| 130 | } |
| 131 | |
| 132 | func GetSearchAuditLogsFilter(filter string) (*qb.Query, error) { |
| 133 | if filter == "" { |
| 134 | return nil, nil |
| 135 | } |
| 136 | |
| 137 | e, err := cel.NewEnv() |
| 138 | if err != nil { |
| 139 | return nil, errors.New("failed to create cel env") |
| 140 | } |
| 141 | ast, iss := e.Parse(filter) |
| 142 | if iss != nil { |
| 143 | return nil, errors.Errorf("failed to parse filter %v, error: %v", filter, iss.String()) |
| 144 | } |
| 145 | |
| 146 | var getFilter func(expr celast.Expr) (*qb.Query, error) |
| 147 | |
| 148 | getFilter = func(expr celast.Expr) (*qb.Query, error) { |
| 149 | q := qb.Q() |
| 150 | switch expr.Kind() { |
| 151 | case celast.CallKind: |
| 152 | functionName := expr.AsCall().FunctionName() |
| 153 | switch functionName { |
| 154 | case celoperators.LogicalOr: |
| 155 | for _, arg := range expr.AsCall().Args() { |
| 156 | qq, err := getFilter(arg) |
| 157 | if err != nil { |
| 158 | return nil, err |
| 159 | } |
| 160 | q.Or("?", qq) |
| 161 | } |
| 162 | return qb.Q().Space("(?)", q), nil |
| 163 | case celoperators.LogicalAnd: |
| 164 | for _, arg := range expr.AsCall().Args() { |
| 165 | qq, err := getFilter(arg) |
| 166 | if err != nil { |
| 167 | return nil, err |
| 168 | } |
| 169 | q.And("?", qq) |
| 170 | } |
| 171 | return qb.Q().Space("(?)", q), nil |
| 172 | case celoperators.Equals: |
| 173 | variable, rawValue := getVariableAndValueFromExpr(expr) |
| 174 | value, ok := rawValue.(string) |
| 175 | if !ok { |
| 176 | return nil, errors.Errorf("expect string, got %T, hint: filter literals should be string", rawValue) |
| 177 | } |
| 178 | switch variable { |
| 179 | case "resource", "method", "user", "severity": |
| 180 | default: |
| 181 | return nil, errors.Errorf("unknown variable %s", variable) |
| 182 | } |
| 183 | return qb.Q().Space(fmt.Sprintf("payload->>'%s' = ?", variable), value), nil |
| 184 | |
| 185 | case celoperators.GreaterEquals, celoperators.LessEquals: |
| 186 | variable, rawValue := getVariableAndValueFromExpr(expr) |
| 187 | value, ok := rawValue.(string) |
| 188 | if !ok { |
| 189 | return nil, errors.Errorf("expect string, got %T, hint: filter literals should be string", rawValue) |