From 64cd858f9cf01ac8f62689081d03166322dc73d0 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 17 Sep 2025 16:49:08 -0700 Subject: [PATCH 1/8] fix: add project slug param for moving secrets on dashboard overview and environment view --- frontend/src/hooks/api/secrets/mutations.tsx | 4 ++-- frontend/src/hooks/api/secrets/types.ts | 1 + .../components/MoveSecretsDialog/MoveSecretsDialog.tsx | 2 ++ .../SecretDashboardPage/components/ActionBar/ActionBar.tsx | 6 ++---- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/frontend/src/hooks/api/secrets/mutations.tsx b/frontend/src/hooks/api/secrets/mutations.tsx index de960cd04..5c1986b21 100644 --- a/frontend/src/hooks/api/secrets/mutations.tsx +++ b/frontend/src/hooks/api/secrets/mutations.tsx @@ -337,7 +337,7 @@ export const useMoveSecrets = ({ destinationSecretPath, secretIds, shouldOverwrite, - projectId + projectSlug }) => { const { data } = await apiRequest.post<{ isSourceUpdated: boolean; @@ -349,7 +349,7 @@ export const useMoveSecrets = ({ destinationSecretPath, secretIds, shouldOverwrite, - projectId + projectSlug }); return data; diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts index 327d3659d..4b45d2d6a 100644 --- a/frontend/src/hooks/api/secrets/types.ts +++ b/frontend/src/hooks/api/secrets/types.ts @@ -228,6 +228,7 @@ export type TDeleteSecretBatchDTO = { export type TMoveSecretsDTO = { projectId: string; + projectSlug: string; sourceEnvironment: string; sourceSecretPath: string; destinationEnvironment: string; diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx index 30ea57957..30d7bf676 100644 --- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx +++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx @@ -66,6 +66,7 @@ const Content = ({ secrets, environments, projectId, + projectSlug, sourceSecretPath }: ContentProps) => { const [search, setSearch] = useState(sourceSecretPath); @@ -194,6 +195,7 @@ const Content = ({ destinationEnvironment: environment.slug, destinationSecretPath: value.secretPath, projectId, + projectSlug, secretIds: secretsToMove.map((sec) => sec.id) }); diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx index 226230c1a..2097fc650 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx @@ -72,10 +72,7 @@ import { useMoveSecrets, useUpdateSecretBatch } from "@app/hooks/api"; -import { - dashboardKeys, - fetchDashboardProjectSecretsByKeys -} from "@app/hooks/api/dashboard/queries"; +import { dashboardKeys, fetchDashboardProjectSecretsByKeys } from "@app/hooks/api/dashboard/queries"; import { UsedBySecretSyncs } from "@app/hooks/api/dashboard/types"; import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries"; import { PendingAction } from "@app/hooks/api/secretFolders/types"; @@ -349,6 +346,7 @@ export const ActionBar = ({ destinationEnvironment, destinationSecretPath, projectId, + projectSlug: currentProject.slug, secretIds: secretsToMove.map((sec) => sec.id) }); From 70372771229a10053b4d385235a68458cf4d6435 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 17 Sep 2025 17:18:29 -0700 Subject: [PATCH 2/8] fix: prevent rotation secrets from select all bulk selection --- .../src/pages/secret-manager/OverviewPage/OverviewPage.tsx | 3 +++ .../secret-manager/SecretDashboardPage/SecretDashboardPage.tsx | 3 +++ 2 files changed, 6 insertions(+) diff --git a/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx b/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx index ab9b332b0..d884f3b6a 100644 --- a/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx +++ b/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx @@ -731,6 +731,9 @@ export const OverviewPage = () => { userAvailableEnvs.forEach((env) => { secrets?.forEach((secret) => { + // bulk actions don't apply to rotation secrets (move/delete) + if (secret.isRotatedSecret) return; + if (allRowsSelectedOnPage.isChecked) { delete newChecks[EntryType.SECRET][secret.key]; } else { diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx index c926450eb..72232058d 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx @@ -570,6 +570,9 @@ const Page = () => { const newChecks = { ...selectedSecrets }; secrets?.forEach((secret) => { + // bulk actions don't apply to rotation secrets (move/delete) + if (secret.isRotatedSecret) return; + if (allRowsSelectedOnPage.isChecked) { delete newChecks[secret.id]; } else { From cd35fb9139fe711d1368155e95620365a2f6063e Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Sep 2025 20:10:51 +0530 Subject: [PATCH 3/8] feat: resolved secret move failing --- backend/src/server/routes/v4/secret-router.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/server/routes/v4/secret-router.ts b/backend/src/server/routes/v4/secret-router.ts index ead96668c..2c9f05570 100644 --- a/backend/src/server/routes/v4/secret-router.ts +++ b/backend/src/server/routes/v4/secret-router.ts @@ -762,7 +762,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { hide: false, tags: [ApiDocsTags.Secrets], body: z.object({ - projectSlug: z.string().trim(), + projectId: z.string().trim(), sourceEnvironment: z.string().trim(), sourceSecretPath: z.string().trim().default("/").transform(removeTrailingSlash), destinationEnvironment: z.string().trim(), From fa230a667c914c021427c4f33887135ad7853d4f Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Sep 2025 20:25:33 +0530 Subject: [PATCH 4/8] Revert "fix: add project slug param for moving secrets on dashboard overview and environment view" This reverts commit 64cd858f9cf01ac8f62689081d03166322dc73d0. --- frontend/src/hooks/api/secrets/mutations.tsx | 4 ++-- frontend/src/hooks/api/secrets/types.ts | 1 - .../components/MoveSecretsDialog/MoveSecretsDialog.tsx | 2 -- .../SecretDashboardPage/components/ActionBar/ActionBar.tsx | 6 ++++-- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/frontend/src/hooks/api/secrets/mutations.tsx b/frontend/src/hooks/api/secrets/mutations.tsx index 5c1986b21..de960cd04 100644 --- a/frontend/src/hooks/api/secrets/mutations.tsx +++ b/frontend/src/hooks/api/secrets/mutations.tsx @@ -337,7 +337,7 @@ export const useMoveSecrets = ({ destinationSecretPath, secretIds, shouldOverwrite, - projectSlug + projectId }) => { const { data } = await apiRequest.post<{ isSourceUpdated: boolean; @@ -349,7 +349,7 @@ export const useMoveSecrets = ({ destinationSecretPath, secretIds, shouldOverwrite, - projectSlug + projectId }); return data; diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts index 4b45d2d6a..327d3659d 100644 --- a/frontend/src/hooks/api/secrets/types.ts +++ b/frontend/src/hooks/api/secrets/types.ts @@ -228,7 +228,6 @@ export type TDeleteSecretBatchDTO = { export type TMoveSecretsDTO = { projectId: string; - projectSlug: string; sourceEnvironment: string; sourceSecretPath: string; destinationEnvironment: string; diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx index 30d7bf676..30ea57957 100644 --- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx +++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx @@ -66,7 +66,6 @@ const Content = ({ secrets, environments, projectId, - projectSlug, sourceSecretPath }: ContentProps) => { const [search, setSearch] = useState(sourceSecretPath); @@ -195,7 +194,6 @@ const Content = ({ destinationEnvironment: environment.slug, destinationSecretPath: value.secretPath, projectId, - projectSlug, secretIds: secretsToMove.map((sec) => sec.id) }); diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx index 2097fc650..226230c1a 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx @@ -72,7 +72,10 @@ import { useMoveSecrets, useUpdateSecretBatch } from "@app/hooks/api"; -import { dashboardKeys, fetchDashboardProjectSecretsByKeys } from "@app/hooks/api/dashboard/queries"; +import { + dashboardKeys, + fetchDashboardProjectSecretsByKeys +} from "@app/hooks/api/dashboard/queries"; import { UsedBySecretSyncs } from "@app/hooks/api/dashboard/types"; import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries"; import { PendingAction } from "@app/hooks/api/secretFolders/types"; @@ -346,7 +349,6 @@ export const ActionBar = ({ destinationEnvironment, destinationSecretPath, projectId, - projectSlug: currentProject.slug, secretIds: secretsToMove.map((sec) => sec.id) }); From ebf136c580c72c01fe0a1ac0529fb14301060ae1 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 18 Sep 2025 23:38:55 +0800 Subject: [PATCH 5/8] misc: add github indicator for datadog --- .../release-standalone-docker-img-postgres-offical.yml | 2 ++ Dockerfile.standalone-infisical | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/release-standalone-docker-img-postgres-offical.yml b/.github/workflows/release-standalone-docker-img-postgres-offical.yml index 5c8809eb4..b17d5e50c 100644 --- a/.github/workflows/release-standalone-docker-img-postgres-offical.yml +++ b/.github/workflows/release-standalone-docker-img-postgres-offical.yml @@ -63,6 +63,8 @@ jobs: build-args: | POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }} INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }} + DD_GIT_REPOSITORY_URL=${{ github.server_url }}/${{ github.repository }} + DD_GIT_COMMIT_SHA=${{ github.sha }} infisical-fips-standalone: name: Build infisical standalone image postgres diff --git a/Dockerfile.standalone-infisical b/Dockerfile.standalone-infisical index a4e5c150a..9ca5e1dea 100644 --- a/Dockerfile.standalone-infisical +++ b/Dockerfile.standalone-infisical @@ -173,6 +173,12 @@ COPY --from=frontend-runner /app ./backend/frontend-build ARG INFISICAL_PLATFORM_VERSION ENV INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION +ARG DD_GIT_REPOSITORY_URL +ENV DD_GIT_REPOSITORY_URL $DD_GIT_REPOSITORY_URL + +ARG DD_GIT_COMMIT_SHA +ENV DD_GIT_COMMIT_SHA $DD_GIT_COMMIT_SHA + ENV PORT 8080 ENV HOST=0.0.0.0 ENV HTTPS_ENABLED false From 59953387c4b92e1854eb9282b92215457d65a60f Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Sep 2025 03:28:24 +0800 Subject: [PATCH 6/8] misc: added audit logs for project and org role management operations --- .../v1/deprecated-project-role-router.ts | 61 ++++++++++++++- backend/src/ee/routes/v1/org-role-router.ts | 42 +++++++++++ .../src/ee/routes/v1/project-role-router.ts | 55 +++++++++++++- .../v2/deprecated-project-role-router.ts | 55 +++++++++++++- .../ee/services/audit-log/audit-log-types.ts | 74 ++++++++++++++++++- .../src/hooks/api/auditLogs/constants.tsx | 10 ++- frontend/src/hooks/api/auditLogs/enums.tsx | 10 ++- 7 files changed, 296 insertions(+), 11 deletions(-) diff --git a/backend/src/ee/routes/v1/deprecated-project-role-router.ts b/backend/src/ee/routes/v1/deprecated-project-role-router.ts index d0ffc0239..8532e5ae7 100644 --- a/backend/src/ee/routes/v1/deprecated-project-role-router.ts +++ b/backend/src/ee/routes/v1/deprecated-project-role-router.ts @@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra"; import { z } from "zod"; import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { backfillPermissionV1SchemaToV2Schema, ProjectPermissionV1Schema @@ -50,6 +51,10 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = JSON.stringify( + packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true)) + ); + const role = await server.services.projectRole.createRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -61,7 +66,22 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, data: { ...req.body, - permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true))) + permissions: stringifiedPermissions + } + }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.CREATE_PROJECT_ROLE, + metadata: { + slug: role.slug, + name: role.name, + description: role.description, + permissions: stringifiedPermissions + } } }); @@ -106,6 +126,10 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = req.body.permissions + ? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true))) + : undefined; + const role = await server.services.projectRole.updateRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -114,11 +138,26 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv roleId: req.params.roleId, data: { ...req.body, - permissions: req.body.permissions - ? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true))) - : undefined + permissions: stringifiedPermissions } }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.UPDATE_PROJECT_ROLE, + metadata: { + originalName: role.name, + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: stringifiedPermissions + } + } + }); + return { role }; } }); @@ -155,6 +194,20 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv actor: req.permission.type, roleId: req.params.roleId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.DELETE_PROJECT_ROLE, + metadata: { + slug: role.slug, + name: role.name + } + } + }); + return { role }; } }); diff --git a/backend/src/ee/routes/v1/org-role-router.ts b/backend/src/ee/routes/v1/org-role-router.ts index c8ee03a99..00d792f83 100644 --- a/backend/src/ee/routes/v1/org-role-router.ts +++ b/backend/src/ee/routes/v1/org-role-router.ts @@ -1,6 +1,7 @@ import { z } from "zod"; import { OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { slugSchema } from "@app/server/lib/schemas"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -42,6 +43,21 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { req.permission.authMethod, req.permission.orgId ); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + event: { + type: EventType.CREATE_ORG_ROLE, + metadata: { + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: JSON.stringify(req.body.permissions) + } + } + }); + return { role }; } }); @@ -116,6 +132,22 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { req.permission.authMethod, req.permission.orgId ); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + event: { + type: EventType.UPDATE_ORG_ROLE, + metadata: { + originalName: role.name, + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: req.body.permissions ? JSON.stringify(req.body.permissions) : undefined + } + } + }); + return { role }; } }); @@ -146,6 +178,16 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { req.permission.authMethod, req.permission.orgId ); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + event: { + type: EventType.DELETE_ORG_ROLE, + metadata: { slug: role.slug, name: role.name } + } + }); + return { role }; } }); diff --git a/backend/src/ee/routes/v1/project-role-router.ts b/backend/src/ee/routes/v1/project-role-router.ts index 23633c8f5..8c0ff6a77 100644 --- a/backend/src/ee/routes/v1/project-role-router.ts +++ b/backend/src/ee/routes/v1/project-role-router.ts @@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra"; import { z } from "zod"; import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns"; import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission"; import { ApiDocsTags, PROJECT_ROLE } from "@app/lib/api-docs"; @@ -52,6 +53,8 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = JSON.stringify(packRules(req.body.permissions)); + const role = await server.services.projectRole.createRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -63,9 +66,25 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { }, data: { ...req.body, - permissions: JSON.stringify(packRules(req.body.permissions)) + permissions: stringifiedPermissions } }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.CREATE_PROJECT_ROLE, + metadata: { + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: stringifiedPermissions + } + } + }); + return { role }; } }); @@ -112,6 +131,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined; const role = await server.services.projectRole.updateRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -120,9 +140,26 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { roleId: req.params.roleId, data: { ...req.body, - permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined + permissions: stringifiedPermissions } }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.UPDATE_PROJECT_ROLE, + metadata: { + originalName: role.name, + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: stringifiedPermissions + } + } + }); + return { role }; } }); @@ -161,6 +198,20 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { actor: req.permission.type, roleId: req.params.roleId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.DELETE_PROJECT_ROLE, + metadata: { + slug: role.slug, + name: role.name + } + } + }); + return { role }; } }); diff --git a/backend/src/ee/routes/v2/deprecated-project-role-router.ts b/backend/src/ee/routes/v2/deprecated-project-role-router.ts index 41a04974d..34b7234fc 100644 --- a/backend/src/ee/routes/v2/deprecated-project-role-router.ts +++ b/backend/src/ee/routes/v2/deprecated-project-role-router.ts @@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra"; import { z } from "zod"; import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns"; import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission"; import { ApiDocsTags, PROJECT_ROLE } from "@app/lib/api-docs"; @@ -52,6 +53,8 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = JSON.stringify(packRules(req.body.permissions)); + const role = await server.services.projectRole.createRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -63,9 +66,25 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, data: { ...req.body, - permissions: JSON.stringify(packRules(req.body.permissions)) + permissions: stringifiedPermissions } }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.CREATE_PROJECT_ROLE, + metadata: { + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: stringifiedPermissions + } + } + }); + return { role }; } }); @@ -112,6 +131,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + const stringifiedPermissions = req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined; const role = await server.services.projectRole.updateRole({ actorAuthMethod: req.permission.authMethod, actorId: req.permission.id, @@ -120,9 +140,26 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv roleId: req.params.roleId, data: { ...req.body, - permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined + permissions: stringifiedPermissions } }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.UPDATE_PROJECT_ROLE, + metadata: { + originalName: role.name, + slug: req.body.slug, + name: req.body.name, + description: req.body.description, + permissions: stringifiedPermissions + } + } + }); + return { role }; } }); @@ -161,6 +198,20 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv actor: req.permission.type, roleId: req.params.roleId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: role.projectId, + event: { + type: EventType.DELETE_PROJECT_ROLE, + metadata: { + slug: role.slug, + name: role.name + } + } + }); + return { role }; } }); diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 07773885a..205ca8bfc 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -478,6 +478,14 @@ export enum EventType { UPDATE_PROJECT = "update-project", DELETE_PROJECT = "delete-project", + CREATE_PROJECT_ROLE = "create-project-role", + UPDATE_PROJECT_ROLE = "update-project-role", + DELETE_PROJECT_ROLE = "delete-project-role", + + CREATE_ORG_ROLE = "create-org-role", + UPDATE_ORG_ROLE = "update-org-role", + DELETE_ORG_ROLE = "delete-org-role", + CREATE_SECRET_REMINDER = "create-secret-reminder", GET_SECRET_REMINDER = "get-secret-reminder", DELETE_SECRET_REMINDER = "delete-secret-reminder" @@ -3502,6 +3510,64 @@ interface ProjectDeleteEvent { }; } +interface ProjectRoleCreateEvent { + type: EventType.CREATE_PROJECT_ROLE; + metadata: { + slug: string; + name: string; + description?: string | null; + permissions: string; + }; +} + +interface ProjectRoleUpdateEvent { + type: EventType.UPDATE_PROJECT_ROLE; + metadata: { + originalName: string; + slug?: string; + name?: string; + description?: string | null; + permissions?: string; + }; +} + +interface ProjectRoleDeleteEvent { + type: EventType.DELETE_PROJECT_ROLE; + metadata: { + slug: string; + name: string; + }; +} + +interface OrgRoleCreateEvent { + type: EventType.CREATE_ORG_ROLE; + metadata: { + slug: string; + name: string; + description?: string | null; + permissions: string; + }; +} + +interface OrgRoleUpdateEvent { + type: EventType.UPDATE_ORG_ROLE; + metadata: { + originalName: string; + slug?: string; + name?: string; + description?: string | null; + permissions?: string; + }; +} + +interface OrgRoleDeleteEvent { + type: EventType.DELETE_ORG_ROLE; + metadata: { + slug: string; + name: string; + }; +} + export type Event = | GetSecretsEvent | GetSecretEvent @@ -3818,4 +3884,10 @@ export type Event = | ProjectDeleteEvent | SecretReminderCreateEvent | SecretReminderGetEvent - | SecretReminderDeleteEvent; + | SecretReminderDeleteEvent + | ProjectRoleCreateEvent + | ProjectRoleUpdateEvent + | ProjectRoleDeleteEvent + | OrgRoleCreateEvent + | OrgRoleUpdateEvent + | OrgRoleDeleteEvent; diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 503264fb2..15993023e 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -222,7 +222,15 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.UPDATE_ORG]: "Update Organization", [EventType.CREATE_PROJECT]: "Create Project", [EventType.UPDATE_PROJECT]: "Update Project", - [EventType.DELETE_PROJECT]: "Delete Project" + [EventType.DELETE_PROJECT]: "Delete Project", + + [EventType.CREATE_PROJECT_ROLE]: "Create Project Role", + [EventType.UPDATE_PROJECT_ROLE]: "Update Project Role", + [EventType.DELETE_PROJECT_ROLE]: "Delete Project Role", + + [EventType.CREATE_ORG_ROLE]: "Create Org Role", + [EventType.UPDATE_ORG_ROLE]: "Update Org Role", + [EventType.DELETE_ORG_ROLE]: "Delete Org Role" }; export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = { diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index bfa983188..77baaa990 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -216,5 +216,13 @@ export enum EventType { CREATE_PROJECT = "create-project", UPDATE_PROJECT = "update-project", - DELETE_PROJECT = "delete-project" + DELETE_PROJECT = "delete-project", + + CREATE_PROJECT_ROLE = "create-project-role", + UPDATE_PROJECT_ROLE = "update-project-role", + DELETE_PROJECT_ROLE = "delete-project-role", + + CREATE_ORG_ROLE = "create-org-role", + UPDATE_ORG_ROLE = "update-org-role", + DELETE_ORG_ROLE = "delete-org-role" } From b8bcea5435fe2eb344d1ce548a9b99c5bd12d901 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Sep 2025 03:44:56 +0800 Subject: [PATCH 7/8] misc: added role ID tracking --- .../src/ee/routes/v1/deprecated-project-role-router.ts | 4 +++- backend/src/ee/routes/v1/org-role-router.ts | 5 +++-- backend/src/ee/routes/v1/project-role-router.ts | 4 +++- .../src/ee/routes/v2/deprecated-project-role-router.ts | 4 +++- backend/src/ee/services/audit-log/audit-log-types.ts | 8 ++++++-- 5 files changed, 18 insertions(+), 7 deletions(-) diff --git a/backend/src/ee/routes/v1/deprecated-project-role-router.ts b/backend/src/ee/routes/v1/deprecated-project-role-router.ts index 8532e5ae7..b1155acf8 100644 --- a/backend/src/ee/routes/v1/deprecated-project-role-router.ts +++ b/backend/src/ee/routes/v1/deprecated-project-role-router.ts @@ -77,6 +77,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.CREATE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: role.slug, name: role.name, description: role.description, @@ -149,7 +150,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.UPDATE_PROJECT_ROLE, metadata: { - originalName: role.name, + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -202,6 +203,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.DELETE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: role.slug, name: role.name } diff --git a/backend/src/ee/routes/v1/org-role-router.ts b/backend/src/ee/routes/v1/org-role-router.ts index 00d792f83..070462d47 100644 --- a/backend/src/ee/routes/v1/org-role-router.ts +++ b/backend/src/ee/routes/v1/org-role-router.ts @@ -50,6 +50,7 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { event: { type: EventType.CREATE_ORG_ROLE, metadata: { + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -139,7 +140,7 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { event: { type: EventType.UPDATE_ORG_ROLE, metadata: { - originalName: role.name, + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -184,7 +185,7 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => { orgId: req.permission.orgId, event: { type: EventType.DELETE_ORG_ROLE, - metadata: { slug: role.slug, name: role.name } + metadata: { roleId: role.id, slug: role.slug, name: role.name } } }); diff --git a/backend/src/ee/routes/v1/project-role-router.ts b/backend/src/ee/routes/v1/project-role-router.ts index 8c0ff6a77..5a20ad893 100644 --- a/backend/src/ee/routes/v1/project-role-router.ts +++ b/backend/src/ee/routes/v1/project-role-router.ts @@ -77,6 +77,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { event: { type: EventType.CREATE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -151,7 +152,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { event: { type: EventType.UPDATE_PROJECT_ROLE, metadata: { - originalName: role.name, + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -206,6 +207,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { event: { type: EventType.DELETE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: role.slug, name: role.name } diff --git a/backend/src/ee/routes/v2/deprecated-project-role-router.ts b/backend/src/ee/routes/v2/deprecated-project-role-router.ts index 34b7234fc..326bda06a 100644 --- a/backend/src/ee/routes/v2/deprecated-project-role-router.ts +++ b/backend/src/ee/routes/v2/deprecated-project-role-router.ts @@ -77,6 +77,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.CREATE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -151,7 +152,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.UPDATE_PROJECT_ROLE, metadata: { - originalName: role.name, + roleId: role.id, slug: req.body.slug, name: req.body.name, description: req.body.description, @@ -206,6 +207,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv event: { type: EventType.DELETE_PROJECT_ROLE, metadata: { + roleId: role.id, slug: role.slug, name: role.name } diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 205ca8bfc..a6111f6ae 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -3513,6 +3513,7 @@ interface ProjectDeleteEvent { interface ProjectRoleCreateEvent { type: EventType.CREATE_PROJECT_ROLE; metadata: { + roleId: string; slug: string; name: string; description?: string | null; @@ -3523,7 +3524,7 @@ interface ProjectRoleCreateEvent { interface ProjectRoleUpdateEvent { type: EventType.UPDATE_PROJECT_ROLE; metadata: { - originalName: string; + roleId: string; slug?: string; name?: string; description?: string | null; @@ -3534,6 +3535,7 @@ interface ProjectRoleUpdateEvent { interface ProjectRoleDeleteEvent { type: EventType.DELETE_PROJECT_ROLE; metadata: { + roleId: string; slug: string; name: string; }; @@ -3542,6 +3544,7 @@ interface ProjectRoleDeleteEvent { interface OrgRoleCreateEvent { type: EventType.CREATE_ORG_ROLE; metadata: { + roleId: string; slug: string; name: string; description?: string | null; @@ -3552,7 +3555,7 @@ interface OrgRoleCreateEvent { interface OrgRoleUpdateEvent { type: EventType.UPDATE_ORG_ROLE; metadata: { - originalName: string; + roleId: string; slug?: string; name?: string; description?: string | null; @@ -3563,6 +3566,7 @@ interface OrgRoleUpdateEvent { interface OrgRoleDeleteEvent { type: EventType.DELETE_ORG_ROLE; metadata: { + roleId: string; slug: string; name: string; }; From b519d00d4ba20720b98b983c3d26e26f2e0c9652 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Sep 2025 03:47:06 +0800 Subject: [PATCH 8/8] mics: updated logic to be consistent --- backend/src/ee/routes/v1/deprecated-project-role-router.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/ee/routes/v1/deprecated-project-role-router.ts b/backend/src/ee/routes/v1/deprecated-project-role-router.ts index b1155acf8..dc361626d 100644 --- a/backend/src/ee/routes/v1/deprecated-project-role-router.ts +++ b/backend/src/ee/routes/v1/deprecated-project-role-router.ts @@ -78,9 +78,9 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv type: EventType.CREATE_PROJECT_ROLE, metadata: { roleId: role.id, - slug: role.slug, - name: role.name, - description: role.description, + slug: req.body.slug, + name: req.body.name, + description: req.body.description, permissions: stringifiedPermissions } }