+        deviceId: 'deviceid'
+    }
+
     beforeEach(async function () {
         config.dir = await fs.mkdtemp(path.join(os.tmpdir(), 'ff-launcher-'))
+        configWithPlatformInfo.dir = config.dir
         await fs.mkdir(path.join(config.dir, 'project'))
     })
 
@@ -183,4 +191,36 @@ describe('Launcher', function () {
         settings.editorTheme.should.have.property('palette')
         settings.editorTheme.palette.should.not.have.a.property('catalogue')
     })
+    it('sets up audit logging for the node-red instance', async function () {
+        const launcher = newLauncher(configWithPlatformInfo, null, 'projectId', setup.snapshot)
+        const expectedURL = `${configWithPlatformInfo.forgeURL}/logging/device/${configWithPlatformInfo.deviceId}/audit`
+        should(launcher).be.an.Object()
+        launcher.should.have.property('auditLogURL', expectedURL)
+        await launcher.writeSettings()
+        const setFile = await fs.readFile(path.join(config.dir, 'project', 'settings.json'))
+        const settings = JSON.parse(setFile)
+        settings.should.have.property('flowforge')
+        settings.flowforge.should.have.property('deviceId', configWithPlatformInfo.deviceId)
+        settings.flowforge.should.have.property('auditLogger').and.be.an.Object()
+        settings.flowforge.auditLogger.should.have.property('url', expectedURL)
+        settings.flowforge.auditLogger.should.have.property('token', configWithPlatformInfo.token)
+        settings.flowforge.auditLogger.should.have.property('bin', path.join(__dirname, '..', '..', '..', 'lib', 'auditLogger', 'index.js'))
+    })
+    it('settings.js loads audit logger with settings from config', async function () {
+        const launcher = newLauncher(configWithPlatformInfo, null, 'projectId', setup.snapshot)
+        const expectedURL = `${configWithPlatformInfo.forgeURL}/logging/device/${configWithPlatformInfo.deviceId}/audit`
+        await launcher.writeSettings()
+
+        // copy the template-settings as settings.js to the test dir
+        await fs.copyFile(path.join(__dirname, '..', '..', '..', 'lib', 'template', 'template-settings.js'), path.join(config.dir, 'project', 'settings.js'))
+        const runtimeSettings = require(path.join(config.dir, 'project', 'settings.js'))
+        should(runtimeSettings).be.an.Object()
+        runtimeSettings.should.have.property('logging').and.be.an.Object()
+        runtimeSettings.logging.should.have.property('auditLogger').and.be.an.Object()
+        runtimeSettings.logging.auditLogger.should.have.property('level', 'off')
+        runtimeSettings.logging.auditLogger.should.have.property('audit', true)
+        runtimeSettings.logging.auditLogger.should.have.property('handler').and.be.a.Function()
+        runtimeSettings.logging.auditLogger.should.have.property('loggingURL', expectedURL)
+        runtimeSettings.logging.auditLogger.should.have.property('token', configWithPlatformInfo.token)
+    })
 })