feat: writing logs to the filesystem with rotation support (#1299)

* refactor: move lib/policy/config to lib/config Signed-off-by: Xe Iaso <me@xeiaso.net> * refactor: don't set global loggers anymore Ref #864 You were right @kotx, it is a bad idea to set the global logger instance. Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(config): add log sink support Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: update spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(test): go mod tidy Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: update spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(admin/policies): add logging block documentation Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: update CHANGELOG Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(cmd/anubis): revert this change, it's meant to be its own PR Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: go mod tidy Signed-off-by: Xe Iaso <me@xeiaso.net> * test: add file logging smoke test Assisted-by: GLM 4.6 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net> * fix: don't expose the old log file time format string Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-11-21 11:46:00 -05:00 · 2025-11-21 11:46:00 -05:00 · f032d5d0ac
commit f032d5d0ac
parent a709a2b2da
118 changed files with 789 additions and 65 deletions
--- a/lib/config/threshold_test.go
+++ b/lib/config/threshold_test.go
@ -0,0 +1,111 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestThresholdValid(t *testing.T) {
+	for _, tt := range []struct {
+		err   error
+		input *Threshold
+		name  string
+	}{
+		{
+			name: "basic allow",
+			input: &Threshold{
+				Name:       "basic-allow",
+				Expression: &ExpressionOrList{Expression: "true"},
+				Action:     RuleAllow,
+			},
+			err: nil,
+		},
+		{
+			name: "basic challenge",
+			input: &Threshold{
+				Name:       "basic-challenge",
+				Expression: &ExpressionOrList{Expression: "true"},
+				Action:     RuleChallenge,
+				Challenge: &ChallengeRules{
+					Algorithm:  "fast",
+					Difficulty: 1,
+					ReportAs:   1,
+				},
+			},
+			err: nil,
+		},
+		{
+			name:  "no name",
+			input: &Threshold{},
+			err:   ErrThresholdMustHaveName,
+		},
+		{
+			name:  "no expression",
+			input: &Threshold{},
+			err:   ErrThresholdMustHaveName,
+		},
+		{
+			name: "invalid expression",
+			input: &Threshold{
+				Expression: &ExpressionOrList{},
+			},
+			err: ErrExpressionEmpty,
+		},
+		{
+			name:  "invalid action",
+			input: &Threshold{},
+			err:   ErrUnknownAction,
+		},
+		{
+			name: "challenge action but no challenge",
+			input: &Threshold{
+				Action: RuleChallenge,
+			},
+			err: ErrThresholdChallengeMustHaveChallenge,
+		},
+		{
+			name: "challenge invalid",
+			input: &Threshold{
+				Action:    RuleChallenge,
+				Challenge: &ChallengeRules{Difficulty: -1, ReportAs: -1},
+			},
+			err: ErrChallengeDifficultyTooLow,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := tt.input.Valid(); !errors.Is(err, tt.err) {
+				t.Errorf("threshold is invalid: %v", err)
+			}
+		})
+	}
+}
+
+func TestDefaultThresholdsValid(t *testing.T) {
+	for i, th := range DefaultThresholds {
+		t.Run(fmt.Sprintf("%d %s", i, th.Name), func(t *testing.T) {
+			if err := th.Valid(); err != nil {
+				t.Errorf("threshold invalid: %v", err)
+			}
+		})
+	}
+}
+
+func TestLoadActuallyLoadsThresholds(t *testing.T) {
+	fin, err := os.Open(filepath.Join(".", "testdata", "good", "thresholds.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fin.Close()
+
+	c, err := Load(fin, fin.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(c.Thresholds) != 4 {
+		t.Errorf("wanted 4 thresholds, got %d thresholds", len(c.Thresholds))
+	}
+}