jpetree331
f97d4845af
Complete RedFlag codebase with two major security audit implementations.
== A-1: Ed25519 Key Rotation Support ==
Server:
- SignCommand sets SignedAt timestamp and KeyID on every signature
- signing_keys database table (migration 020) for multi-key rotation
- InitializePrimaryKey registers active key at startup
- /api/v1/public-keys endpoint for rotation-aware agents
- SigningKeyQueries for key lifecycle management
Agent:
- Key-ID-aware verification via CheckKeyRotation
- FetchAndCacheAllActiveKeys for rotation pre-caching
- Cache metadata with TTL and staleness fallback
- SecurityLogger events for key rotation and command signing
== A-2: Replay Attack Fixes (F-1 through F-7) ==
F-5 CRITICAL - RetryCommand now signs via signAndCreateCommand
F-1 HIGH - v3 format: "{agent_id}:{cmd_id}:{type}:{hash}:{ts}"
F-7 HIGH - Migration 026: expires_at column with partial index
F-6 HIGH - GetPendingCommands/GetStuckCommands filter by expires_at
F-2 HIGH - Agent-side executedIDs dedup map with cleanup
F-4 HIGH - commandMaxAge reduced from 24h to 4h
F-3 CRITICAL - Old-format commands rejected after 48h via CreatedAt
Verification fixes: migration idempotency (ETHOS #4), log format
compliance (ETHOS #1), stale comments updated.
All 24 tests passing. Docker --no-cache build verified.
See docs/ for full audit reports and deviation log (DEV-001 to DEV-019).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
79 lines
2.9 KiB
Go
79 lines
2.9 KiB
Go
package models
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// SystemEvent represents a unified event log entry for all system events
|
|
// This implements the unified event logging system from docs/ERROR_FLOW_AUDIT.md
|
|
type SystemEvent struct {
|
|
ID uuid.UUID `json:"id" db:"id"`
|
|
AgentID *uuid.UUID `json:"agent_id,omitempty" db:"agent_id"` // Pointer to allow NULL for server events
|
|
EventType string `json:"event_type" db:"event_type"` // e.g., 'agent_update', 'agent_startup', 'server_build'
|
|
EventSubtype string `json:"event_subtype" db:"event_subtype"` // e.g., 'success', 'failed', 'info', 'warning'
|
|
Severity string `json:"severity" db:"severity"` // 'info', 'warning', 'error', 'critical'
|
|
Component string `json:"component" db:"component"` // 'agent', 'server', 'build', 'download', 'config', etc.
|
|
Message string `json:"message" db:"message"`
|
|
Metadata map[string]interface{} `json:"metadata,omitempty" db:"metadata"` // JSONB for structured data
|
|
CreatedAt time.Time `json:"created_at" db:"created_at"`
|
|
}
|
|
|
|
// Event type constants
|
|
const (
|
|
EventTypeAgentStartup = "agent_startup"
|
|
EventTypeAgentRegistration = "agent_registration"
|
|
EventTypeAgentCheckIn = "agent_checkin"
|
|
EventTypeAgentScan = "agent_scan"
|
|
EventTypeAgentUpdate = "agent_update"
|
|
EventTypeAgentConfig = "agent_config"
|
|
EventTypeAgentMigration = "agent_migration"
|
|
EventTypeAgentShutdown = "agent_shutdown"
|
|
EventTypeServerBuild = "server_build"
|
|
EventTypeServerDownload = "server_download"
|
|
EventTypeServerConfig = "server_config"
|
|
EventTypeServerAuth = "server_auth"
|
|
EventTypeDownload = "download"
|
|
EventTypeMigration = "migration"
|
|
EventTypeError = "error"
|
|
)
|
|
|
|
// Event subtype constants
|
|
const (
|
|
SubtypeSuccess = "success"
|
|
SubtypeFailed = "failed"
|
|
SubtypeInfo = "info"
|
|
SubtypeWarning = "warning"
|
|
SubtypeCritical = "critical"
|
|
SubtypeDownloadFailed = "download_failed"
|
|
SubtypeValidationFailed = "validation_failed"
|
|
SubtypeConfigCorrupted = "config_corrupted"
|
|
SubtypeMigrationNeeded = "migration_needed"
|
|
SubtypePanicRecovered = "panic_recovered"
|
|
SubtypeTokenExpired = "token_expired"
|
|
SubtypeNetworkTimeout = "network_timeout"
|
|
SubtypePermissionDenied = "permission_denied"
|
|
SubtypeServiceUnavailable = "service_unavailable"
|
|
)
|
|
|
|
// Severity constants
|
|
const (
|
|
SeverityInfo = "info"
|
|
SeverityWarning = "warning"
|
|
SeverityError = "error"
|
|
SeverityCritical = "critical"
|
|
)
|
|
|
|
// Component constants
|
|
const (
|
|
ComponentAgent = "agent"
|
|
ComponentServer = "server"
|
|
ComponentBuild = "build"
|
|
ComponentDownload = "download"
|
|
ComponentConfig = "config"
|
|
ComponentDatabase = "database"
|
|
ComponentNetwork = "network"
|
|
ComponentSecurity = "security"
|
|
ComponentMigration = "migration"
|
|
) |