Skip to content

Commit 8eb57bf

Browse files
danyi1212danyi1212
authored
dan/per-12689-pdp-clean-health-check-logs (#280)
* Add enforcement API logs * Removed spamming watchdog logs * Changed debug log serialization error
1 parent 25fc179 commit 8eb57bf

File tree

5 files changed

+158
-11
lines changed

5 files changed

+158
-11
lines changed

‎pdp-server/src/opa_client/allowed.rs‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,35 @@
11
use crate::opa_client::{send_request_to_opa, ForwardingError};
22
use crate::state::AppState;
3+
use log::{debug, info};
34
use serde::{Deserialize, Serialize};
45
use std::collections::HashMap;
6+
use std::fmt::Display;
57
use utoipa::ToSchema;
68

79
/// Send an allowed query to OPA and get the result
810
pub async fn query_allowed(
911
state: &AppState,
1012
query: &AllowedQuery,
1113
) -> Result<AllowedResult, ForwardingError> {
12-
send_request_to_opa::<AllowedResult, _>(state, "/v1/data/permit/root", query).await
14+
let result =
15+
send_request_to_opa::<AllowedResult, _>(state, "/v1/data/permit/root", query).await;
16+
if let Ok(response) = &result {
17+
if state.config.debug.unwrap_or(false) {
18+
info!(
19+
"permit.check(\"{user}\", \"{action}\", \"{resource}\") -> {result}",
20+
user = query.user,
21+
action = query.action,
22+
resource = query.resource,
23+
result = response.allow,
24+
);
25+
debug!(
26+
"Query: {}\nResult: {}",
27+
serde_json::to_string_pretty(query).unwrap_or("Serialization error".to_string()),
28+
serde_json::to_string_pretty(response).unwrap_or("Serialization error".to_string()),
29+
);
30+
}
31+
}
32+
result
1333
}
1434

1535
#[derive(Debug, Serialize, Deserialize, ToSchema, Clone, PartialEq)]
@@ -30,6 +50,12 @@ pub struct User {
3050
pub attributes: HashMap<String, serde_json::Value>,
3151
}
3252

53+
impl Display for User {
54+
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
55+
write!(f, "{}", self.key)
56+
}
57+
}
58+
3359
#[derive(Debug, Serialize, Deserialize, ToSchema, Clone, PartialEq)]
3460
pub struct Resource {
3561
/// Type of the resource
@@ -48,6 +74,18 @@ pub struct Resource {
4874
pub context: HashMap<String, serde_json::Value>,
4975
}
5076

77+
impl Display for Resource {
78+
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
79+
if let Some(key) = &self.key {
80+
write!(f, "{}:{}", self.r#type, key)
81+
} else if let Some(tenant) = &self.tenant {
82+
write!(f, "{}@{}", self.r#type, tenant)
83+
} else {
84+
write!(f, "{}", self.r#type)
85+
}
86+
}
87+
}
88+
5189
/// Authorization query parameters for the allowed endpoint
5290
#[derive(Debug, Serialize, Deserialize, ToSchema, Clone, PartialEq)]
5391
pub struct AllowedQuery {

‎pdp-server/src/opa_client/allowed_bulk.rs‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,31 @@ pub async fn query_allowed_bulk(
2727
let bulk_query = BulkAuthorizationQuery {
2828
checks: queries.to_vec(),
2929
};
30-
send_request_to_opa::<BulkAuthorizationResult, _>(state, "/v1/data/permit/bulk", &bulk_query)
31-
.await
30+
let result = send_request_to_opa::<BulkAuthorizationResult, _>(
31+
state,
32+
"/v1/data/permit/bulk",
33+
&bulk_query,
34+
)
35+
.await;
36+
37+
// Add debug logging if enabled
38+
if let Ok(response) = &result {
39+
if state.config.debug.unwrap_or(false) {
40+
let allowed_count = response.allow.iter().filter(|r| r.allow).count();
41+
log::info!(
42+
"permit.bulk_check({} queries) -> {} allowed, {} denied",
43+
queries.len(),
44+
allowed_count,
45+
response.allow.len() - allowed_count
46+
);
47+
log::debug!(
48+
"Query: {}\nResult: {}",
49+
serde_json::to_string_pretty(&bulk_query)
50+
.unwrap_or("Serialization error".to_string()),
51+
serde_json::to_string_pretty(response).unwrap_or("Serialization error".to_string()),
52+
);
53+
}
54+
}
55+
56+
result
3257
}

‎pdp-server/src/opa_client/authorized_users.rs‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,27 @@ pub async fn query_authorized_users(
2424
// Process the result to extract the nested 'result' field if it exists
2525
if let serde_json::Value::Object(map) = &result {
2626
if let Some(inner_result) = map.get("result") {
27-
return Ok(serde_json::from_value(inner_result.clone())?);
27+
let authorized_result: AuthorizedUsersResult =
28+
serde_json::from_value(inner_result.clone())?;
29+
30+
// Add debug logging if enabled
31+
if state.config.debug.unwrap_or(false) {
32+
log::info!(
33+
"permit.authorized_users(\"{}\", \"{}\") -> {} users",
34+
query.action,
35+
query.resource,
36+
authorized_result.users.len()
37+
);
38+
log::debug!(
39+
"Query: {}\nResult: {}",
40+
serde_json::to_string_pretty(query)
41+
.unwrap_or("Serialization error".to_string()),
42+
serde_json::to_string_pretty(&authorized_result)
43+
.unwrap_or("Serialization error".to_string()),
44+
);
45+
}
46+
47+
return Ok(authorized_result);
2848
}
2949
}
3050

@@ -40,11 +60,26 @@ pub async fn query_authorized_users(
4060
.clone()
4161
.unwrap_or_else(|| "default".to_string());
4262

43-
Ok(AuthorizedUsersResult {
63+
let empty_result = AuthorizedUsersResult {
4464
resource: format!("{}:{}", query.resource.r#type, resource_key),
4565
tenant,
4666
users: HashMap::new(),
47-
})
67+
};
68+
69+
// Add debug logging if enabled
70+
if state.config.debug.unwrap_or(false) {
71+
log::info!(
72+
"permit.authorized_users(\"{}\", \"{}\") -> 0 users",
73+
query.action,
74+
query.resource
75+
);
76+
log::debug!(
77+
"Query: {}\nResult: empty",
78+
serde_json::to_string_pretty(query)?
79+
);
80+
}
81+
82+
Ok(empty_result)
4883
}
4984

5085
/// Query parameters for the authorized users endpoint

‎pdp-server/src/opa_client/user_permissions.rs‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,29 @@ pub async fn query_user_permissions(
2222

2323
if let serde_json::Value::Object(result_map) = response {
2424
if let Some(permissions) = result_map.get("permissions") {
25-
return Ok(serde_json::from_value(permissions.clone())?);
25+
let result: HashMap<String, UserPermissionsResult> =
26+
serde_json::from_value(permissions.clone())?;
27+
28+
// Add debug logging if enabled
29+
if state.config.debug.unwrap_or(false) {
30+
log::info!(
31+
"permit.user_permissions(\"{}\", tenants={:?}, resources={:?}, resource_types={:?}) -> {} permissions",
32+
query.user,
33+
query.tenants,
34+
query.resources,
35+
query.resource_types,
36+
result.len()
37+
);
38+
log::debug!(
39+
"Query: {}\nResult: {}",
40+
serde_json::to_string_pretty(query)
41+
.unwrap_or("Serialization error".to_string()),
42+
serde_json::to_string_pretty(&result)
43+
.unwrap_or("Serialization error".to_string()),
44+
);
45+
}
46+
47+
return Ok(result);
2648
} else {
2749
debug!("No 'permissions' field found in result");
2850
}
@@ -31,7 +53,24 @@ pub async fn query_user_permissions(
3153
}
3254

3355
// If we couldn't find the permissions, return an empty map
34-
Ok(HashMap::new())
56+
let empty_result = HashMap::new();
57+
58+
// Add debug logging if enabled
59+
if state.config.debug.unwrap_or(false) {
60+
log::info!(
61+
"permit.user_permissions(\"{}\", tenants={:?}, resources={:?}, resource_types={:?}) -> 0 permissions",
62+
query.user,
63+
query.tenants,
64+
query.resources,
65+
query.resource_types
66+
);
67+
log::debug!(
68+
"Query: {}\nResult: empty",
69+
serde_json::to_string_pretty(query)?
70+
);
71+
}
72+
73+
Ok(empty_result)
3574
}
3675

3776
#[derive(Debug, Serialize, Deserialize, ToSchema, Clone, PartialEq)]

‎watchdog/src/service.rs‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
use crate::health::HealthCheck;
22
use crate::stats::ServiceWatchdogStats;
33
use crate::{CommandWatchdog, CommandWatchdogOptions};
4-
use log::{debug, error, info, warn};
4+
use log::{debug, error, info, log, warn};
55
use std::sync::Arc;
66
use std::time::Duration;
77
use tokio::process::Command;
@@ -130,7 +130,12 @@ impl ServiceWatchdog {
130130
}
131131

132132
if consecutive_failures > 0 {
133-
info!(
133+
log!(
134+
if consecutive_failures < opt.health_check_failure_threshold / 2 {
135+
log::Level::Debug
136+
} else {
137+
log::Level::Info
138+
},
134139
"Service '{}' health restored after {} failures",
135140
command_watchdog.program_name, consecutive_failures
136141
);
@@ -146,7 +151,12 @@ impl ServiceWatchdog {
146151
stats.increment_failed_health_checks();
147152
consecutive_failures += 1;
148153

149-
warn!(
154+
log!(
155+
if consecutive_failures < opt.health_check_failure_threshold / 2 {
156+
log::Level::Debug
157+
} else {
158+
log::Level::Warn
159+
},
150160
"Service '{}' health check failed: {} (consecutive failures: {}/{})",
151161
command_watchdog.program_name,
152162
e,

0 commit comments

Comments
 (0)