EXT-1423 audit trace merge stream-nb-25-1

ydb/core/mon/audit/audit.cpp

@@ -108,7 +108,11 @@ bool TAuditCtx::AuditableRequest(const NHttp::THttpIncomingRequestPtr& request)
     return true;
 }
 
-void TAuditCtx::InitAudit(const NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr& ev) {
+void TAuditCtx::InitAudit(const NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr& ev, bool needAudit) {
+    if (!(Auditable = needAudit)) {
+        return;
+    }
+
     const auto& request = ev->Get()->Request;
     const TString method(request->Method);
     const TString url(request->URL.Before('?'));

ydb/core/mon/audit/audit.h

@@ -22,7 +22,7 @@ enum ERequestStatus {
 
 class TAuditCtx {
 public:
-    void InitAudit(const NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr& ev);
+    void InitAudit(const NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr& ev, bool needAudit = true);
     void AddAuditLogParts(const TAuditParts& parts); // TODO: pass request context instead of audit log parts
     void LogAudit(ERequestStatus status, const TString& reason, NKikimrConfig::TAuditConfig::TLogClassConfig::ELogPhase logPhase);
     void LogOnReceived();

ydb/core/mon/events_internal.h

@@ -0,0 +1,51 @@
+#pragma once
+
+#include <ydb/core/protos/mon.pb.h>
+
+namespace NMonitoring::NPrivate {
+
+struct TEvMon {
+    enum {
+        EvBegin = EventSpaceBegin(NActors::TEvents::ES_PRIVATE),
+
+        EvMonitoringRequest = EvBegin,
+        EvMonitoringResponse,
+        EvRegisterHandler,
+        EvMonitoringCancelRequest,
+        EvCleanupProxy,
+
+        End
+    };
+
+    static_assert(End < EventSpaceEnd(NActors::TEvents::ES_PRIVATE), "expect End < EventSpaceEnd(TEvents::ES_PRIVATE)");
+
+    struct TEvMonitoringRequest : NActors::TEventPB<TEvMonitoringRequest, NKikimrMonProto::TEvMonitoringRequest, EvMonitoringRequest> {
+        TEvMonitoringRequest() = default;
+    };
+
+    struct TEvMonitoringResponse : NActors::TEventPB<TEvMonitoringResponse, NKikimrMonProto::TEvMonitoringResponse, EvMonitoringResponse> {
+        TEvMonitoringResponse() = default;
+    };
+
+    struct TEvRegisterHandler : NActors::TEventLocal<TEvRegisterHandler, EvRegisterHandler> {
+        NActors::TMon::TRegisterHandlerFields Fields;
+
+        TEvRegisterHandler(const NActors::TMon::TRegisterHandlerFields& fields)
+            : Fields(fields)
+        {}
+    };
+
+    struct TEvMonitoringCancelRequest : NActors::TEventPB<TEvMonitoringCancelRequest, NKikimrMonProto::TEvMonitoringCancelRequest, EvMonitoringCancelRequest> {
+        TEvMonitoringCancelRequest() = default;
+    };
+
+    struct TEvCleanupProxy : NActors::TEventLocal<TEvCleanupProxy, EvCleanupProxy> {
+        TString Address;
+
+        TEvCleanupProxy(const TString& address)
+            : Address(address)
+        {}
+    };
+};
+
+} // namespace NMonitoring::NPrivate

ydb/core/mon/mon.cpp

@@ -1,5 +1,6 @@
 #include "mon.h"
 #include "mon_impl.h"
+#include "events_internal.h"
 #include "counters_adapter_impl.h"
 
 #include <ydb/core/base/appdata.h>
@@ -32,51 +33,10 @@
 
 namespace NActors {
 
-struct TEvMon {
-    enum {
-        EvMonitoringRequest = NActors::NMon::HttpInfo + 10,
-        EvMonitoringResponse,
-        EvRegisterHandler,
-        EvMonitoringCancelRequest,
-        EvCleanupProxy,
-        End
-    };
-
-    static_assert(EvMonitoringRequest > NMon::End, "expect EvMonitoringRequest > NMon::End");
-    static_assert(End < EventSpaceEnd(NActors::TEvents::ES_MON), "expect End < EventSpaceEnd(NActors::TEvents::ES_MON)");
-
-    struct TEvMonitoringRequest : TEventPB<TEvMonitoringRequest, NKikimrMonProto::TEvMonitoringRequest, EvMonitoringRequest> {
-        TEvMonitoringRequest() = default;
-    };
-
-    struct TEvMonitoringResponse : TEventPB<TEvMonitoringResponse, NKikimrMonProto::TEvMonitoringResponse, EvMonitoringResponse> {
-        TEvMonitoringResponse() = default;
-    };
-
-    struct TEvRegisterHandler : TEventLocal<TEvRegisterHandler, EvRegisterHandler> {
-        TMon::TRegisterHandlerFields Fields;
-
-        TEvRegisterHandler(const TMon::TRegisterHandlerFields& fields)
-            : Fields(fields)
-        {}
-    };
-
-    struct TEvMonitoringCancelRequest : TEventPB<TEvMonitoringCancelRequest, NKikimrMonProto::TEvMonitoringCancelRequest, EvMonitoringCancelRequest> {
-        TEvMonitoringCancelRequest() = default;
-    };
-
-    struct TEvCleanupProxy : TEventLocal<TEvCleanupProxy, EvCleanupProxy> {
-        TString Address;
-
-        TEvCleanupProxy(const TString& address)
-            : Address(address)
-        {}
-    };
-};
-
 namespace {
 
 using namespace NKikimr;
+using namespace NMonitoring::NPrivate;
 
 bool HasJsonContent(NHttp::THttpIncomingRequest* request) {
     if (request->Method == "POST") {
@@ -583,18 +543,20 @@ class THttpMonLegacyIndexRequest : public TActorBootstrapped<THttpMonLegacyIndex
     NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr Event;
     THttpMonRequestContainer Container;
     NMonitoring::NAudit::TAuditCtx AuditCtx;
+    bool NeedAudit;
 
-    THttpMonLegacyIndexRequest(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event, NMonitoring::IMonPage* index)
+    THttpMonLegacyIndexRequest(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event, NMonitoring::IMonPage* index, bool needAudit = true)
         : Event(std::move(event))
         , Container(Event->Get()->Request, index)
+        , NeedAudit(needAudit)
     {}
 
     static constexpr NKikimrServices::TActivity::EType ActorActivityType() {
         return NKikimrServices::TActivity::HTTP_MON_LEGACY_INDEX_REQUEST;
     }
 
     void Bootstrap() {
-        AuditCtx.InitAudit(Event);
+        AuditCtx.InitAudit(Event, NeedAudit);
         ProcessRequest();
     }
 
@@ -1249,12 +1211,14 @@ class THttpMonAuthorizedActorRequest : public TActorBootstrapped<THttpMonAuthori
 // receives everyhing not related to actor communcation, converts them to request-actors
 class THttpMonIndexService : public TActor<THttpMonIndexService> {
 public:
-    THttpMonIndexService(const TActorId& httpProxyActorId, TIntrusivePtr<NMonitoring::TIndexMonPage> indexMonPage, TMon::TRequestAuthorizer authorizer, const TString& redirectRoot = {})
+    THttpMonIndexService(const TActorId& httpProxyActorId, TIntrusivePtr<NMonitoring::TIndexMonPage> indexMonPage, 
+                         TMon::TRequestAuthorizer authorizer, const TString& redirectRoot = {}, bool needMonLegacyAudit = true)
         : TActor(&THttpMonIndexService::StateWork)
         , HttpProxyActorId(httpProxyActorId)
         , IndexMonPage(std::move(indexMonPage))
         , Authorizer(std::move(authorizer))
         , RedirectRoot(redirectRoot)
+        , NeedMonLegacyAudit(needMonLegacyAudit)
     {
     }
 
@@ -1349,7 +1313,7 @@ class THttpMonIndexService : public TActor<THttpMonIndexService> {
             }
         }
 
-        Register(new THttpMonLegacyIndexRequest(std::move(ev), IndexMonPage.Get()));
+        Register(new THttpMonLegacyIndexRequest(std::move(ev), IndexMonPage.Get(), NeedMonLegacyAudit));
     }
 
     void Handle(TEvMon::TEvRegisterHandler::TPtr& ev) {
@@ -1371,6 +1335,7 @@ class THttpMonIndexService : public TActor<THttpMonIndexService> {
     std::unordered_map<TString, TMon::TRegisterHandlerFields> Handlers;
     TMon::TRequestAuthorizer Authorizer;
     TString RedirectRoot;
+    bool NeedMonLegacyAudit;
 };
 
 
@@ -1380,6 +1345,36 @@ TMon::TMon(TConfig config)
 {
 }
 
+void TMon::RegisterLwtrace() {
+    NLwTraceMonPage::RegisterPages(IndexMonPage.Get());
+    NLwTraceMonPage::ProbeRegistry().AddProbesList(LWTRACE_GET_PROBES(ACTORLIB_PROVIDER));
+    NLwTraceMonPage::ProbeRegistry().AddProbesList(LWTRACE_GET_PROBES(MONITORING_PROVIDER));
+
+    TVector<TString> monitoringAllowedSIDs;
+    NKikimr::TAppData* appData = ActorSystem->AppData<NKikimr::TAppData>();
+    if (appData) {
+        {
+            const auto& protoAllowedSIDs = appData->DomainsConfig.GetSecurityConfig().GetMonitoringAllowedSIDs();
+            for (const auto& sid : protoAllowedSIDs) {
+                monitoringAllowedSIDs.emplace_back(sid);
+            }
+        }
+        {
+            const auto& protoAllowedSIDs = appData->DomainsConfig.GetSecurityConfig().GetAdministrationAllowedSIDs();
+            for (const auto& sid : protoAllowedSIDs) {
+                monitoringAllowedSIDs.emplace_back(sid);
+            }
+        }
+    }
+
+    RegisterActorHandler({
+        .Path = "/trace",
+        .Handler = HttpAuthMonServiceActorId,
+        .UseAuth = true,
+        .AllowedSIDs = monitoringAllowedSIDs,
+    });
+}
+
 std::future<void> TMon::Start(TActorSystem* actorSystem) {
     Y_ABORT_UNLESS(actorSystem);
     TGuard<TMutex> g(Mutex);
@@ -1395,9 +1390,6 @@ std::future<void> TMon::Start(TActorSystem* actorSystem) {
     Register(new NMonitoring::TBootstrapFontsSvgMonPage);
     Register(new NMonitoring::TBootstrapFontsTtfMonPage);
     Register(new NMonitoring::TBootstrapFontsWoffMonPage);
-    NLwTraceMonPage::RegisterPages(IndexMonPage.Get());
-    NLwTraceMonPage::ProbeRegistry().AddProbesList(LWTRACE_GET_PROBES(ACTORLIB_PROVIDER));
-    NLwTraceMonPage::ProbeRegistry().AddProbesList(LWTRACE_GET_PROBES(MONITORING_PROVIDER));
     if (ActorSystem->AppData<NKikimr::TAppData>()) {
         auto metricsRoot = NKikimr::GetServiceCounters(ActorSystem->AppData<NKikimr::TAppData>()->Counters, "utils")->GetSubgroup("subsystem", "mon");
         Metrics = std::make_shared<TMetricFactoryForDynamicCounters>(std::move(metricsRoot));
@@ -1413,6 +1405,11 @@ std::future<void> TMon::Start(TActorSystem* actorSystem) {
         new THttpMonIndexService(HttpProxyActorId, IndexMonPage, Config.Authorizer, Config.RedirectMainPageTo),
         TMailboxType::ReadAsFilled,
         executorPool);
+    HttpAuthMonServiceActorId = ActorSystem->Register(
+        new THttpMonIndexService(HttpMonServiceActorId, IndexMonPage, Config.Authorizer, Config.RedirectMainPageTo, false),
+        TMailboxType::ReadAsFilled,
+        executorPool);
+    RegisterLwtrace();
     auto nodeProxyActorId = ActorSystem->Register(
         new THttpMonServiceNodeProxy(HttpProxyActorId),
         TMailboxType::ReadAsFilled,
@@ -1464,6 +1461,7 @@ void TMon::Stop() {
         }
         ActorSystem->Send(NodeProxyServiceActorId, new TEvents::TEvPoisonPill);
         ActorSystem->Send(HttpMonServiceActorId, new TEvents::TEvPoisonPill);
+        ActorSystem->Send(HttpAuthMonServiceActorId, new TEvents::TEvPoisonPill);
         ActorSystem->Send(HttpProxyActorId, new TEvents::TEvPoisonPill);
         ActorSystem = nullptr;
     }

ydb/core/mon/mon.h

@@ -51,6 +51,7 @@ class TMon {
 
     void Register(NMonitoring::IMonPage* page);
     NMonitoring::TIndexMonPage* RegisterIndexPage(const TString& path, const TString& title);
+    void RegisterLwtrace();
 
     struct TRegisterActorPageFields {
         TString Title;
@@ -97,6 +98,7 @@ class TMon {
     TActorSystem* ActorSystem = {};
     TActorId HttpProxyActorId;
     TActorId HttpMonServiceActorId;
+    TActorId HttpAuthMonServiceActorId;
     TActorId NodeProxyServiceActorId;
 
     struct TActorMonPageInfo {