feat(infisical-pg): completed audit log moved ee routes to normal routing pattern

backend-pg/src/ee/services/audit-log/audit-log-dal.ts

@@ -0,0 +1,61 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify, stripUndefinedInWhere } from "@app/lib/knex";
+
+export type TAuditLogDalFactory = ReturnType<typeof auditLogDalFactory>;
+
+type TFindQuery = {
+  actor?: string;
+  projectId?: string;
+  orgId?: string;
+  eventType?: string;
+  startDate?: string;
+  endDate?: string;
+  userAgentType?: string;
+  limit?: number;
+  offset?: number;
+};
+
+export const auditLogDalFactory = (db: TDbClient) => {
+  const auditLogOrm = ormify(db, TableName.AuditLog);
+
+  const find = async (
+    {
+      orgId,
+      projectId,
+      userAgentType,
+      startDate,
+      endDate,
+      limit = 20,
+      offset = 0,
+      actor,
+      eventType
+    }: TFindQuery,
+    tx?: Knex
+  ) => {
+    const sqlQuery = (tx || db)(TableName.AuditLog)
+      .where(
+        stripUndefinedInWhere({
+          projectId,
+          orgId,
+          eventType,
+          actor,
+          userAgentType
+        })
+      )
+      .limit(limit)
+      .offset(offset);
+    if (startDate) {
+      sqlQuery.where("createdAt", ">=", startDate);
+    }
+    if (endDate) {
+      sqlQuery.where("createdAt", "<=", endDate);
+    }
+    const docs = await sqlQuery;
+    return docs;
+  };
+
+  return { ...auditLogOrm, find };
+};

backend-pg/src/ee/services/audit-log/audit-log-queue.ts

@@ -0,0 +1,46 @@
+import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+
+import { TAuditLogDalFactory } from "./audit-log-dal";
+import { TCreateAuditLogDTO } from "./audit-log-types";
+
+type TAuditLogQueueServiceFactoryDep = {
+  auditLogDal: TAuditLogDalFactory;
+  queueService: TQueueServiceFactory;
+};
+
+export type TAuditLogQueueServiceFactory = ReturnType<typeof auditLogQueueServiceFactory>;
+
+export const auditLogQueueServiceFactory = ({
+  auditLogDal,
+  queueService
+}: TAuditLogQueueServiceFactoryDep) => {
+  const pushToLog = async (data: TCreateAuditLogDTO) => {
+    await queueService.queue(QueueName.AuditLog, QueueJobs.AuditLog, data, {
+      removeOnFail: {
+        count: 5
+      },
+      removeOnComplete: true
+    });
+  };
+
+  queueService.start(QueueName.AuditLog, async (job) => {
+    const { actor, orgId, event, ipAddress, projectId, userAgent, userAgentType } = job.data;
+    const MS_IN_DAY = 24 * 60 * 60 * 1000;
+    await auditLogDal.create({
+      actor: actor.type,
+      actorMetadata: actor.metadata,
+      userAgent,
+      projectId,
+      ipAddress,
+      orgId,
+      eventType: event.type,
+      expiresAt: new Date(Date.now() + 30 * MS_IN_DAY),
+      eventMetadata: event.metadata,
+      userAgentType
+    });
+  });
+
+  return {
+    pushToLog
+  };
+};

backend-pg/src/ee/services/audit-log/audit-log-service.ts

@@ -0,0 +1,73 @@
+import { ForbiddenError } from "@casl/ability";
+
+import { BadRequestError } from "@app/lib/errors";
+
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { TAuditLogDalFactory } from "./audit-log-dal";
+import { TAuditLogQueueServiceFactory } from "./audit-log-queue";
+import { EventType, TCreateAuditLogDTO, TListProjectAuditLogDTO } from "./audit-log-types";
+
+type TAuditLogServiceFactoryDep = {
+  auditLogDal: TAuditLogDalFactory;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  auditLogQueue: TAuditLogQueueServiceFactory;
+};
+
+export type TAuditLogServiceFactory = ReturnType<typeof auditLogServiceFactory>;
+
+export const auditLogServiceFactory = ({
+  auditLogDal,
+  auditLogQueue,
+  permissionService
+}: TAuditLogServiceFactoryDep) => {
+  const listProjectAuditLogs = async ({
+    userAgentType,
+    eventType,
+    offset,
+    limit,
+    endDate,
+    startDate,
+    actor,
+    actorId,
+    projectId,
+    auditLogActor
+  }: TListProjectAuditLogDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.AuditLogs
+    );
+    const auditLogs = await auditLogDal.find({
+      startDate,
+      endDate,
+      limit,
+      offset,
+      eventType,
+      userAgentType,
+      actor: auditLogActor,
+      projectId
+    });
+    return auditLogs.map(
+      ({ eventType: logEventType, actor: eActor, actorMetadata, eventMetadata, ...el }) => ({
+        ...el,
+        event: { type: logEventType, metadata: eventMetadata },
+        actor: { type: eActor, metadata: actorMetadata }
+      })
+    );
+  };
+
+  const createAuditLog = async (data: TCreateAuditLogDTO) => {
+    // add all cases in which project id or org id cannot be added
+    if (data.event.type !== EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH) {
+      if (!data.projectId && !data.orgId)
+        throw new BadRequestError({ message: "Must either project id or org id" });
+    }
+    return auditLogQueue.pushToLog(data);
+  };
+
+  return {
+    createAuditLog,
+    listProjectAuditLogs
+  };
+};

backend-pg/src/ee/services/audit-log/audit-log-types.ts

@@ -0,0 +1,674 @@
+import { TProjectPermission } from "@app/lib/types";
+import { ActorType } from "@app/services/auth/auth-type";
+import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
+
+export type TListProjectAuditLogDTO = {
+  auditLogActor?: string;
+  projectId: string;
+  eventType?: string;
+  startDate?: string;
+  endDate?: string;
+  userAgentType?: string;
+  limit?: number;
+  offset?: number;
+} & TProjectPermission;
+
+export type TCreateAuditLogDTO = {
+  event: Event;
+  actor: UserActor | IdentityActor | ServiceActor;
+  orgId?: string;
+  projectId?: string;
+} & BaseAuthData;
+
+interface BaseAuthData {
+  ipAddress?: string;
+  userAgent?: string;
+  userAgentType?: UserAgentType;
+}
+
+export enum UserAgentType {
+  WEB = "web",
+  CLI = "cli",
+  K8_OPERATOR = "k8-operator",
+  TERRAFORM = "terraform",
+  OTHER = "other",
+  PYTHON_SDK = "InfisicalPythonSDK",
+  NODE_SDK = "InfisicalNodeSDK"
+}
+
+export enum EventType {
+  GET_SECRETS = "get-secrets",
+  GET_SECRET = "get-secret",
+  REVEAL_SECRET = "reveal-secret",
+  CREATE_SECRET = "create-secret",
+  CREATE_SECRETS = "create-secrets",
+  UPDATE_SECRET = "update-secret",
+  UPDATE_SECRETS = "update-secrets",
+  DELETE_SECRET = "delete-secret",
+  DELETE_SECRETS = "delete-secrets",
+  GET_WORKSPACE_KEY = "get-workspace-key",
+  AUTHORIZE_INTEGRATION = "authorize-integration",
+  UNAUTHORIZE_INTEGRATION = "unauthorize-integration",
+  CREATE_INTEGRATION = "create-integration",
+  DELETE_INTEGRATION = "delete-integration",
+  ADD_TRUSTED_IP = "add-trusted-ip",
+  UPDATE_TRUSTED_IP = "update-trusted-ip",
+  DELETE_TRUSTED_IP = "delete-trusted-ip",
+  CREATE_SERVICE_TOKEN = "create-service-token", // v2
+  DELETE_SERVICE_TOKEN = "delete-service-token", // v2
+  CREATE_IDENTITY = "create-identity",
+  UPDATE_IDENTITY = "update-identity",
+  DELETE_IDENTITY = "delete-identity",
+  LOGIN_IDENTITY_UNIVERSAL_AUTH = "login-identity-universal-auth",
+  ADD_IDENTITY_UNIVERSAL_AUTH = "add-identity-universal-auth",
+  UPDATE_IDENTITY_UNIVERSAL_AUTH = "update-identity-universal-auth",
+  GET_IDENTITY_UNIVERSAL_AUTH = "get-identity-universal-auth",
+  CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "create-identity-universal-auth-client-secret",
+  REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "revoke-identity-universal-auth-client-secret",
+  GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS = "get-identity-universal-auth-client-secret",
+  CREATE_ENVIRONMENT = "create-environment",
+  UPDATE_ENVIRONMENT = "update-environment",
+  DELETE_ENVIRONMENT = "delete-environment",
+  ADD_WORKSPACE_MEMBER = "add-workspace-member",
+  ADD_BATCH_WORKSPACE_MEMBER = "add-workspace-members",
+  REMOVE_WORKSPACE_MEMBER = "remove-workspace-member",
+  CREATE_FOLDER = "create-folder",
+  UPDATE_FOLDER = "update-folder",
+  DELETE_FOLDER = "delete-folder",
+  CREATE_WEBHOOK = "create-webhook",
+  UPDATE_WEBHOOK_STATUS = "update-webhook-status",
+  DELETE_WEBHOOK = "delete-webhook",
+  GET_SECRET_IMPORTS = "get-secret-imports",
+  CREATE_SECRET_IMPORT = "create-secret-import",
+  UPDATE_SECRET_IMPORT = "update-secret-import",
+  DELETE_SECRET_IMPORT = "delete-secret-import",
+  UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
+  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions",
+  SECRET_APPROVAL_MERGED = "secret-approval-merged",
+  SECRET_APPROVAL_REQUEST = "secret-approval-request",
+  SECRET_APPROVAL_CLOSED = "secret-approval-closed",
+  SECRET_APPROVAL_REOPENED = "secret-approval-reopened"
+}
+
+interface UserActorMetadata {
+  userId: string;
+  email: string;
+}
+
+interface ServiceActorMetadata {
+  serviceId: string;
+  name: string;
+}
+
+interface IdentityActorMetadata {
+  identityId: string;
+  name: string;
+}
+
+export interface UserActor {
+  type: ActorType.USER;
+  metadata: UserActorMetadata;
+}
+
+export interface ServiceActor {
+  type: ActorType.SERVICE;
+  metadata: ServiceActorMetadata;
+}
+
+export interface IdentityActor {
+  type: ActorType.IDENTITY;
+  metadata: IdentityActorMetadata;
+}
+
+export type Actor = UserActor | ServiceActor | IdentityActor;
+
+interface GetSecretsEvent {
+  type: EventType.GET_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    numberOfSecrets: number;
+  };
+}
+
+interface GetSecretEvent {
+  type: EventType.GET_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface CreateSecretEvent {
+  type: EventType.CREATE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface CreateSecretBatchEvent {
+  type: EventType.CREATE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface UpdateSecretEvent {
+  type: EventType.UPDATE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface UpdateSecretBatchEvent {
+  type: EventType.UPDATE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface DeleteSecretEvent {
+  type: EventType.DELETE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface DeleteSecretBatchEvent {
+  type: EventType.DELETE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface GetWorkspaceKeyEvent {
+  type: EventType.GET_WORKSPACE_KEY;
+  metadata: {
+    keyId: string;
+  };
+}
+
+interface AuthorizeIntegrationEvent {
+  type: EventType.AUTHORIZE_INTEGRATION;
+  metadata: {
+    integration: string;
+  };
+}
+
+interface UnauthorizeIntegrationEvent {
+  type: EventType.UNAUTHORIZE_INTEGRATION;
+  metadata: {
+    integration: string;
+  };
+}
+
+interface CreateIntegrationEvent {
+  type: EventType.CREATE_INTEGRATION;
+  metadata: {
+    integrationId: string;
+    integration: string; // TODO: fix type
+    environment: string;
+    secretPath: string;
+    url?: string;
+    app?: string;
+    appId?: string;
+    targetEnvironment?: string;
+    targetEnvironmentId?: string;
+    targetService?: string;
+    targetServiceId?: string;
+    path?: string;
+    region?: string;
+  };
+}
+
+interface DeleteIntegrationEvent {
+  type: EventType.DELETE_INTEGRATION;
+  metadata: {
+    integrationId: string;
+    integration: string; // TODO: fix type
+    environment: string;
+    secretPath: string;
+    url?: string;
+    app?: string;
+    appId?: string;
+    targetEnvironment?: string;
+    targetEnvironmentId?: string;
+    targetService?: string;
+    targetServiceId?: string;
+    path?: string;
+    region?: string;
+  };
+}
+
+interface AddTrustedIPEvent {
+  type: EventType.ADD_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface UpdateTrustedIPEvent {
+  type: EventType.UPDATE_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface DeleteTrustedIPEvent {
+  type: EventType.DELETE_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface CreateServiceTokenEvent {
+  type: EventType.CREATE_SERVICE_TOKEN;
+  metadata: {
+    name: string;
+    scopes: Array<{
+      environment: string;
+      secretPath: string;
+    }>;
+  };
+}
+
+interface DeleteServiceTokenEvent {
+  type: EventType.DELETE_SERVICE_TOKEN;
+  metadata: {
+    name: string;
+    scopes: Array<{
+      environment: string;
+      secretPath: string;
+    }>;
+  };
+}
+
+interface CreateIdentityEvent {
+  // note: currently not logging org-role
+  type: EventType.CREATE_IDENTITY;
+  metadata: {
+    identityId: string;
+    name: string;
+  };
+}
+
+interface UpdateIdentityEvent {
+  type: EventType.UPDATE_IDENTITY;
+  metadata: {
+    identityId: string;
+    name?: string;
+  };
+}
+
+interface DeleteIdentityEvent {
+  type: EventType.DELETE_IDENTITY;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface LoginIdentityUniversalAuthEvent {
+  type: EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    identityUniversalAuthId: string;
+    clientSecretId: string;
+    identityAccessTokenId: string;
+  };
+}
+
+interface AddIdentityUniversalAuthEvent {
+  type: EventType.ADD_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    clientSecretTrustedIps: Array<TIdentityTrustedIp>;
+    accessTokenTTL: number;
+    accessTokenMaxTTL: number;
+    accessTokenNumUsesLimit: number;
+    accessTokenTrustedIps: Array<TIdentityTrustedIp>;
+  };
+}
+
+interface UpdateIdentityUniversalAuthEvent {
+  type: EventType.UPDATE_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    clientSecretTrustedIps?: Array<TIdentityTrustedIp>;
+    accessTokenTTL?: number;
+    accessTokenMaxTTL?: number;
+    accessTokenNumUsesLimit?: number;
+    accessTokenTrustedIps?: Array<TIdentityTrustedIp>;
+  };
+}
+
+interface GetIdentityUniversalAuthEvent {
+  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface CreateIdentityUniversalAuthClientSecretEvent {
+  type: EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET;
+  metadata: {
+    identityId: string;
+    clientSecretId: string;
+  };
+}
+
+interface GetIdentityUniversalAuthClientSecretsEvent {
+  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface RevokeIdentityUniversalAuthClientSecretEvent {
+  type: EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET;
+  metadata: {
+    identityId: string;
+    clientSecretId: string;
+  };
+}
+
+interface CreateEnvironmentEvent {
+  type: EventType.CREATE_ENVIRONMENT;
+  metadata: {
+    name: string;
+    slug: string;
+  };
+}
+
+interface UpdateEnvironmentEvent {
+  type: EventType.UPDATE_ENVIRONMENT;
+  metadata: {
+    oldName: string;
+    newName: string;
+    oldSlug: string;
+    newSlug: string;
+  };
+}
+
+interface DeleteEnvironmentEvent {
+  type: EventType.DELETE_ENVIRONMENT;
+  metadata: {
+    name: string;
+    slug: string;
+  };
+}
+
+interface AddWorkspaceMemberEvent {
+  type: EventType.ADD_WORKSPACE_MEMBER;
+  metadata: {
+    userId: string;
+    email: string;
+  };
+}
+
+interface AddBatchWorkspaceMemberEvent {
+  type: EventType.ADD_BATCH_WORKSPACE_MEMBER;
+  metadata: Array<{
+    userId: string;
+    email: string;
+  }>;
+}
+
+interface RemoveWorkspaceMemberEvent {
+  type: EventType.REMOVE_WORKSPACE_MEMBER;
+  metadata: {
+    userId: string;
+    email: string;
+  };
+}
+
+interface CreateFolderEvent {
+  type: EventType.CREATE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    folderName: string;
+    folderPath: string;
+  };
+}
+
+interface UpdateFolderEvent {
+  type: EventType.UPDATE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    oldFolderName: string;
+    newFolderName: string;
+    folderPath: string;
+  };
+}
+
+interface DeleteFolderEvent {
+  type: EventType.DELETE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    folderName: string;
+    folderPath: string;
+  };
+}
+
+interface CreateWebhookEvent {
+  type: EventType.CREATE_WEBHOOK;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface UpdateWebhookStatusEvent {
+  type: EventType.UPDATE_WEBHOOK_STATUS;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface DeleteWebhookEvent {
+  type: EventType.DELETE_WEBHOOK;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface GetSecretImportsEvent {
+  type: EventType.GET_SECRET_IMPORTS;
+  metadata: {
+    environment: string;
+    folderId: string;
+    numberOfImports: number;
+  };
+}
+
+interface CreateSecretImportEvent {
+  type: EventType.CREATE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importFromEnvironment: string;
+    importFromSecretPath: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+  };
+}
+
+interface UpdateSecretImportEvent {
+  type: EventType.UPDATE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+    position: number;
+    orderBefore?: {
+      environment: string;
+      secretPath: string;
+    }[];
+    orderAfter?: {
+      environment: string;
+      secretPath: string;
+    }[];
+  };
+}
+
+interface DeleteSecretImportEvent {
+  type: EventType.DELETE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importFromEnvironment: string;
+    importFromSecretPath: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+  };
+}
+
+interface UpdateUserRole {
+  type: EventType.UPDATE_USER_WORKSPACE_ROLE;
+  metadata: {
+    userId: string;
+    email: string;
+    oldRole: string;
+    newRole: string;
+  };
+}
+
+interface UpdateUserDeniedPermissions {
+  type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS;
+  metadata: {
+    userId: string;
+    email: string;
+    deniedPermissions: {
+      environmentSlug: string;
+      ability: string;
+    }[];
+  };
+}
+interface SecretApprovalMerge {
+  type: EventType.SECRET_APPROVAL_MERGED;
+  metadata: {
+    mergedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalClosed {
+  type: EventType.SECRET_APPROVAL_CLOSED;
+  metadata: {
+    closedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalReopened {
+  type: EventType.SECRET_APPROVAL_REOPENED;
+  metadata: {
+    reopenedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalRequest {
+  type: EventType.SECRET_APPROVAL_REQUEST;
+  metadata: {
+    committedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+export type Event =
+  | GetSecretsEvent
+  | GetSecretEvent
+  | CreateSecretEvent
+  | CreateSecretBatchEvent
+  | UpdateSecretEvent
+  | UpdateSecretBatchEvent
+  | DeleteSecretEvent
+  | DeleteSecretBatchEvent
+  | GetWorkspaceKeyEvent
+  | AuthorizeIntegrationEvent
+  | UnauthorizeIntegrationEvent
+  | CreateIntegrationEvent
+  | DeleteIntegrationEvent
+  | AddTrustedIPEvent
+  | UpdateTrustedIPEvent
+  | DeleteTrustedIPEvent
+  | CreateServiceTokenEvent
+  | DeleteServiceTokenEvent
+  | CreateIdentityEvent
+  | UpdateIdentityEvent
+  | DeleteIdentityEvent
+  | LoginIdentityUniversalAuthEvent
+  | AddIdentityUniversalAuthEvent
+  | UpdateIdentityUniversalAuthEvent
+  | GetIdentityUniversalAuthEvent
+  | CreateIdentityUniversalAuthClientSecretEvent
+  | GetIdentityUniversalAuthClientSecretsEvent
+  | RevokeIdentityUniversalAuthClientSecretEvent
+  | CreateEnvironmentEvent
+  | UpdateEnvironmentEvent
+  | DeleteEnvironmentEvent
+  | AddWorkspaceMemberEvent
+  | AddBatchWorkspaceMemberEvent
+  | RemoveWorkspaceMemberEvent
+  | CreateFolderEvent
+  | UpdateFolderEvent
+  | DeleteFolderEvent
+  | CreateWebhookEvent
+  | UpdateWebhookStatusEvent
+  | DeleteWebhookEvent
+  | GetSecretImportsEvent
+  | CreateSecretImportEvent
+  | UpdateSecretImportEvent
+  | DeleteSecretImportEvent
+  | UpdateUserRole
+  | UpdateUserDeniedPermissions
+  | SecretApprovalMerge
+  | SecretApprovalClosed
+  | SecretApprovalRequest
+  | SecretApprovalReopened;

backend-pg/src/ee/services/saml-config/saml-config-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TSamlConfigDalFactory = ReturnType<typeof samlConfigDalFactory>;
+
+export const samlConfigDalFactory = (db: TDbClient) => {
+  const samlCfgOrm = ormify(db, TableName.SamlConfig);
+  return samlCfgOrm;
+};

backend-pg/src/ee/services/saml-config/saml-config-service.ts

@@ -0,0 +1,348 @@
+import { ForbiddenError } from "@casl/ability";
+import jwt from "jsonwebtoken";
+
+import {
+  OrgMembershipRole,
+  OrgMembershipStatus,
+  SecretKeyEncoding,
+  TSamlConfigs,
+  TSamlConfigsUpdate
+} from "@app/db/schemas";
+import { getConfig } from "@app/lib/config/env";
+import {
+  decryptSymmetric,
+  encryptSymmetric,
+  infisicalSymmetricDecrypt
+} from "@app/lib/crypto/encryption";
+import { BadRequestError } from "@app/lib/errors";
+import { AuthTokenType } from "@app/services/auth/auth-type";
+import { TOrgBotDalFactory } from "@app/services/org/org-bot-dal";
+import { TOrgDalFactory } from "@app/services/org/org-dal";
+import { TUserDalFactory } from "@app/services/user/user-dal";
+
+import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TSamlConfigDalFactory } from "./saml-config-dal";
+import {
+  SamlProviders,
+  TCreateSamlCfgDTO,
+  TGetSamlCfgDTO,
+  TSamlLoginDTO,
+  TUpdateSamlCfgDTO
+} from "./saml-config-types";
+
+type TSamlConfigServiceFactoryDep = {
+  samlConfigDal: TSamlConfigDalFactory;
+  userDal: Pick<TUserDalFactory, "create" | "findUserByEmail" | "transaction" | "updateById">;
+  orgDal: Pick<
+    TOrgDalFactory,
+    "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById"
+  >;
+  orgBotDal: Pick<TOrgBotDalFactory, "findOne">;
+  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
+};
+
+export type TSamlConfigServiceFactory = ReturnType<typeof samlConfigServiceFactory>;
+
+export const samlConfigServiceFactory = ({
+  samlConfigDal,
+  orgBotDal,
+  orgDal,
+  userDal,
+  permissionService
+}: TSamlConfigServiceFactoryDep) => {
+  const createSamlCfg = async ({
+    cert,
+    actor,
+    orgId,
+    issuer,
+    actorId,
+    isActive,
+    entryPoint,
+    authProvider
+  }: TCreateSamlCfgDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Create,
+      OrgPermissionSubjects.Sso
+    );
+
+    // TODO(akhilmhdh-pg): licence check
+
+    const orgBot = await orgBotDal.findOne({ orgId });
+    if (!orgBot)
+      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    const {
+      ciphertext: encryptedEntryPoint,
+      iv: entryPointIV,
+      tag: entryPointTag
+    } = encryptSymmetric(entryPoint, key);
+    const {
+      ciphertext: encryptedIssuer,
+      iv: issuerIV,
+      tag: issuerTag
+    } = encryptSymmetric(issuer, key);
+
+    const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
+    const samlConfig = await samlConfigDal.create({
+      orgId,
+      authProvider,
+      isActive,
+      encryptedEntryPoint,
+      entryPointIV,
+      entryPointTag,
+      encryptedIssuer,
+      issuerIV,
+      issuerTag,
+      encryptedCert,
+      certIV,
+      certTag
+    });
+    return samlConfig;
+  };
+
+  const updateSamlCfg = async ({
+    orgId,
+    actor,
+    cert,
+    actorId,
+    issuer,
+    isActive,
+    entryPoint,
+    authProvider
+  }: TUpdateSamlCfgDTO) => {
+    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionActions.Edit,
+      OrgPermissionSubjects.Sso
+    );
+    const updateQuery: TSamlConfigsUpdate = { authProvider, isActive };
+    const orgBot = await orgBotDal.findOne({ orgId });
+    if (!orgBot)
+      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    if (entryPoint) {
+      const {
+        ciphertext: encryptedEntryPoint,
+        iv: entryPointIV,
+        tag: entryPointTag
+      } = encryptSymmetric(entryPoint, key);
+      updateQuery.encryptedEntryPoint = encryptedEntryPoint;
+      updateQuery.entryPointIV = entryPointIV;
+      updateQuery.entryPointTag = entryPointTag;
+    }
+    if (issuer) {
+      const {
+        ciphertext: encryptedIssuer,
+        iv: issuerIV,
+        tag: issuerTag
+      } = encryptSymmetric(issuer, key);
+      updateQuery.encryptedIssuer = encryptedIssuer;
+      updateQuery.issuerIV = issuerIV;
+      updateQuery.issuerTag = issuerTag;
+    }
+    if (cert) {
+      const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
+      updateQuery.encryptedCert = encryptedCert;
+      updateQuery.certIV = certIV;
+      updateQuery.certTag = certTag;
+    }
+    const [ssoConfig] = await samlConfigDal.update({ orgId }, updateQuery);
+    return ssoConfig;
+  };
+
+  const getSaml = async (dto: TGetSamlCfgDTO) => {
+    let ssoConfig: TSamlConfigs | undefined;
+    if (dto.type === "org") {
+      ssoConfig = await samlConfigDal.findOne({ orgId: dto.orgId });
+      if (!ssoConfig) return;
+    } else if (dto.type === "ssoId") {
+      ssoConfig = await samlConfigDal.findById(dto.id);
+    }
+    if (!ssoConfig) throw new BadRequestError({ message: "Failed to find organization SSO data" });
+
+    // when dto is type id means it's internally used
+    if (dto.type === "org") {
+      const { permission } = await permissionService.getOrgPermission(
+        dto.actor,
+        dto.actorId,
+        ssoConfig!.orgId
+      );
+      ForbiddenError.from(permission).throwUnlessCan(
+        OrgPermissionActions.Read,
+        OrgPermissionSubjects.Sso
+      );
+    }
+    const {
+      entryPointTag,
+      entryPointIV,
+      encryptedEntryPoint,
+      certTag,
+      certIV,
+      encryptedCert,
+      issuerTag,
+      issuerIV,
+      encryptedIssuer
+    } = ssoConfig;
+
+    const orgBot = await orgBotDal.findOne({ orgId: ssoConfig.orgId });
+    if (!orgBot)
+      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    let entryPoint = "";
+    if (encryptedEntryPoint && entryPointIV && entryPointTag) {
+      entryPoint = decryptSymmetric({
+        ciphertext: encryptedEntryPoint,
+        key,
+        tag: entryPointTag,
+        iv: entryPointIV
+      });
+    }
+
+    let issuer = "";
+    if (encryptedIssuer && issuerTag && issuerIV) {
+      issuer = decryptSymmetric({
+        key,
+        tag: issuerTag,
+        iv: issuerIV,
+        ciphertext: encryptedIssuer
+      });
+    }
+
+    let cert = "";
+    if (encryptedCert && certTag && certIV) {
+      cert = decryptSymmetric({ key, tag: certTag, iv: certIV, ciphertext: encryptedCert });
+    }
+
+    return {
+      id: ssoConfig.id,
+      organization: ssoConfig.orgId,
+      orgId: ssoConfig.orgId,
+      authProvider: ssoConfig.authProvider,
+      isActive: ssoConfig.isActive,
+      entryPoint,
+      issuer,
+      cert
+    };
+  };
+
+  const samlLogin = async ({
+    firstName,
+    email,
+    lastName,
+    authProvider,
+    orgId,
+    relayState,
+    isSignupAllowed
+  }: TSamlLoginDTO) => {
+    const appCfg = getConfig();
+    let user = await userDal.findUserByEmail(email);
+    const isSamlSignUpDisabled = !isSignupAllowed && !user;
+    if (isSamlSignUpDisabled)
+      throw new BadRequestError({ message: "User signup disabled", name: "Saml SSO login" });
+
+    const organization = await orgDal.findOrgById(orgId);
+    if (!organization) throw new BadRequestError({ message: "Org not found" });
+
+    if (user) {
+      const hasSamlEnabled = (user.authMethods || []).some((method) =>
+        Object.values(SamlProviders).includes(method as SamlProviders)
+      );
+      await userDal.transaction(async (tx) => {
+        if (!hasSamlEnabled) {
+          await userDal.updateById(user.id, { authMethods: [authProvider] }, tx);
+        }
+        const [orgMembership] = await orgDal.findMembership({ userId: user.id, orgId }, { tx });
+        if (!orgMembership) {
+          await orgDal.createMembership(
+            {
+              userId: user.id,
+              orgId,
+              inviteEmail: email,
+              role: OrgMembershipRole.Member,
+              status: OrgMembershipStatus.Accepted
+            },
+            tx
+          );
+        } else if (orgMembership.status === OrgMembershipStatus.Invited) {
+          await orgDal.updateMembershipById(
+            orgMembership.id,
+            {
+              status: OrgMembershipStatus.Accepted
+            },
+            tx
+          );
+        }
+      });
+    } else {
+      user = await userDal.transaction(async (tx) => {
+        const newUser = await userDal.create(
+          {
+            email,
+            firstName,
+            lastName,
+            authMethods: [authProvider]
+          },
+          tx
+        );
+        await orgDal.createMembership({
+          inviteEmail: email,
+          orgId,
+          role: OrgMembershipRole.Member,
+          status: OrgMembershipStatus.Invited
+        });
+        return newUser;
+      });
+    }
+    const isUserCompleted = Boolean(user.isAccepted);
+    const providerAuthToken = jwt.sign(
+      {
+        authTokenType: AuthTokenType.PROVIDER_TOKEN,
+        userId: user.id,
+        email: user.email,
+        firstName,
+        lastName,
+        organizationName: organization.name,
+        organizationId: organization.id,
+        authMethod: authProvider,
+        isUserCompleted,
+        ...(relayState
+          ? {
+              callbackPort: JSON.parse(relayState).callbackPort as string
+            }
+          : {})
+      },
+      appCfg.JWT_AUTH_SECRET,
+      {
+        expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME
+      }
+    );
+    return { isUserCompleted, providerAuthToken };
+  };
+
+  return {
+    createSamlCfg,
+    updateSamlCfg,
+    getSaml,
+    samlLogin
+  };
+};

backend-pg/src/ee/services/saml-config/saml-config-types.ts

@@ -0,0 +1,43 @@
+import { TOrgPermission } from "@app/lib/types";
+import { ActorType } from "@app/services/auth/auth-type";
+
+export enum SamlProviders {
+  OKTA_SAML = "okta-saml",
+  AZURE_SAML = "azure-saml",
+  JUMPCLOUD_SAML = "jumpcloud-saml"
+}
+
+export type TCreateSamlCfgDTO = {
+  authProvider: SamlProviders;
+  isActive: boolean;
+  entryPoint: string;
+  issuer: string;
+  cert: string;
+} & TOrgPermission;
+
+export type TUpdateSamlCfgDTO = Partial<{
+  authProvider: SamlProviders;
+  isActive: boolean;
+  entryPoint: string;
+  issuer: string;
+  cert: string;
+}> &
+  TOrgPermission;
+
+export type TGetSamlCfgDTO =
+  | { type: "org"; orgId: string; actor: ActorType; actorId: string }
+  | {
+      type: "ssoId";
+      id: string;
+    };
+
+export type TSamlLoginDTO = {
+  email: string;
+  firstName: string;
+  lastName?: string;
+  authProvider: string;
+  orgId: string;
+  isSignupAllowed: boolean;
+  // saml thingy
+  relayState?: string;
+};

backend-pg/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -84,12 +84,12 @@ export const secretApprovalRequestDalFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "reviewerMemberId",
-            label: "reviewers",
+            label: "reviewers" as const,
             mapper: ({ reviewerMemberId: member, reviewerStatus: status }) =>
               member ? { member, status } : undefined
           },
-          { key: "approverId", label: "approvers", mapper: ({ approverId }) => approverId }
-        ] as const
+          { key: "approverId", label: "approvers" as const, mapper: ({ approverId }) => approverId }
+        ]
       });
       if (!formatedDoc?.[0]) return;
       return {
@@ -213,12 +213,12 @@ export const secretApprovalRequestDalFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "reviewerMemberId",
-            label: "reviewers",
+            label: "reviewers" as const,
             mapper: ({ reviewerMemberId: member, reviewerStatus: s }) =>
               member ? { member, status: s } : undefined
           },
-          { key: "approverId", label: "approvers", mapper: ({ approverId }) => approverId }
-        ] as const
+          { key: "approverId", label: "approvers" as const, mapper: ({ approverId }) => approverId }
+        ]
       });
       return formatedDoc.map((el) => ({
         ...el,

backend-pg/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -181,7 +181,7 @@ export const secretApprovalRequestServiceFactory = ({
       status,
       statusChangeBy: membership.id
     });
-    return updatedRequest;
+    return { ...secretApprovalRequest, ...updatedRequest };
   };
 
   const mergeSecretApprovalRequest = async ({

backend-pg/src/ee/services/secret-rotation/secret-rotation-dal.ts

@@ -61,7 +61,7 @@ export const secretRotationDalFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "secId",
-            label: "outputs",
+            label: "outputs" as const,
             mapper: ({
               secId,
               outputKey,
@@ -92,7 +92,7 @@ export const secretRotationDalFactory = (db: TDbClient) => {
               }
             })
           }
-        ] as const
+        ]
       });
     } catch (error) {
       throw new DatabaseError({ error, name: "SecretRotationFind" });

backend-pg/src/ee/services/secret-snapshot/snapshot-dal.ts

@@ -7,7 +7,8 @@ import {
   TSecretFolderVersions,
   TSecretSnapshotFolders,
   TSecretSnapshots,
-  TSecretVersions} from "@app/db/schemas";
+  TSecretVersions
+} from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
@@ -109,15 +110,15 @@ export const snapshotDalFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "id",
-            label: "secretVersions",
+            label: "secretVersions" as const,
             mapper: (el) => SecretVersionsSchema.parse(el)
           },
           {
             key: "folderVerId",
-            label: "folderVersion",
+            label: "folderVersion" as const,
             mapper: ({ folderVerId: id, folderVerName: name }) => ({ id, name })
           }
-        ] as const
+        ]
       })?.[0];
     } catch (error) {
       throw new DatabaseError({ error, name: "FindSecretSnapshotDataById" });
@@ -237,7 +238,7 @@ export const snapshotDalFactory = (db: TDbClient) => {
         childrenMapper: [
           {
             key: "id",
-            label: "secretVersions",
+            label: "secretVersions" as const,
             mapper: (el) => ({
               ...SecretVersionsSchema.parse(el),
               latestSecretVersion: el.latestSecretVersion
@@ -245,14 +246,14 @@ export const snapshotDalFactory = (db: TDbClient) => {
           },
           {
             key: "folderVerId",
-            label: "folderVersion",
+            label: "folderVersion" as const,
             mapper: ({ folderVerId: id, folderVerName: name, latestFolderVersion }) => ({
               id,
               name,
               latestFolderVersion
             })
           }
-        ] as const
+        ]
       });
       return formated;
     } catch (error) {