awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

More audit log stuff

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-12-09 17:31:43 -08:00
parent 8598b276f6
commit 12b245b641
2 changed files with 32 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -49,8 +49,8 @@ import { TWebhookPayloads } from "@app/services/webhook/webhook-types";
import { WorkflowIntegration } from "@app/services/workflow-integration/workflow-integration-types";
import { KmipPermission } from "../kmip/kmip-enum";
import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
import { AcmeIdentifierType } from "../pki-acme/pki-acme-schemas";
import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
export type TListProjectAuditLogDTO = {
filter: {
@@ -582,7 +582,8 @@ export enum EventType {
// PKI ACME
CREATE_ACME_ACCOUNT = "create-acme-account",
RETRIEVE_ACME_ACCOUNT = "retrieve-acme-account",
CREATE_ACME_ORDER = "create-acme-order"
CREATE_ACME_ORDER = "create-acme-order",
FINALIZE_ACME_ORDER = "finalize-acme-order"
}
export const filterableSecretEvents: EventType[] = [
@@ -4430,6 +4431,14 @@ interface CreateAcmeOrderEvent {
};
}
interface FinalizeAcmeOrderEvent {
type: EventType.FINALIZE_ACME_ORDER;
metadata: {
orderId: string;
csr: string;
};
}
export type Event =
| CreateSubOrganizationEvent
| UpdateSubOrganizationEvent
@@ -4833,4 +4842,5 @@ export type Event =
| ApprovalRequestGrantRevokeEvent
| CreateAcmeAccountEvent
| RetrieveAcmeAccountEvent
| CreateAcmeOrderEvent;
| CreateAcmeOrderEvent
| FinalizeAcmeOrderEvent;

20
backend/src/ee/services/pki-acme/pki-acme-service.ts
View File

@@ -613,6 +613,7 @@ export const pkiAcmeServiceFactory = ({
// if not, we may be able to reject it early with an unsupportedIdentifier error.
// TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
const profile = await validateAcmeProfile(profileId);
if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
}
@@ -686,7 +687,7 @@ export const pkiAcmeServiceFactory = ({
tx
);
await auditLogService.createAuditLog({
projectId: account.profileId,
projectId: profile.projectId,
actor: {
type: ActorType.ACME_ACCOUNT,
metadata: {
@@ -932,6 +933,23 @@ export const pkiAcmeServiceFactory = ({
throw error;
}
order = updatedOrder;
await auditLogService.createAuditLog({
projectId: profile.projectId,
actor: {
type: ActorType.ACME_ACCOUNT,
metadata: {
profileId,
accountId
}
},
event: {
type: EventType.FINALIZE_ACME_ORDER,
metadata: {
orderId: updatedOrder.id,
csr: updatedOrder.csr!
}
}
});
} else if (order.status !== AcmeOrderStatus.Valid) {
throw new AcmeOrderNotReadyError({ message: "ACME order is not ready" });
}