Files
pmg/internal/eventlog/eventlog.go
T
EapolSniperandGitHub 698bd3dd13 Add comprehensive event logging system (#82)
* Add comprehensive event logging system with OS-specific location and rotation

Features:
- Event logging for security-relevant events (malware detection, installations)
- OS-specific default log locations (~/.pmg/logs/ on macOS/Linux, %LOCALAPPDATA%\pmg\logs\ on Windows)
- Automatic 7-day log rotation with daily log files (YYYYMMDD-pmg.log format)
- Support for custom log files via --log flag
- Thread-safe JSON logging with zero external dependencies

Implementation:
- New internal/eventlog package with comprehensive logging functionality
- Integration with guard.go to log malware detections and blocks
- Integration with main.go for initialization and cleanup
- Log file naming: YYYYMMDD-pmg.log (e.g., 20251216-pmg.log)
- Fail-safe design - PMG continues if logging fails

Event Types:
- malware_blocked: Malicious package blocked from installation
- malware_confirmed: User proceeded with flagged package
- install_allowed: Clean package installation allowed
- install_started: Package manager command initiated
- error: Error events

Testing:
- Comprehensive test suite with 6 passing tests
- Verified with real malware detection (e.g., @postman/tunnel-agent)
- Works with all package managers (npm, pip, etc.)

Technical Details:
- Thread-safe with mutex protection
- JSON format for easy parsing
- Automatic cleanup of logs >7 days old
- Background cleanup goroutine
- Uses only Go standard library (encoding/json, os, path/filepath, sync, time)

* Add update command support and improve event logging robustness

Features:
- Add support for npm/pnpm/bun/yarn update/upgrade/ci commands
- These commands now scan packages for malware before updating
- Closes security gap where update commands bypassed PMG protection

Improvements:
- Make event logging more defensive (graceful failure when not initialized)
- Add nil check for packageManager in guard to prevent test failures
- Add comprehensive tests for update commands

Testing:
- All 33+ unit tests passing
- Integration tests verified with real malware detection
- Tested with npm update, npm ci, npm upgrade, pnpm update, yarn upgrade

Files changed:
- packagemanager/npm.go: Added update/upgrade/ci to InstallCommands
- packagemanager/npm_test.go: Added 4 new test cases for update commands
- guard/guard.go: Added nil check for packageManager
- internal/eventlog/eventlog.go: Made logging more defensive

* Address review feedback: use log.Warnf instead of silently failing

Replace silent error handling in cleanupOldLogs with log.Warnf
to avoid completely swallowing errors when reading log directory.

Fixes reviewer feedback from abhisek.

* Remove update/upgrade command support, keep logging improvements

- Remove update/upgrade/ci commands from InstallCommands for npm, pnpm, bun, yarn
- Remove special handling for update/upgrade/ci commands in ParseCommand
- Remove update command test cases and restore original test
- Preserve logging improvements (nil check in guard.go, defensive check in eventlog.go)

All tests passing.
2025-12-31 16:05:31 +05:30

351 lines
8.5 KiB
Go

package eventlog
import (
"encoding/json"
"fmt"
"io"
"os"
"path/filepath"
"runtime"
"sync"
"time"
"github.com/safedep/dry/log"
)
// EventType represents the type of event being logged
type EventType string
const (
EventTypeMalwareBlocked EventType = "malware_blocked"
EventTypeMalwareConfirmed EventType = "malware_confirmed"
EventTypeInstallAllowed EventType = "install_allowed"
EventTypeInstallStarted EventType = "install_started"
EventTypeDependencyResolved EventType = "dependency_resolved"
EventTypeError EventType = "error"
)
// Event represents a security event
type Event struct {
Timestamp time.Time `json:"timestamp"`
EventType EventType `json:"event_type"`
Message string `json:"message"`
PackageName string `json:"package_name,omitempty"`
Version string `json:"version,omitempty"`
Ecosystem string `json:"ecosystem,omitempty"`
Details map[string]interface{} `json:"details,omitempty"`
}
// Logger represents an event logger
type Logger struct {
file *os.File
writer io.Writer
mu sync.Mutex
active bool
}
var (
globalLogger *Logger
once sync.Once
)
// GetDefaultLogDir returns the default log directory based on the OS
func GetDefaultLogDir() (string, error) {
var baseDir string
switch runtime.GOOS {
case "windows":
// Windows: %LOCALAPPDATA%\pmg\logs or %USERPROFILE%\.pmg\logs
baseDir = os.Getenv("LOCALAPPDATA")
if baseDir == "" {
baseDir = os.Getenv("USERPROFILE")
if baseDir == "" {
return "", fmt.Errorf("could not determine Windows user directory")
}
return filepath.Join(baseDir, ".pmg", "logs"), nil
}
return filepath.Join(baseDir, "pmg", "logs"), nil
case "darwin", "linux":
// macOS and Linux: ~/.pmg/logs
homeDir, err := os.UserHomeDir()
if err != nil {
return "", fmt.Errorf("could not determine home directory: %w", err)
}
return filepath.Join(homeDir, ".pmg", "logs"), nil
default:
return "", fmt.Errorf("unsupported operating system: %s", runtime.GOOS)
}
}
// Initialize sets up the global event logger with the default log directory
func Initialize() error {
logDir, err := GetDefaultLogDir()
if err != nil {
return err
}
return InitializeWithDir(logDir)
}
// InitializeWithFile sets up the global event logger with a specific file path
func InitializeWithFile(filePath string) error {
var initErr error
once.Do(func() {
globalLogger = &Logger{}
initErr = globalLogger.initWithFile(filePath)
})
return initErr
}
// InitializeWithDir sets up the global event logger with a custom log directory
func InitializeWithDir(logDir string) error {
var initErr error
once.Do(func() {
globalLogger = &Logger{}
initErr = globalLogger.init(logDir)
})
return initErr
}
// reinitializeForTest resets and reinitializes the logger for testing purposes
// This should only be used in tests
func reinitializeForTest(logDir string) error {
// Close existing logger if any
if globalLogger != nil {
globalLogger.Close()
}
// Reset once
once = sync.Once{}
// Initialize new logger
return InitializeWithDir(logDir)
}
// init initializes the logger with the specified directory
func (l *Logger) init(logDir string) error {
// Create log directory if it doesn't exist
if err := os.MkdirAll(logDir, 0755); err != nil {
return fmt.Errorf("failed to create log directory: %w", err)
}
// Create log file with timestamp-based naming
logFileName := time.Now().Format("20060102") + "-pmg.log"
logFilePath := filepath.Join(logDir, logFileName)
file, err := os.OpenFile(logFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
if err != nil {
return fmt.Errorf("failed to open log file: %w", err)
}
l.file = file
l.writer = file
l.active = true
// Clean up old logs in background
go l.cleanupOldLogs(logDir)
return nil
}
// initWithFile initializes the logger with a specific file path
func (l *Logger) initWithFile(filePath string) error {
// Create directory if it doesn't exist
dir := filepath.Dir(filePath)
if dir != "" && dir != "." {
if err := os.MkdirAll(dir, 0755); err != nil {
return fmt.Errorf("failed to create log directory: %w", err)
}
}
file, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
if err != nil {
return fmt.Errorf("failed to open log file: %w", err)
}
l.file = file
l.writer = file
l.active = true
// No cleanup needed for custom log files (user manages them)
return nil
}
// cleanupOldLogs removes log files older than 7 days
func (l *Logger) cleanupOldLogs(logDir string) {
cutoff := time.Now().AddDate(0, 0, -7)
entries, err := os.ReadDir(logDir)
if err != nil {
log.Warnf("Failed to read log directory for cleanup: %v", err)
return
}
for _, entry := range entries {
if entry.IsDir() {
continue
}
// Only process *-pmg.log files
name := entry.Name()
matched, err := filepath.Match("*-pmg.log", name)
if err != nil || !matched {
continue
}
filePath := filepath.Join(logDir, name)
info, err := entry.Info()
if err != nil {
continue
}
if info.ModTime().Before(cutoff) {
os.Remove(filePath)
}
}
}
// Log writes an event to the log file
func (l *Logger) Log(event Event) error {
if !l.active {
return nil
}
l.mu.Lock()
defer l.mu.Unlock()
// Set timestamp if not already set
if event.Timestamp.IsZero() {
event.Timestamp = time.Now()
}
// Marshal event to JSON
data, err := json.Marshal(event)
if err != nil {
return fmt.Errorf("failed to marshal event: %w", err)
}
// Write to file
_, err = l.writer.Write(append(data, '\n'))
if err != nil {
return fmt.Errorf("failed to write event: %w", err)
}
// Flush to ensure data is written
if l.file != nil {
l.file.Sync()
}
return nil
}
// Close closes the logger
func (l *Logger) Close() error {
if !l.active {
return nil
}
l.mu.Lock()
defer l.mu.Unlock()
l.active = false
if l.file != nil {
return l.file.Close()
}
return nil
}
// Global logging functions
// LogEvent logs an event using the global logger
func LogEvent(event Event) error {
if globalLogger == nil || !globalLogger.active {
// If logger is not initialized or not active, silently fail
return nil
}
return globalLogger.Log(event)
}
// LogMalwareBlocked logs when malware is blocked
func LogMalwareBlocked(packageName, version, ecosystem, reason string, details map[string]interface{}) {
event := Event{
EventType: EventTypeMalwareBlocked,
Message: fmt.Sprintf("Blocked installation of malicious package: %s@%s", packageName, version),
PackageName: packageName,
Version: version,
Ecosystem: ecosystem,
Details: details,
}
if details == nil {
event.Details = make(map[string]interface{})
}
event.Details["reason"] = reason
LogEvent(event)
}
// LogMalwareConfirmed logs when user confirms installation despite warning
func LogMalwareConfirmed(packageName, version, ecosystem string) {
event := Event{
EventType: EventTypeMalwareConfirmed,
Message: fmt.Sprintf("User confirmed installation of flagged package: %s@%s", packageName, version),
PackageName: packageName,
Version: version,
Ecosystem: ecosystem,
}
LogEvent(event)
}
// LogInstallAllowed logs when an installation is allowed
func LogInstallAllowed(packageName, version, ecosystem string, packageCount int) {
event := Event{
EventType: EventTypeInstallAllowed,
Message: fmt.Sprintf("Installation allowed for %s@%s (%d packages analyzed)", packageName, version, packageCount),
PackageName: packageName,
Version: version,
Ecosystem: ecosystem,
Details: map[string]interface{}{
"packages_analyzed": packageCount,
},
}
LogEvent(event)
}
// LogInstallStarted logs when an installation starts
func LogInstallStarted(packageManager string, args []string) {
event := Event{
EventType: EventTypeInstallStarted,
Message: fmt.Sprintf("Starting package installation with %s", packageManager),
Details: map[string]interface{}{
"package_manager": packageManager,
"arguments": args,
},
}
LogEvent(event)
}
// LogError logs an error event
func LogError(message string, err error) {
event := Event{
EventType: EventTypeError,
Message: message,
Details: map[string]interface{}{
"error": err.Error(),
},
}
LogEvent(event)
}
// Close closes the global logger
func Close() error {
if globalLogger != nil {
return globalLogger.Close()
}
return nil
}
// IsInitialized returns whether the global logger is initialized
func IsInitialized() bool {
return globalLogger != nil && globalLogger.active
}