* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
208 lines
6 KiB
Python
208 lines
6 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Python imports
|
|
from datetime import timedelta
|
|
import logging
|
|
from typing import Callable, Iterable
|
|
|
|
# Django imports
|
|
from django.conf import settings
|
|
from django.utils import timezone
|
|
from django.db.models import F, Window, Subquery
|
|
from django.db.models.functions import RowNumber
|
|
|
|
# Third party imports
|
|
from celery import shared_task
|
|
|
|
# Module imports
|
|
from plane.db.models import (
|
|
EmailNotificationLog,
|
|
PageVersion,
|
|
APIActivityLog,
|
|
IssueDescriptionVersion,
|
|
WebhookLog,
|
|
)
|
|
from plane.utils.exception_logger import log_exception
|
|
|
|
|
|
logger = logging.getLogger("plane.worker")
|
|
BATCH_SIZE = 500
|
|
|
|
|
|
def process_cleanup_task(
|
|
queryset_func: Callable[[], Iterable],
|
|
model,
|
|
task_name: str,
|
|
):
|
|
"""
|
|
Batch-delete expired rows for the given model from PostgreSQL.
|
|
|
|
Args:
|
|
queryset_func: Callable returning an iterable of primary keys to delete.
|
|
model: Django model class.
|
|
task_name: Name of the task for logging.
|
|
"""
|
|
logger.info(f"Starting {task_name} cleanup task")
|
|
|
|
total_deleted = 0
|
|
total_batches = 0
|
|
batch: list = []
|
|
|
|
def flush(ids: list) -> None:
|
|
nonlocal total_deleted, total_batches
|
|
if not ids:
|
|
return
|
|
total_batches += 1
|
|
try:
|
|
# `all_objects` is a plain manager, so this is a hard delete — rows
|
|
# are removed from PostgreSQL immediately rather than soft-deleted.
|
|
delete_result = model.all_objects.filter(id__in=ids).delete()
|
|
deleted = delete_result[0] if isinstance(delete_result, tuple) else 0
|
|
total_deleted += deleted
|
|
except Exception as e:
|
|
# Log and skip a failed batch rather than aborting the whole run, so
|
|
# a single bad batch doesn't block cleanup of the remaining rows.
|
|
log_exception(e)
|
|
|
|
for record_id in queryset_func():
|
|
batch.append(record_id)
|
|
if len(batch) >= BATCH_SIZE:
|
|
flush(batch)
|
|
batch = []
|
|
|
|
# Flush the final partial batch
|
|
flush(batch)
|
|
|
|
logger.info(
|
|
f"{task_name} cleanup task completed",
|
|
extra={"total_records_deleted": total_deleted, "total_batches": total_batches},
|
|
)
|
|
|
|
|
|
# Queryset functions for each cleanup task — each yields primary keys to delete
|
|
def get_api_logs_queryset():
|
|
"""Get API activity logs older than the API retention window."""
|
|
cutoff_time = timezone.now() - timedelta(days=settings.API_ACTIVITY_LOG_RETENTION_DAYS)
|
|
logger.info(f"API logs cutoff time: {cutoff_time}")
|
|
return (
|
|
APIActivityLog.all_objects.filter(created_at__lte=cutoff_time)
|
|
.values_list("id", flat=True)
|
|
.iterator(chunk_size=BATCH_SIZE)
|
|
)
|
|
|
|
|
|
def get_email_logs_queryset():
|
|
"""Get email logs older than the email retention window."""
|
|
cutoff_time = timezone.now() - timedelta(days=settings.EMAIL_LOG_RETENTION_DAYS)
|
|
logger.info(f"Email logs cutoff time: {cutoff_time}")
|
|
return (
|
|
EmailNotificationLog.all_objects.filter(sent_at__lte=cutoff_time)
|
|
.values_list("id", flat=True)
|
|
.iterator(chunk_size=BATCH_SIZE)
|
|
)
|
|
|
|
|
|
def get_page_versions_queryset():
|
|
"""Get page versions beyond the maximum allowed (20 per page)."""
|
|
subq = (
|
|
PageVersion.all_objects.annotate(
|
|
row_num=Window(
|
|
expression=RowNumber(),
|
|
partition_by=[F("page_id")],
|
|
order_by=F("created_at").desc(),
|
|
)
|
|
)
|
|
.filter(row_num__gt=20)
|
|
.values("id")
|
|
)
|
|
|
|
return (
|
|
PageVersion.all_objects.filter(id__in=Subquery(subq))
|
|
.values_list("id", flat=True)
|
|
.iterator(chunk_size=BATCH_SIZE)
|
|
)
|
|
|
|
|
|
def get_issue_description_versions_queryset():
|
|
"""Get issue description versions beyond the maximum allowed (20 per issue)."""
|
|
subq = (
|
|
IssueDescriptionVersion.all_objects.annotate(
|
|
row_num=Window(
|
|
expression=RowNumber(),
|
|
partition_by=[F("issue_id")],
|
|
order_by=F("created_at").desc(),
|
|
)
|
|
)
|
|
.filter(row_num__gt=20)
|
|
.values("id")
|
|
)
|
|
|
|
return (
|
|
IssueDescriptionVersion.all_objects.filter(id__in=Subquery(subq))
|
|
.values_list("id", flat=True)
|
|
.iterator(chunk_size=BATCH_SIZE)
|
|
)
|
|
|
|
|
|
def get_webhook_logs_queryset():
|
|
"""Get webhook logs older than the webhook retention window."""
|
|
cutoff_time = timezone.now() - timedelta(days=settings.WEBHOOK_LOG_RETENTION_DAYS)
|
|
logger.info(f"Webhook logs cutoff time: {cutoff_time}")
|
|
return (
|
|
WebhookLog.all_objects.filter(created_at__lte=cutoff_time)
|
|
.order_by("created_at")
|
|
.values_list("id", flat=True)
|
|
.iterator(chunk_size=BATCH_SIZE)
|
|
)
|
|
|
|
|
|
@shared_task
|
|
def delete_api_logs():
|
|
"""Delete old API activity logs."""
|
|
process_cleanup_task(
|
|
queryset_func=get_api_logs_queryset,
|
|
model=APIActivityLog,
|
|
task_name="API Activity Log",
|
|
)
|
|
|
|
|
|
@shared_task
|
|
def delete_email_notification_logs():
|
|
"""Delete old email notification logs."""
|
|
process_cleanup_task(
|
|
queryset_func=get_email_logs_queryset,
|
|
model=EmailNotificationLog,
|
|
task_name="Email Notification Log",
|
|
)
|
|
|
|
|
|
@shared_task
|
|
def delete_page_versions():
|
|
"""Delete excess page versions."""
|
|
process_cleanup_task(
|
|
queryset_func=get_page_versions_queryset,
|
|
model=PageVersion,
|
|
task_name="Page Version",
|
|
)
|
|
|
|
|
|
@shared_task
|
|
def delete_issue_description_versions():
|
|
"""Delete excess issue description versions."""
|
|
process_cleanup_task(
|
|
queryset_func=get_issue_description_versions_queryset,
|
|
model=IssueDescriptionVersion,
|
|
task_name="Issue Description Version",
|
|
)
|
|
|
|
|
|
@shared_task
|
|
def delete_webhook_logs():
|
|
"""Delete old webhook logs."""
|
|
process_cleanup_task(
|
|
queryset_func=get_webhook_logs_queryset,
|
|
model=WebhookLog,
|
|
task_name="Webhook Log",
|
|
)
|