Files
coder/codersdk/connectionlog.go
T
Ethan 6a9b896f5b fix!: use client ip when creating connection logs for workspace proxied app accesses (#19788)
Breaking API Change: 
> The presence of the `ip` field on `codersdk.ConnectionLog` cannot be
guaranteed, and so the field has been made optional. It may be omitted
on API responses.

When running a scaletest, I noticed logs of the form:
```
2025-09-12 06:34:10.924 [erro]  coderd.workspaceapps: upsert connection log failed  trace=0xa17580  span=0xa17620  workspace_id=81b937d7-5777-4df5-b5cb-80241f30326f  agent_id=78b2ff6d-b4a6-4a4e-88a7-283e05455a88  app_id=00000000-0000-0000-0000-000000000000  user_id=00000000-0000-0000-0000-000000000000  user_agent=""  app_slug_or_port=terminal  status_code=404  request_id=67f03cf8-9523-444a-97bc-90de080a54c8 ...
    error= 1 error occurred:
           	* pq: null value in column "ip" of relation "connection_logs" violates not-null constraint
```

to ensure logs are never omitted from the connection log due to a
missing IP again (i.e. I'm not sure if we can always rely on a valid,
parseable, IP from `(http.Request).RemoteAddr`), I've removed the `NOT
NULL` constraint on `ip` on `connection_logs`, and made `ip` on the API
response optional.


The specific cause for these null IPs was the
`/workspaceproxies/me/issue-signed-app-token [post]` endpoint
constructing it's own `http.Request` without a `RemoteAddr` set, and
then passing that to the token issuer.

To solve this, we'll have workspace proxies send the real IP of the
client when calling `/workspaceproxies/me/issue-signed-app-token [post]`
via the header `Coder-Workspace-Proxy-Real-IP`.
2025-09-15 12:30:17 +10:00

127 lines
4.1 KiB
Go

package codersdk
import (
"context"
"encoding/json"
"net/http"
"net/netip"
"strings"
"time"
"github.com/google/uuid"
)
type ConnectionLog struct {
ID uuid.UUID `json:"id" format:"uuid"`
ConnectTime time.Time `json:"connect_time" format:"date-time"`
Organization MinimalOrganization `json:"organization"`
WorkspaceOwnerID uuid.UUID `json:"workspace_owner_id" format:"uuid"`
WorkspaceOwnerUsername string `json:"workspace_owner_username"`
WorkspaceID uuid.UUID `json:"workspace_id" format:"uuid"`
WorkspaceName string `json:"workspace_name"`
AgentName string `json:"agent_name"`
IP *netip.Addr `json:"ip,omitempty"`
Type ConnectionType `json:"type"`
// WebInfo is only set when `type` is one of:
// - `ConnectionTypePortForwarding`
// - `ConnectionTypeWorkspaceApp`
WebInfo *ConnectionLogWebInfo `json:"web_info,omitempty"`
// SSHInfo is only set when `type` is one of:
// - `ConnectionTypeSSH`
// - `ConnectionTypeReconnectingPTY`
// - `ConnectionTypeVSCode`
// - `ConnectionTypeJetBrains`
SSHInfo *ConnectionLogSSHInfo `json:"ssh_info,omitempty"`
}
// ConnectionType is the type of connection that the agent is receiving.
type ConnectionType string
const (
ConnectionTypeSSH ConnectionType = "ssh"
ConnectionTypeVSCode ConnectionType = "vscode"
ConnectionTypeJetBrains ConnectionType = "jetbrains"
ConnectionTypeReconnectingPTY ConnectionType = "reconnecting_pty"
ConnectionTypeWorkspaceApp ConnectionType = "workspace_app"
ConnectionTypePortForwarding ConnectionType = "port_forwarding"
)
// ConnectionLogStatus is the status of a connection log entry.
// It's the argument to the `status` filter when fetching connection logs.
type ConnectionLogStatus string
const (
ConnectionLogStatusOngoing ConnectionLogStatus = "ongoing"
ConnectionLogStatusCompleted ConnectionLogStatus = "completed"
)
func (s ConnectionLogStatus) Valid() bool {
switch s {
case ConnectionLogStatusOngoing, ConnectionLogStatusCompleted:
return true
default:
return false
}
}
type ConnectionLogWebInfo struct {
UserAgent string `json:"user_agent"`
// User is omitted if the connection event was from an unauthenticated user.
User *User `json:"user"`
SlugOrPort string `json:"slug_or_port"`
// StatusCode is the HTTP status code of the request.
StatusCode int32 `json:"status_code"`
}
type ConnectionLogSSHInfo struct {
ConnectionID uuid.UUID `json:"connection_id" format:"uuid"`
// DisconnectTime is omitted if a disconnect event with the same connection ID
// has not yet been seen.
DisconnectTime *time.Time `json:"disconnect_time,omitempty" format:"date-time"`
// DisconnectReason is omitted if a disconnect event with the same connection ID
// has not yet been seen.
DisconnectReason string `json:"disconnect_reason,omitempty"`
// ExitCode is the exit code of the SSH session. It is omitted if a
// disconnect event with the same connection ID has not yet been seen.
ExitCode *int32 `json:"exit_code,omitempty"`
}
type ConnectionLogsRequest struct {
SearchQuery string `json:"q,omitempty"`
Pagination
}
type ConnectionLogResponse struct {
ConnectionLogs []ConnectionLog `json:"connection_logs"`
Count int64 `json:"count"`
}
func (c *Client) ConnectionLogs(ctx context.Context, req ConnectionLogsRequest) (ConnectionLogResponse, error) {
res, err := c.Request(ctx, http.MethodGet, "/api/v2/connectionlog", nil, req.Pagination.asRequestOption(), func(r *http.Request) {
q := r.URL.Query()
var params []string
if req.SearchQuery != "" {
params = append(params, req.SearchQuery)
}
q.Set("q", strings.Join(params, " "))
r.URL.RawQuery = q.Encode()
})
if err != nil {
return ConnectionLogResponse{}, err
}
defer res.Body.Close()
if res.StatusCode != http.StatusOK {
return ConnectionLogResponse{}, ReadBodyAsError(res)
}
var logRes ConnectionLogResponse
err = json.NewDecoder(res.Body).Decode(&logRes)
if err != nil {
return ConnectionLogResponse{}, err
}
return logRes, nil
}