diff --git a/backend/src/controllers/v1/membershipController.ts b/backend/src/controllers/v1/membershipController.ts
index 48689be1c..885f16690 100644
--- a/backend/src/controllers/v1/membershipController.ts
+++ b/backend/src/controllers/v1/membershipController.ts
@@ -104,9 +104,9 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
}
// validate target membership
- const membershipToChangeRole = await findMembership({
- _id: membershipId
- });
+ const membershipToChangeRole = await Membership
+ .findById(membershipId)
+ .populate<{ user: IUser }>("user");
if (!membershipToChangeRole) {
throw new Error("Failed to find membership to change role");
@@ -127,9 +127,27 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
// user is not an admin member of the workspace
throw new Error("Insufficient role for changing member roles");
}
+
+ const oldRole = membershipToChangeRole.role;
membershipToChangeRole.role = role;
await membershipToChangeRole.save();
+
+ await EEAuditLogService.createAuditLog(
+ req.authData,
+ {
+ type: EventType.UPDATE_USER_WORKSPACE_ROLE,
+ metadata: {
+ userId: membershipToChangeRole.user._id.toString(),
+ email: membershipToChangeRole.user.email,
+ oldRole,
+ newRole: membershipToChangeRole.role
+ }
+ },
+ {
+ workspaceId: membershipToChangeRole.workspace
+ }
+ );
return res.status(200).send({
membership: membershipToChangeRole
diff --git a/backend/src/ee/controllers/v1/membershipController.ts b/backend/src/ee/controllers/v1/membershipController.ts
index f7bebfdc5..4d2321a45 100644
--- a/backend/src/ee/controllers/v1/membershipController.ts
+++ b/backend/src/ee/controllers/v1/membershipController.ts
@@ -1,10 +1,12 @@
import { Request, Response } from "express";
-import { Membership, Workspace } from "../../../models";
+import { IUser, Membership, Workspace } from "../../../models";
+import { EventType } from "../../../ee/models";
import { IMembershipPermission } from "../../../models/membership";
import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
import { ADMIN, MEMBER } from "../../../variables/organization";
import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../../variables";
import _ from "lodash";
+import { EEAuditLogService } from "../../services";
export const denyMembershipPermissions = async (req: Request, res: Response) => {
const { membershipId } = req.params;
@@ -51,12 +53,33 @@ export const denyMembershipPermissions = async (req: Request, res: Response) =>
{ _id: membershipToModify._id },
{ $set: { deniedPermissions: sanitizedMembershipPermissionsUnique } },
{ new: true }
- )
+ ).populate<{ user: IUser }>("user");
if (!updatedMembershipWithPermissions) {
throw BadRequestError({ message: "The resource has been removed before it can be modified" })
}
+ await EEAuditLogService.createAuditLog(
+ req.authData,
+ {
+ type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
+ metadata: {
+ userId: updatedMembershipWithPermissions.user._id.toString(),
+ email: updatedMembershipWithPermissions.user.email,
+ deniedPermissions: updatedMembershipWithPermissions.deniedPermissions.map(({
+ environmentSlug,
+ ability
+ }) => ({
+ environmentSlug,
+ ability
+ }))
+ }
+ },
+ {
+ workspaceId: updatedMembershipWithPermissions.workspace
+ }
+ );
+
res.send({
permissionsDenied: updatedMembershipWithPermissions.deniedPermissions,
})
diff --git a/backend/src/ee/models/auditLog/enums.ts b/backend/src/ee/models/auditLog/enums.ts
index c1523cc84..dda49c1cd 100644
--- a/backend/src/ee/models/auditLog/enums.ts
+++ b/backend/src/ee/models/auditLog/enums.ts
@@ -42,4 +42,6 @@ export enum EventType {
CREATE_SECRET_IMPORT = "create-secret-import",
UPDATE_SECRET_IMPORT = "update-secret-import",
DELETE_SECRET_IMPORT = "delete-secret-import",
+ UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
+ UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
}
\ No newline at end of file
diff --git a/backend/src/ee/models/auditLog/types.ts b/backend/src/ee/models/auditLog/types.ts
index 261421798..71507212e 100644
--- a/backend/src/ee/models/auditLog/types.ts
+++ b/backend/src/ee/models/auditLog/types.ts
@@ -346,6 +346,28 @@ interface DeleteSecretImportEvent {
}
}
+interface UpdateUserRole {
+ type: EventType.UPDATE_USER_WORKSPACE_ROLE,
+ metadata: {
+ userId: string;
+ email: string;
+ oldRole: string;
+ newRole: string;
+ }
+}
+
+interface UpdateUserDeniedPermissions {
+ type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
+ metadata: {
+ userId: string;
+ email: string;
+ deniedPermissions: {
+ environmentSlug: string;
+ ability: string;
+ }[]
+ }
+}
+
export type Event =
| GetSecretsEvent
| GetSecretEvent
@@ -376,4 +398,6 @@ export type Event =
| GetSecretImportsEvent
| CreateSecretImportEvent
| UpdateSecretImportEvent
- | DeleteSecretImportEvent;
\ No newline at end of file
+ | DeleteSecretImportEvent
+ | UpdateUserRole
+ | UpdateUserDeniedPermissions;
\ No newline at end of file
diff --git a/frontend/src/ee/api/memberships/UpdateUserProjectPermission.ts b/frontend/src/ee/api/memberships/UpdateUserProjectPermission.ts
index d4371e252..c50710601 100644
--- a/frontend/src/ee/api/memberships/UpdateUserProjectPermission.ts
+++ b/frontend/src/ee/api/memberships/UpdateUserProjectPermission.ts
@@ -26,9 +26,9 @@ const updateUserProjectPermission = async ({
permissions: denials
})
}).then(async (res) => {
- console.log({
- permissions: denials
- }, res)
+ // console.log({
+ // permissions: denials
+ // }, res)
if (res && res.status === 200) {
return res.json();
}
diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx
index f76e0f4be..cfdee0a10 100644
--- a/frontend/src/hooks/api/auditLogs/constants.tsx
+++ b/frontend/src/hooks/api/auditLogs/constants.tsx
@@ -31,7 +31,8 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.CREATE_SECRET_IMPORT]: "Create secret import",
[EventType.UPDATE_SECRET_IMPORT]: "Update secret import",
[EventType.DELETE_SECRET_IMPORT]: "Delete secret import",
-
+ [EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS]: "Update denied permissions",
+ [EventType.UPDATE_USER_WORKSPACE_ROLE]: "Update user role"
};
export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = {
diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx
index dfc047b03..d19876525 100644
--- a/frontend/src/hooks/api/auditLogs/enums.tsx
+++ b/frontend/src/hooks/api/auditLogs/enums.tsx
@@ -40,5 +40,7 @@ export enum EventType {
GET_SECRET_IMPORTS = "get-secret-imports",
CREATE_SECRET_IMPORT = "create-secret-import",
UPDATE_SECRET_IMPORT = "update-secret-import",
- DELETE_SECRET_IMPORT = "delete-secret-import"
+ DELETE_SECRET_IMPORT = "delete-secret-import",
+ UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
+ UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
}
\ No newline at end of file
diff --git a/frontend/src/hooks/api/auditLogs/types.tsx b/frontend/src/hooks/api/auditLogs/types.tsx
index 9a41c85f0..40488f196 100644
--- a/frontend/src/hooks/api/auditLogs/types.tsx
+++ b/frontend/src/hooks/api/auditLogs/types.tsx
@@ -348,6 +348,29 @@ interface DeleteSecretImportEvent {
}
}
+interface UpdateUserRole {
+ type: EventType.UPDATE_USER_WORKSPACE_ROLE,
+ metadata: {
+ userId: string;
+ email: string;
+ oldRole: string;
+ newRole: string;
+ }
+}
+
+interface UpdateUserDeniedPermissions {
+ type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
+ metadata: {
+ userId: string;
+ email: string;
+ deniedPermissions: {
+ environmentSlug: string;
+ ability: string;
+ }[]
+ }
+}
+
+
export type Event =
| GetSecretsEvent
| GetSecretEvent
@@ -378,7 +401,9 @@ export type Event =
| GetSecretImportsEvent
| CreateSecretImportEvent
| UpdateSecretImportEvent
- | DeleteSecretImportEvent;
+ | DeleteSecretImportEvent
+ | UpdateUserRole
+ | UpdateUserDeniedPermissions;
export type AuditLog = {
_id: string;
diff --git a/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx b/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx
index 795450d9d..0520d73ba 100644
--- a/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx
+++ b/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx
@@ -279,6 +279,27 @@ export const LogsTableRow = ({
{`Import to path: ${event.metadata.importToSecretPath}`}
);
+ case EventType.UPDATE_USER_WORKSPACE_ROLE:
+ return (
+
+ {`Email: ${event.metadata.email}`}
+ {`Old role: ${event.metadata.oldRole}`}
+ {`New role: ${event.metadata.newRole}`}
+ |
+ );
+ case EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS:
+ return (
+
+ {`Email: ${event.metadata.email}`}
+ {event.metadata.deniedPermissions.map((permission) => {
+ return (
+
+ {`Denied env-ability: ${permission.environmentSlug}-${permission.ability}`}
+
+ );
+ })}
+ |
+ );
default:
return (
|