WIP: Save current state - security subsystems, migrations, logging

aggregator-server/internal/models/security_event.go

@@ -0,0 +1,111 @@
+package models
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// SecurityEvent represents a security-related event that occurred
+type SecurityEvent struct {
+	Timestamp    time.Time              `json:"timestamp" db:"timestamp"`
+	Level        string                 `json:"level" db:"level"` // CRITICAL, WARNING, INFO, DEBUG
+	EventType    string                 `json:"event_type" db:"event_type"`
+	AgentID      uuid.UUID              `json:"agent_id,omitempty" db:"agent_id"`
+	Message      string                 `json:"message" db:"message"`
+	TraceID      string                 `json:"trace_id,omitempty" db:"trace_id"`
+	IPAddress    string                 `json:"ip_address,omitempty" db:"ip_address"`
+	Details      map[string]interface{} `json:"details,omitempty" db:"details"` // JSON encoded
+	Metadata     map[string]interface{} `json:"metadata,omitempty" db:"metadata"` // JSON encoded
+}
+
+// SecurityEventTypes defines all possible security event types
+var SecurityEventTypes = struct {
+	CmdSigned                        string
+	CmdSignatureVerificationFailed   string
+	CmdSignatureVerificationSuccess  string
+	UpdateNonceInvalid               string
+	UpdateSignatureVerificationFailed string
+	MachineIDMismatch                string
+	AuthJWTValidationFailed          string
+	PrivateKeyNotConfigured          string
+	AgentRegistrationFailed          string
+	UnauthorizedAccessAttempt        string
+	ConfigTamperingDetected          string
+	AnomalousBehavior                string
+}{
+	CmdSigned:                        "CMD_SIGNED",
+	CmdSignatureVerificationFailed:   "CMD_SIGNATURE_VERIFICATION_FAILED",
+	CmdSignatureVerificationSuccess:  "CMD_SIGNATURE_VERIFICATION_SUCCESS",
+	UpdateNonceInvalid:               "UPDATE_NONCE_INVALID",
+	UpdateSignatureVerificationFailed: "UPDATE_SIGNATURE_VERIFICATION_FAILED",
+	MachineIDMismatch:                "MACHINE_ID_MISMATCH",
+	AuthJWTValidationFailed:          "AUTH_JWT_VALIDATION_FAILED",
+	PrivateKeyNotConfigured:          "PRIVATE_KEY_NOT_CONFIGURED",
+	AgentRegistrationFailed:          "AGENT_REGISTRATION_FAILED",
+	UnauthorizedAccessAttempt:        "UNAUTHORIZED_ACCESS_ATTEMPT",
+	ConfigTamperingDetected:          "CONFIG_TAMPERING_DETECTED",
+	AnomalousBehavior:                "ANOMALOUS_BEHAVIOR",
+}
+
+// IsCritical returns true if the event is of critical severity
+func (e *SecurityEvent) IsCritical() bool {
+	return e.Level == "CRITICAL"
+}
+
+// IsWarning returns true if the event is a warning
+func (e *SecurityEvent) IsWarning() bool {
+	return e.Level == "WARNING"
+}
+
+// ShouldLogToDatabase determines if this event should be stored in the database
+func (e *SecurityEvent) ShouldLogToDatabase(logToDatabase bool) bool {
+	return logToDatabase && (e.IsCritical() || e.IsWarning())
+}
+
+// HashIPAddress hashes the IP address for privacy
+func (e *SecurityEvent) HashIPAddress() {
+	if e.IPAddress != "" {
+		hash := sha256.Sum256([]byte(e.IPAddress))
+		e.IPAddress = fmt.Sprintf("hashed:%x", hash[:8]) // Store first 8 bytes of hash
+	}
+}
+
+// NewSecurityEvent creates a new security event with current timestamp
+func NewSecurityEvent(level, eventType string, agentID uuid.UUID, message string) *SecurityEvent {
+	return &SecurityEvent{
+		Timestamp: time.Now().UTC(),
+		Level:     level,
+		EventType: eventType,
+		AgentID:   agentID,
+		Message:   message,
+		Details:   make(map[string]interface{}),
+		Metadata:  make(map[string]interface{}),
+	}
+}
+
+// WithTrace adds a trace ID to the event
+func (e *SecurityEvent) WithTrace(traceID string) *SecurityEvent {
+	e.TraceID = traceID
+	return e
+}
+
+// WithIPAddress adds an IP address to the event
+func (e *SecurityEvent) WithIPAddress(ip string) *SecurityEvent {
+	e.IPAddress = ip
+	return e
+}
+
+// WithDetail adds a key-value detail to the event
+func (e *SecurityEvent) WithDetail(key string, value interface{}) *SecurityEvent {
+	e.Details[key] = value
+	return e
+}
+
+// WithMetadata adds a key-value metadata to the event
+func (e *SecurityEvent) WithMetadata(key string, value interface{}) *SecurityEvent {
+	e.Metadata[key] = value
+	return e
+}