coder · ethanndickson · Jun 12, 2025 · Jun 12, 2025 · Jun 12, 2025 · Jun 12, 2025
diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go
@@ -19,7 +19,7 @@ import (
 	agentproto "github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/coderd/agentapi/resourcesmonitor"
 	"github.com/coder/coder/v2/coderd/appearance"
-	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/connectionlog"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/pubsub"
 	"github.com/coder/coder/v2/coderd/externalauth"
@@ -50,7 +50,7 @@ type API struct {
 	*ResourcesMonitoringAPI
 	*LogsAPI
 	*ScriptsAPI
-	*AuditAPI
+	*ConnLogAPI
 	*SubAgentAPI
 	*tailnet.DRPCService
 
@@ -71,7 +71,7 @@ type Options struct {
 	Database                          database.Store
 	NotificationsEnqueuer             notifications.Enqueuer
 	Pubsub                            pubsub.Pubsub
-	Auditor                           *atomic.Pointer[audit.Auditor]
+	ConnectionLogger                  *atomic.Pointer[connectionlog.ConnectionLogger]
 	DerpMapFn                         func() *tailcfg.DERPMap
 	TailnetCoordinator                *atomic.Pointer[tailnet.Coordinator]
 	StatsReporter                     *workspacestats.Reporter
@@ -180,11 +180,11 @@ func New(opts Options) *API {
 		Database: opts.Database,
 	}
 
-	api.AuditAPI = &AuditAPI{
-		AgentFn:  api.agent,
-		Auditor:  opts.Auditor,
-		Database: opts.Database,
-		Log:      opts.Log,
+	api.ConnLogAPI = &ConnLogAPI{
+		AgentFn:          api.agent,
+		ConnectionLogger: opts.ConnectionLogger,
+		Database:         opts.Database,
+		Log:              opts.Log,
 	}
 
 	api.DRPCService = &tailnet.DRPCService{

diff --git a/coderd/agentapi/audit.go b/coderd/agentapi/audit.go
diff --git a/coderd/agentapi/connectionlog.go b/coderd/agentapi/connectionlog.go
@@ -0,0 +1,79 @@
+package agentapi
+
+import (
+	"context"
+	"database/sql"
+	"sync/atomic"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"cdr.dev/slog"
+
+	agentproto "github.com/coder/coder/v2/agent/proto"
+	"github.com/coder/coder/v2/coderd/connectionlog"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+type ConnLogAPI struct {
+	AgentFn          func(context.Context) (database.WorkspaceAgent, error)
+	ConnectionLogger *atomic.Pointer[connectionlog.ConnectionLogger]
+	Database         database.Store
+	Log              slog.Logger
+}
+
+func (a *ConnLogAPI) ReportConnection(ctx context.Context, req *agentproto.ReportConnectionRequest) (*emptypb.Empty, error) {
+	action, err := db2sdk.ConnectionLogActionFromAgentProtoConnectionAction(req.GetConnection().GetAction())
+	if err != nil {
+		return nil, err
+	}
+	connectionType, err := agentsdk.ConnectionTypeFromProto(req.GetConnection().GetType())
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch contextual data for this connection log event.
+	workspaceAgent, err := a.AgentFn(ctx)
+	if err != nil {
+		return nil, xerrors.Errorf("get agent: %w", err)
+	}
+	workspace, err := a.Database.GetWorkspaceByAgentID(ctx, workspaceAgent.ID)
+	if err != nil {
+		return nil, xerrors.Errorf("get workspace by agent id: %w", err)
+	}
+
+	reason := req.GetConnection().GetReason()
+	connLogger := *a.ConnectionLogger.Load()
+	err = connLogger.Export(ctx, database.ConnectionLog{
+		ID:               uuid.New(),
+		Time:             req.GetConnection().GetTimestamp().AsTime(),
+		OrganizationID:   workspace.OrganizationID,
+		WorkspaceOwnerID: workspace.OwnerID,
+		WorkspaceID:      workspace.ID,
+		WorkspaceName:    workspace.Name,
+		AgentName:        workspaceAgent.Name,
+		Action:           action,
+		Code:             req.GetConnection().GetStatusCode(),
+		Ip:               database.ParseIP(req.GetConnection().GetIp()),
+		ConnectionType: sql.NullString{
+			String: string(connectionType),
+			Valid:  true,
+		},
+		Reason: sql.NullString{
+			String: reason,
+			Valid:  reason != "",
+		},
+
+		// It's not possible to tell which user connected. Once we have
+		// the capability, this may be reported by the agent.
+		UserID: uuid.Nil,
+	})
+	if err != nil {
+		return nil, xerrors.Errorf("export connection log: %w", err)
+	}
+
+	return &emptypb.Empty{}, nil
+}
diff --git a/coderd/agentapi/audit_test.go → coderd/agentapi/connectionlog_test.go b/coderd/agentapi/audit_test.go → coderd/agentapi/connectionlog_test.go
@@ -2,7 +2,7 @@ package agentapi_test
 
 import (
 	"context"
-	"encoding/json"
+	"database/sql"
 	"net"
 	"sync/atomic"
 	"testing"
@@ -16,15 +16,15 @@ import (
 
 	agentproto "github.com/coder/coder/v2/agent/proto"
 	"github.com/coder/coder/v2/coderd/agentapi"
-	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/connectionlog"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/db2sdk"
 	"github.com/coder/coder/v2/coderd/database/dbmock"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
-func TestAuditReport(t *testing.T) {
+func TestConnectionLog(t *testing.T) {
 	t.Parallel()
 
 	var (
@@ -38,10 +38,6 @@ func TestAuditReport(t *testing.T) {
 			OwnerID:        owner.ID,
 			Name:           "cool-workspace",
 		}
-		build = database.WorkspaceBuild{
-			ID:          uuid.New(),
-			WorkspaceID: workspace.ID,
-		}
 		agent = database.WorkspaceAgent{
 			ID: uuid.New(),
 		}
@@ -62,7 +58,7 @@ func TestAuditReport(t *testing.T) {
 			id:     uuid.New(),
 			action: agentproto.Connection_CONNECT.Enum(),
 			typ:    agentproto.Connection_SSH.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 			ip:     "127.0.0.1",
 			status: 200,
 		},
@@ -71,36 +67,36 @@ func TestAuditReport(t *testing.T) {
 			id:     uuid.New(),
 			action: agentproto.Connection_CONNECT.Enum(),
 			typ:    agentproto.Connection_VSCODE.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 			ip:     "8.8.8.8",
 		},
 		{
 			name:   "JetBrains Connect",
 			id:     uuid.New(),
 			action: agentproto.Connection_CONNECT.Enum(),
 			typ:    agentproto.Connection_JETBRAINS.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 		},
 		{
 			name:   "Reconnecting PTY Connect",
 			id:     uuid.New(),
 			action: agentproto.Connection_CONNECT.Enum(),
 			typ:    agentproto.Connection_RECONNECTING_PTY.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 		},
 		{
 			name:   "SSH Disconnect",
 			id:     uuid.New(),
 			action: agentproto.Connection_DISCONNECT.Enum(),
 			typ:    agentproto.Connection_SSH.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 		},
 		{
 			name:   "SSH Disconnect",
 			id:     uuid.New(),
 			action: agentproto.Connection_DISCONNECT.Enum(),
 			typ:    agentproto.Connection_SSH.Enum(),
-			time:   time.Now(),
+			time:   dbtime.Now(),
 			status: 500,
 			reason: "because error says so",
 		},
@@ -110,15 +106,14 @@ func TestAuditReport(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			mAudit := audit.NewMock()
+			connLogger := connectionlog.NewMock()
 
 			mDB := dbmock.NewMockStore(gomock.NewController(t))
 			mDB.EXPECT().GetWorkspaceByAgentID(gomock.Any(), agent.ID).Return(workspace, nil)
-			mDB.EXPECT().GetLatestWorkspaceBuildByWorkspaceID(gomock.Any(), workspace.ID).Return(build, nil)
 
-			api := &agentapi.AuditAPI{
-				Auditor:  asAtomicPointer[audit.Auditor](mAudit),
-				Database: mDB,
+			api := &agentapi.ConnLogAPI{
+				ConnectionLogger: asAtomicPointer[connectionlog.ConnectionLogger](connLogger),
+				Database:         mDB,
 				AgentFn: func(context.Context) (database.WorkspaceAgent, error) {
 					return agent, nil
 				},
@@ -135,33 +130,33 @@ func TestAuditReport(t *testing.T) {
 				},
 			})
 
-			require.True(t, mAudit.Contains(t, database.AuditLog{
-				Time:           dbtime.Time(tt.time).In(time.UTC),
-				Action:         agentProtoConnectionActionToAudit(t, *tt.action),
-				OrganizationID: workspace.OrganizationID,
-				UserID:         uuid.Nil,
-				RequestID:      tt.id,
-				ResourceType:   database.ResourceTypeWorkspaceAgent,
-				ResourceID:     agent.ID,
-				ResourceTarget: agent.Name,
-				Ip:             pqtype.Inet{Valid: true, IPNet: net.IPNet{IP: net.ParseIP(tt.ip), Mask: net.CIDRMask(32, 32)}},
-				StatusCode:     tt.status,
-			}))
+			require.True(t, connLogger.Contains(t, database.ConnectionLog{
+				Time:             dbtime.Time(tt.time).In(time.UTC),
+				OrganizationID:   workspace.OrganizationID,
+				WorkspaceOwnerID: workspace.OwnerID,
+				WorkspaceID:      workspace.ID,
+				WorkspaceName:    workspace.Name,
+				AgentName:        agent.Name,
+				UserID:           uuid.Nil,
+				Action:           agentProtoConnectionActionToConnectionLog(t, *tt.action),
 
-			// Check some additional fields.
-			var m map[string]any
-			err := json.Unmarshal(mAudit.AuditLogs()[0].AdditionalFields, &m)
-			require.NoError(t, err)
-			require.Equal(t, string(agentProtoConnectionTypeToSDK(t, *tt.typ)), m["connection_type"].(string))
-			if tt.reason != "" {
-				require.Equal(t, tt.reason, m["reason"])
-			}
+				Code: tt.status,
+				Ip:   pqtype.Inet{Valid: true, IPNet: net.IPNet{IP: net.ParseIP(tt.ip), Mask: net.CIDRMask(32, 32)}},
+				ConnectionType: sql.NullString{
+					String: string(agentProtoConnectionTypeToSDK(t, *tt.typ)),
+					Valid:  true,
+				},
+				Reason: sql.NullString{
+					String: tt.reason,
+					Valid:  tt.reason != "",
+				},
+			}))
 		})
 	}
 }
 
-func agentProtoConnectionActionToAudit(t *testing.T, action agentproto.Connection_Action) database.AuditAction {
-	a, err := db2sdk.AuditActionFromAgentProtoConnectionAction(action)
+func agentProtoConnectionActionToConnectionLog(t *testing.T, action agentproto.Connection_Action) database.ConnectionAction {
+	a, err := db2sdk.ConnectionLogActionFromAgentProtoConnectionAction(action)
 	require.NoError(t, err)
 	return a
 }