refactor(agentapi): use slog for boundary logs

zedkipp · zedkipp · commit c1c56e33b980 · 2025-12-09T16:01:55.000-07:00
Replace fmt.Fprintf to stderr with structured slog logging for boundary
audit events. This integrates with coder's existing logging infrastructure
and provides better observability.
diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go
@@ -220,6 +220,7 @@ func New(opts Options, workspace database.Workspace) *API {
 	}
 
 	api.BoundaryLogsAPI = &BoundaryLogsAPI{
+		Log:         opts.Log,
 		WorkspaceID: opts.WorkspaceID,
 	}
 
diff --git a/coderd/agentapi/boundary_logs.go b/coderd/agentapi/boundary_logs.go
@@ -2,50 +2,50 @@ package agentapi
 
 import (
 	"context"
-	"fmt"
-	"os"
 	"time"
 
 	"github.com/google/uuid"
 
+	"cdr.dev/slog"
 	agentproto "github.com/coder/coder/v2/agent/proto"
 )
 
 type BoundaryLogsAPI struct {
+	Log         slog.Logger
 	WorkspaceID uuid.UUID
 }
 
-func (a *BoundaryLogsAPI) ReportBoundaryLogs(_ context.Context, req *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error) {
-	for _, log := range req.Logs {
-		workspaceID, err := uuid.FromBytes(log.WorkspaceId)
+func (a *BoundaryLogsAPI) ReportBoundaryLogs(ctx context.Context, req *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error) {
+	for _, l := range req.Logs {
+		workspaceID, err := uuid.FromBytes(l.WorkspaceId)
 		if err != nil {
 			workspaceID = a.WorkspaceID
 		}
 
-		decision := "allow"
-		level := "info"
-		if !log.Allowed {
-			decision = "deny"
-			level = "warn"
-		}
-
 		var logTime time.Time
-		if log.Time != nil {
-			logTime = log.Time.AsTime()
+		if l.Time != nil {
+			logTime = l.Time.AsTime()
 		} else {
 			logTime = time.Now()
 		}
 
-		// Format: [API] 2025-12-08 20:58:46.093 [warn] boundary: workspace.id=... decision=deny http.method="GET" http.url="..." time="..."
-		_, _ = fmt.Fprintf(os.Stderr, "[API] %s [%s] boundary: workspace.id=%s decision=%s http.method=%q http.url=%q time=%q\n",
-			logTime.Format("2006-01-02 15:04:05.000"),
-			level,
-			workspaceID.String(),
-			decision,
-			log.HttpMethod,
-			log.HttpUrl,
-			logTime.Format(time.RFC3339Nano),
-		)
+		if l.Allowed {
+			a.Log.Info(ctx, "boundary request allowed",
+				slog.F("workspace_id", workspaceID.String()),
+				slog.F("http_method", l.HttpMethod),
+				slog.F("http_url", l.HttpUrl),
+				slog.F("event_time", logTime.Format(time.RFC3339Nano)),
+				slog.F("matched_rule", l.MatchedRule),
+			)
+		} else {
+			a.Log.Warn(ctx, "boundary request denied",
+				slog.F("workspace_id", workspaceID.String()),
+				slog.F("http_method", l.HttpMethod),
+				slog.F("http_url", l.HttpUrl),
+				slog.F("event_time", logTime.Format(time.RFC3339Nano)),
+				slog.F("matched_rule", l.MatchedRule),
+			)
+		}
 	}
 
 	return &agentproto.ReportBoundaryLogsResponse{}, nil

Original file line number	Diff line number	Diff line change
`@@ -220,6 +220,7 @@ func New(opts Options, workspace database.Workspace) *API {`
`220`	`220`	`}`
`221`	`221`
`222`	`222`	`api.BoundaryLogsAPI = &BoundaryLogsAPI{`
	`223`	`+ Log: opts.Log,`
`223`	`224`	`WorkspaceID: opts.WorkspaceID,`
`224`	`225`	`}`
`225`	`226`