Events: Add outbound detail protobufs, request status code, and update event encrypt filter. (#1569)

* feat (events): Add status code to audit events

* feat (events): Add the resp proto msg to every audit event

* chore (events): Update eventlogger dep

This latest version will redact any map and/or map field which isn't
explicitly classified via a Taggable interface

* feat (events): Begin to add tagging to response proto msgs

internal/gen/controller/api/services/auth_method_service.pb.go

@@ -873,14 +873,14 @@ type AuthenticateRequest struct {
 	unknownFields protoimpl.UnknownFields
 
 	// The ID of the Auth Method in the system that should be used for authentication.
-	AuthMethodId string `protobuf:"bytes,1,opt,name=auth_method_id,proto3" json:"auth_method_id,omitempty"`
+	AuthMethodId string `protobuf:"bytes,1,opt,name=auth_method_id,proto3" json:"auth_method_id,omitempty" class:"public"` // @gotags: `class:"public"`
 	// This can be "cookie" or "token". If not provided, "token" will be used. "cookie" activates a split-cookie method where the token is split partially between http-only and regular cookies in order
 	// to keep it safe from rogue JS in the browser.
 	TokenType string `protobuf:"bytes,2,opt,name=token_type,proto3" json:"token_type,omitempty"`
 	// Attributes are passed to the Auth Method; the valid keys and values depend on the type of Auth Method as well as the command.
 	Attributes *structpb.Struct `protobuf:"bytes,4,opt,name=attributes,proto3" json:"attributes,omitempty"`
 	// The command to perform.
-	Command string `protobuf:"bytes,5,opt,name=command,proto3" json:"command,omitempty"`
+	Command string `protobuf:"bytes,5,opt,name=command,proto3" json:"command,omitempty" class:"public"` // @gotags: `class:"public"`
 }
 
 func (x *AuthenticateRequest) Reset() {
@@ -951,7 +951,7 @@ type AuthenticateResponse struct {
 	// Valid keys and values depend on the type of Auth Method as well as the command.
 	Attributes *structpb.Struct `protobuf:"bytes,4,opt,name=attributes,proto3" json:"attributes,omitempty"`
 	// The command that was performed.
-	Command string `protobuf:"bytes,5,opt,name=command,proto3" json:"command,omitempty"`
+	Command string `protobuf:"bytes,5,opt,name=command,proto3" json:"command,omitempty" class:"public"` // @gotags: `class:"public"`
 }
 
 func (x *AuthenticateResponse) Reset() {

internal/gen/controller/api/services/auth_method_service_taggable.go

@@ -0,0 +1,63 @@
+package services
+
+import "github.com/hashicorp/eventlogger/filters/encrypt"
+
+// Tags implements the encrypt.Taggable interface which allows
+// AuthenticateResponse Attributes to be classified for the encrypt filter.
+func (req *AuthenticateResponse) Tags() ([]encrypt.PointerTag, error) {
+	if req.Attributes == nil {
+		return nil, nil
+	}
+	return []encrypt.PointerTag{
+		// public fields
+		{
+			Pointer:        "/Attributes/Fields/account_id",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/approximate_last_used_time",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/auth_method_id",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/authorized_actions",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/created_time",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/expiration_time",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/id",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/scope",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/token_type",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/updated_time",
+			Classification: encrypt.PublicClassification,
+		},
+		{
+			Pointer:        "/Attributes/Fields/user_id",
+			Classification: encrypt.PublicClassification,
+		},
+		// secret fields
+		{
+			Pointer:        "/Attributes/Fields/token",
+			Classification: encrypt.SecretClassification,
+		},
+	}, nil
+}

internal/gen/controller/api/services/auth_method_service_taggable_test.go

@@ -0,0 +1,97 @@
+package services
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary/sdk/wrapper"
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/eventlogger/filters/encrypt"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestScope_Tags(t *testing.T) {
+	ctx := context.Background()
+	now := time.Now()
+	wrapper := wrapper.TestWrapper(t)
+	testEncryptingFilter := &encrypt.Filter{
+		Wrapper:  wrapper,
+		HmacSalt: []byte("salt"),
+		HmacInfo: []byte("info"),
+	}
+
+	tests := []struct {
+		name      string
+		testEvent *eventlogger.Event
+		wantEvent *eventlogger.Event
+	}{
+		{
+			name: "validate-filtering",
+			testEvent: &eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &AuthenticateResponse{
+					Command: "public-command",
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"account_id":                 structpb.NewStringValue("public-account_id"),
+							"approximate_last_used_time": structpb.NewStringValue("public-approximate_last_used_time"),
+							"auth_method_id":             structpb.NewStringValue("public-auth_method_id"),
+							"authorized_actions":         structpb.NewStringValue("public-authorized_actions"),
+							"created_time":               structpb.NewStringValue("public-created_time"),
+							"expiration_time":            structpb.NewStringValue("public-expiration_time"),
+							"id":                         structpb.NewStringValue("public-id"),
+							"scope":                      structpb.NewStringValue("public-scope"),
+							"token_type":                 structpb.NewStringValue("public-token_type"),
+							"updated_time":               structpb.NewStringValue("public-updated_time"),
+							"user_id":                    structpb.NewStringValue("public-user_id"),
+							"token":                      structpb.NewStringValue("secret-token"),
+						},
+					},
+				},
+			},
+			wantEvent: &eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &AuthenticateResponse{
+					Command: "public-command",
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"account_id":                 structpb.NewStringValue("public-account_id"),
+							"approximate_last_used_time": structpb.NewStringValue("public-approximate_last_used_time"),
+							"auth_method_id":             structpb.NewStringValue("public-auth_method_id"),
+							"authorized_actions":         structpb.NewStringValue("public-authorized_actions"),
+							"created_time":               structpb.NewStringValue("public-created_time"),
+							"expiration_time":            structpb.NewStringValue("public-expiration_time"),
+							"id":                         structpb.NewStringValue("public-id"),
+							"scope":                      structpb.NewStringValue("public-scope"),
+							"token_type":                 structpb.NewStringValue("public-token_type"),
+							"updated_time":               structpb.NewStringValue("public-updated_time"),
+							"user_id":                    structpb.NewStringValue("public-user_id"),
+							"token":                      structpb.NewStringValue("<REDACTED>"),
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			got, err := testEncryptingFilter.Process(ctx, tt.testEvent)
+			require.NoError(err)
+			require.NotNil(got)
+			actualJson, err := json.Marshal(got)
+			require.NoError(err)
+			t.Log(string(actualJson))
+
+			wantJson, err := json.Marshal(tt.wantEvent)
+			require.NoError(err)
+			assert.JSONEq(string(wantJson), string(actualJson))
+		})
+	}
+}