91 lines
2.9 KiB
PHP
91 lines
2.9 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Str;
|
|
|
|
class AuditEvent extends Model
|
|
{
|
|
/** Sidebar threats-count badge cache key — busted by forgetThreatLoginCount() on each fake login. */
|
|
public const THREAT_COUNT_CACHE = 'threats:login_attempts_24h';
|
|
|
|
protected $guarded = [];
|
|
|
|
protected $casts = ['meta' => 'array'];
|
|
|
|
protected static function booted(): void
|
|
{
|
|
static::creating(fn (self $e) => $e->uuid ??= (string) Str::uuid());
|
|
}
|
|
|
|
public function getRouteKeyName(): string
|
|
{
|
|
return 'uuid';
|
|
}
|
|
|
|
public function user(): BelongsTo
|
|
{
|
|
return $this->belongsTo(User::class);
|
|
}
|
|
|
|
public function server(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Server::class);
|
|
}
|
|
|
|
/**
|
|
* Fake-login (honeypot) attempts in the last 24h for the sidebar Threats badge. Cached (the
|
|
* sidebar renders on every page) but busted the instant one is recorded (forgetThreatLoginCount),
|
|
* so the badge stays in step with the Threats page instead of lagging up to the TTL.
|
|
*/
|
|
public static function threatLoginCount24h(): int
|
|
{
|
|
return (int) Cache::remember(
|
|
self::THREAT_COUNT_CACHE,
|
|
60,
|
|
fn () => static::where('action', 'security.honeypot_login')->where('created_at', '>', now()->subDay())->count(),
|
|
);
|
|
}
|
|
|
|
public static function forgetThreatLoginCount(): void
|
|
{
|
|
Cache::forget(self::THREAT_COUNT_CACHE);
|
|
}
|
|
|
|
/** Actions that record a failure or security event — surfaced with a warning style. */
|
|
private const ERROR_ACTIONS = [
|
|
'auth.login_failed', 'auth.2fa_failed', 'auth.ip_banned',
|
|
'fail2ban.ban', 'wg.action-failed', 'deploy.staging_release_failed',
|
|
'deploy.public_failed', 'deploy.stable_failed', 'deploy.yank_failed',
|
|
'security.honeypot_hit', 'security.honeypot_login', 'security.honeytoken_used',
|
|
];
|
|
|
|
/**
|
|
* Human-readable, localized label for the raw action code (e.g. "wg.set-endpoint" ->
|
|
* "WireGuard-Endpoint geändert"). Falls back to a tidied form for unmapped/dynamic codes
|
|
* (e.g. the dynamic "harden.*.on|off") so nothing ever shows a bare machine code awkwardly.
|
|
*/
|
|
public function getActionLabelAttribute(): string
|
|
{
|
|
$labels = (array) trans('audit.actions');
|
|
|
|
return $labels[$this->action] ?? $this->prettyAction();
|
|
}
|
|
|
|
/** True when the entry represents a failure / security alert (drives the warning styling). */
|
|
public function getIsErrorAttribute(): bool
|
|
{
|
|
return in_array($this->action, self::ERROR_ACTIONS, true);
|
|
}
|
|
|
|
private function prettyAction(): string
|
|
{
|
|
$s = str_replace(['_', '-'], ' ', str_replace('.', ' · ', (string) $this->action));
|
|
|
|
return Str::ucfirst(trim($s));
|
|
}
|
|
}
|