Add monitoring for token scanning hits/misses

app/controllers/Main.scala

@@ -144,18 +144,10 @@ final class Main(
 
  def githubSecretScanning =
  AnonBodyOf(parse.json):
- _.asOpt[List[JsObject]]
- .map:
- _.flatMap: obj =>
- for
- token <- (obj \ "token").asOpt[String]
- url <- (obj \ "url").asOpt[String]
- yield Bearer(token) -> url
- .toMap
- .so: tokensMap =>
- env.oAuth.tokenApi
- .secretScanning(tokensMap)
- .flatMap:
- _.traverse: (token, url) =>
- env.msg.api.systemPost(token.userId, lila.msg.MsgPreset.apiTokenRevoked(url))
- .as(NoContent)
+ _.asOpt[List[lila.oauth.AccessTokenApi.GithubSecretScan]].so: scans =>
+ env.oAuth.tokenApi
+ .secretScanning(scans)
+ .flatMap:
+ _.traverse: (token, url) =>
+ env.msg.api.systemPost(token.userId, lila.msg.MsgPreset.apiTokenRevoked(url))
+ .as(NoContent)

modules/common/src/main/mon.scala

@@ -342,6 +342,10 @@ object mon:
  counter("security.login.attempt").withTags:
  tags("by" -> (if byEmail then "email" else "name"), "stuffing" -> stuffing, "result" -> result)
  def proxy(tpe: String) = counter("security.login.proxy").withTag("proxy", tpe)
+ def secretScanning(tokenType: String, source: String, hit: Boolean) =
+ counter("security.githubSecretScanning.hit").withTags(
+ tags("type" -> tokenType, "source" -> source, "hit" -> hit)
+ )
  object shutup:
  def analyzer = timer("shutup.analyzer.time").withoutTags()
  object tv:

modules/oauth/src/main/AccessTokenApi.scala

@@ -6,6 +6,7 @@ import play.api.libs.json.*
 import lila.core.net.Bearer
 import lila.db.dsl.{ *, given }
 import lila.core.misc.oauth.TokenRevoke
+import lila.common.Json.given
 
 final class AccessTokenApi(
  coll: Coll,
@@ -212,18 +213,19 @@ final class AccessTokenApi(
  bearers.zip(openTokens).toMap
  }
 
- def secretScanning(tokens: Map[Bearer, String]): Fu[List[(AccessToken, String)]] =
- test(tokens.keys.toList)
- .flatMap:
- _.toList.traverse: (bearer, token) =>
- token match
- case Some(token) =>
- logger.branch("github").info(s"revoking token ${token.plain} for user ${token.userId}")
- revoke(token.plain).inject(tokens.get(bearer).map(token -> _))
- case None =>
- logger.branch("github").info(s"ignoring token $bearer")
- fuccess(none)
- .map(_.flatten)
+ def secretScanning(scans: List[AccessTokenApi.GithubSecretScan]): Fu[List[(AccessToken, String)]] = for
+ found <- test(scans.map(_.token))
+ res <- scans.traverse: scan =>
+ val compromised = found.get(scan.token).flatten
+ lila.mon.security.secretScanning(scan.`type`, scan.source, compromised.isDefined).increment()
+ compromised match
+ case Some(token) =>
+ logger.branch("github").info(s"revoking token ${token.plain} for user ${token.userId}")
+ revoke(token.plain).inject((token, scan.url).some)
+ case None =>
+ logger.branch("github").info(s"ignoring token ${scan.token}")
+ fuccess(none)
+ yield res.flatten
 
  private val accessTokenCache =
  cacheApi[AccessToken.Id, Option[AccessToken.ForAuth]](1024, "oauth.access_token"):
@@ -242,3 +244,6 @@ final class AccessTokenApi(
 
 object AccessTokenApi:
  case class Client(origin: String, usedAt: Option[Instant], scopes: List[OAuthScope])
+
+ case class GithubSecretScan(token: Bearer, `type`: String, url: String, source: String)
+ given Reads[GithubSecretScan] = Json.reads[GithubSecretScan]