feat: add plugin metadata to audit logging

[thyton]

Add plugin metadata (name, type, version, sha256, whether the plugin is running externally) to audit logging

[tomhjp]

Looking pretty good to me. It would be great to get some tests. There is an example of a test that enables audit logging to a file here that you could use as a basis:

vault/vault/logical_system_test.go

Lines 3432 to 3445 in 3c2faf2

	tempDir := t.TempDir()
	f, err := os.CreateTemp(tempDir, "")
	if err != nil {
	t.Fatal(err)
	}
	// Enable audit logging.
	req := logical.TestRequest(t, logical.UpdateOperation, "audit/file")
	req.Data = map[string]any{
	"type": "file",
	"options": map[string]any{
	"file_path": f.Name(),
	},
	}

[swenson]

Looking good. Echoing what Tom said, adding some tests would be great.

[swenson]

Awesome! Just a question and a few small nits.

[swenson]

Does this work if the request is under a namespace?

[thyton]

I believe this works if the request is under a namespace since req.Path has the namespace trimmed further up in the call stack. For example, in buildLogicalRequestNoAuth() that constructs logical.Request , logical.Request.Path is made from namespace-trimmed http.Request.URL.Path https://github.com/hashicorp/vault/blob/main/http/logical.go#L53.

[thyton]

I decided to use add MountClass() to MountEntry instead of using logical.Request.Path as MountEntry.Path doesn't have a namespace.

// APIPath returns the full API Path for the given mount entry
func (e *MountEntry) APIPath() string {
	path := e.Path
	if e.Table == credentialTableType {
		path = credentialRoutePrefix + path
	}
	return e.namespace.Path + path
}

// APIPathNoNamespace returns the API Path without the namespace for the given mount entry
func (e *MountEntry) APIPathNoNamespace() string {
	path := e.Path
	if e.Table == credentialTableType {
		path = credentialRoutePrefix + path
	}
	return path
}

[swenson]

LGTM

I pulled this down and tested it locally with namespaces as well, and it seems to work,

e.g.,

$ VAULT_NAMESPACE=testns vault write auth/approle/role/example-dot-com ...
...
  "request": {
    "id": "9bd6a564-6046-6e16-5ccb-5b40dbdad29d",
    "client_id": "0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=",
    "operation": "create",
    "mount_type": "approle",
    "mount_accessor": "auth_approle_316cf542",
    "mount_running_version": "v1.14.0+builtin.vault",
    "mount_class": "auth",
    "client_token": "hmac-sha256:70849cbddaebad80649e4d1845fccfd2c4a12694b590a627d6d12d21ec34a5b4",
    "client_token_accessor": "hmac-sha256:6bdd69aa740335b8a0d2b9588c60f79b7907c51091301d6a5f0d5289ed243e59",
    "namespace": {
      "id": "x3PCA",
      "path": "testns/"
    },
...
  "response": {
    "mount_type": "approle",
    "mount_accessor": "auth_approle_316cf542",
    "mount_running_plugin_version": "v1.14.0+builtin.vault",
    "mount_class": "auth"
  }    

[tomhjp]

Nice tests! 👍