From 4f41673c3847bf0a460797737a35c826903d5060 Mon Sep 17 00:00:00 2001 From: x032205 Date: Sun, 7 Dec 2025 23:51:22 -0500 Subject: [PATCH] audit log all endpoints --- .../ee/services/audit-log/audit-log-types.ts | 152 +++++++++++++- .../approval-policy-endpoints.ts | 196 ++++++++++++++++-- .../approval-policy-service.ts | 3 +- .../src/hooks/api/auditLogs/constants.tsx | 33 ++- frontend/src/hooks/api/auditLogs/enums.tsx | 17 +- 5 files changed, 380 insertions(+), 21 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 504339d18..adfac13c1 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -559,7 +559,21 @@ export enum EventType { PAM_RESOURCE_GET = "pam-resource-get", PAM_RESOURCE_CREATE = "pam-resource-create", PAM_RESOURCE_UPDATE = "pam-resource-update", - PAM_RESOURCE_DELETE = "pam-resource-delete" + PAM_RESOURCE_DELETE = "pam-resource-delete", + APPROVAL_POLICY_CREATE = "approval-policy-create", + APPROVAL_POLICY_UPDATE = "approval-policy-update", + APPROVAL_POLICY_DELETE = "approval-policy-delete", + APPROVAL_POLICY_LIST = "approval-policy-list", + APPROVAL_POLICY_GET = "approval-policy-get", + APPROVAL_REQUEST_GET = "approval-request-get", + APPROVAL_REQUEST_LIST = "approval-request-list", + APPROVAL_REQUEST_CREATE = "approval-request-create", + APPROVAL_REQUEST_APPROVE = "approval-request-approve", + APPROVAL_REQUEST_REJECT = "approval-request-reject", + APPROVAL_REQUEST_CANCEL = "approval-request-cancel", + APPROVAL_REQUEST_GRANT_LIST = "approval-request-grant-list", + APPROVAL_REQUEST_GRANT_GET = "approval-request-grant-get", + APPROVAL_REQUEST_GRANT_REVOKE = "approval-request-grant-revoke" } export const filterableSecretEvents: EventType[] = [ @@ -4224,6 +4238,126 @@ interface GetCertificateFromRequestEvent { }; } +interface ApprovalPolicyCreateEvent { + type: EventType.APPROVAL_POLICY_CREATE; + metadata: { + policyType: string; + name: string; + }; +} + +interface ApprovalPolicyUpdateEvent { + type: EventType.APPROVAL_POLICY_UPDATE; + metadata: { + policyType: string; + policyId: string; + name: string; + }; +} + +interface ApprovalPolicyDeleteEvent { + type: EventType.APPROVAL_POLICY_DELETE; + metadata: { + policyType: string; + policyId: string; + }; +} + +interface ApprovalPolicyListEvent { + type: EventType.APPROVAL_POLICY_LIST; + metadata: { + policyType: string; + count: number; + }; +} + +interface ApprovalPolicyGetEvent { + type: EventType.APPROVAL_POLICY_GET; + metadata: { + policyType: string; + policyId: string; + name: string; + }; +} + +interface ApprovalRequestGetEvent { + type: EventType.APPROVAL_REQUEST_GET; + metadata: { + policyType: string; + requestId: string; + status: string; + }; +} + +interface ApprovalRequestListEvent { + type: EventType.APPROVAL_REQUEST_LIST; + metadata: { + policyType: string; + count: number; + }; +} + +interface ApprovalRequestCreateEvent { + type: EventType.APPROVAL_REQUEST_CREATE; + metadata: { + policyType: string; + justification?: string; + requestDuration: string; + }; +} + +interface ApprovalRequestApproveEvent { + type: EventType.APPROVAL_REQUEST_APPROVE; + metadata: { + policyType: string; + requestId: string; + comment?: string; + }; +} + +interface ApprovalRequestRejectEvent { + type: EventType.APPROVAL_REQUEST_REJECT; + metadata: { + policyType: string; + requestId: string; + comment?: string; + }; +} + +interface ApprovalRequestCancelEvent { + type: EventType.APPROVAL_REQUEST_CANCEL; + metadata: { + policyType: string; + requestId: string; + }; +} + +interface ApprovalRequestGrantListEvent { + type: EventType.APPROVAL_REQUEST_GRANT_LIST; + metadata: { + policyType: string; + count: number; + }; +} + +interface ApprovalRequestGrantGetEvent { + type: EventType.APPROVAL_REQUEST_GRANT_GET; + metadata: { + policyType: string; + grantId: string; + status: string; + }; +} + +interface ApprovalRequestGrantRevokeEvent { + type: EventType.APPROVAL_REQUEST_GRANT_REVOKE; + metadata: { + policyType: string; + grantId: string; + revocationReason?: string; + }; +} + export type Event = | CreateSubOrganizationEvent | UpdateSubOrganizationEvent @@ -4609,4 +4743,18 @@ export type Event = | AutomatedRenewCertificate | AutomatedRenewCertificateFailed | UserLoginEvent - | SelectOrganizationEvent; + | SelectOrganizationEvent + | ApprovalPolicyCreateEvent + | ApprovalPolicyUpdateEvent + | ApprovalPolicyDeleteEvent + | ApprovalPolicyListEvent + | ApprovalPolicyGetEvent + | ApprovalRequestGetEvent + | ApprovalRequestListEvent + | ApprovalRequestCreateEvent + | ApprovalRequestApproveEvent + | ApprovalRequestRejectEvent + | ApprovalRequestCancelEvent + | ApprovalRequestGrantListEvent + | ApprovalRequestGrantGetEvent + | ApprovalRequestGrantRevokeEvent; diff --git a/backend/src/server/routes/v1/approval-policy-routers/approval-policy-endpoints.ts b/backend/src/server/routes/v1/approval-policy-routers/approval-policy-endpoints.ts index dc3363497..51bcab001 100644 --- a/backend/src/server/routes/v1/approval-policy-routers/approval-policy-endpoints.ts +++ b/backend/src/server/routes/v1/approval-policy-routers/approval-policy-endpoints.ts @@ -11,6 +11,7 @@ import { TUpdatePolicyDTO } from "@app/services/approval-policy/approval-policy-types"; import { AuthMode } from "@app/services/auth/auth-type"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; export const registerApprovalPolicyEndpoints =

({ server, @@ -61,7 +62,18 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { policy } = await server.services.approvalPolicy.create(policyType, req.body, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: req.body.projectId, + event: { + type: EventType.APPROVAL_POLICY_CREATE, + metadata: { + policyType, + name: req.body.name + } + } + }); return { policy }; } @@ -88,7 +100,18 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { policies } = await server.services.approvalPolicy.list(policyType, req.query.projectId, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: req.query.projectId, + event: { + type: EventType.APPROVAL_POLICY_LIST, + metadata: { + policyType, + count: policies.length + } + } + }); return { policies }; } @@ -115,7 +138,19 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { policy } = await server.services.approvalPolicy.getById(req.params.policyId, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: policy.projectId, + event: { + type: EventType.APPROVAL_POLICY_GET, + metadata: { + policyType, + policyId: policy.id, + name: policy.name + } + } + }); return { policy }; } @@ -143,7 +178,19 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { policy } = await server.services.approvalPolicy.updateById(req.params.policyId, req.body, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: policy.projectId, + event: { + type: EventType.APPROVAL_POLICY_UPDATE, + metadata: { + policyType, + policyId: policy.id, + name: policy.name + } + } + }); return { policy }; } @@ -168,9 +215,23 @@ export const registerApprovalPolicyEndpoints =

({ }, onRequest: verifyAuth([AuthMode.JWT]), handler: async (req) => { - const { policyId } = await server.services.approvalPolicy.deleteById(req.params.policyId, req.permission); + const { policyId, projectId } = await server.services.approvalPolicy.deleteById( + req.params.policyId, + req.permission + ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId, + event: { + type: EventType.APPROVAL_POLICY_DELETE, + metadata: { + policyType, + policyId + } + } + }); return { policyId }; } @@ -202,7 +263,18 @@ export const registerApprovalPolicyEndpoints =

({ req.permission ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: req.query.projectId, + event: { + type: EventType.APPROVAL_REQUEST_LIST, + metadata: { + policyType, + count: requests.length + } + } + }); return { requests }; } @@ -240,7 +312,19 @@ export const registerApprovalPolicyEndpoints =

({ req.permission ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: request.projectId, + event: { + type: EventType.APPROVAL_REQUEST_CREATE, + metadata: { + policyType, + justification: req.body.justification || undefined, + requestDuration: req.body.requestDuration || "infinite" + } + } + }); return { request }; } @@ -267,7 +351,19 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { request } = await server.services.approvalPolicy.getRequestById(req.params.requestId, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: request.projectId, + event: { + type: EventType.APPROVAL_REQUEST_GET, + metadata: { + policyType, + requestId: request.id, + status: request.status + } + } + }); return { request }; } @@ -301,7 +397,19 @@ export const registerApprovalPolicyEndpoints =

({ req.permission ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: request.projectId, + event: { + type: EventType.APPROVAL_REQUEST_APPROVE, + metadata: { + policyType, + requestId: req.params.requestId, + comment: req.body.comment + } + } + }); return { request }; } @@ -335,7 +443,19 @@ export const registerApprovalPolicyEndpoints =

({ req.permission ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: request.projectId, + event: { + type: EventType.APPROVAL_REQUEST_REJECT, + metadata: { + policyType, + requestId: req.params.requestId, + comment: req.body.comment + } + } + }); return { request }; } @@ -362,7 +482,18 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { request } = await server.services.approvalPolicy.cancelRequest(req.params.requestId, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: request.projectId, + event: { + type: EventType.APPROVAL_REQUEST_CANCEL, + metadata: { + policyType, + requestId: req.params.requestId + } + } + }); return { request }; } @@ -394,7 +525,18 @@ export const registerApprovalPolicyEndpoints =

({ req.permission ); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: req.query.projectId, + event: { + type: EventType.APPROVAL_REQUEST_GRANT_LIST, + metadata: { + policyType, + count: grants.length + } + } + }); return { grants }; } @@ -421,7 +563,19 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { grant } = await server.services.approvalPolicy.getGrantById(req.params.grantId, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: grant.projectId, + event: { + type: EventType.APPROVAL_REQUEST_GRANT_GET, + metadata: { + policyType, + grantId: grant.id, + status: grant.status + } + } + }); return { grant }; } @@ -451,7 +605,19 @@ export const registerApprovalPolicyEndpoints =

({ handler: async (req) => { const { grant } = await server.services.approvalPolicy.revokeGrant(req.params.grantId, req.body, req.permission); - // TODO(andrey): Audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + orgId: req.permission.orgId, + projectId: grant.projectId, + event: { + type: EventType.APPROVAL_REQUEST_GRANT_REVOKE, + metadata: { + policyType, + grantId: grant.id, + revocationReason: req.body.revocationReason + } + } + }); return { grant }; } diff --git a/backend/src/services/approval-policy/approval-policy-service.ts b/backend/src/services/approval-policy/approval-policy-service.ts index 10e46d3b8..1940b9877 100644 --- a/backend/src/services/approval-policy/approval-policy-service.ts +++ b/backend/src/services/approval-policy/approval-policy-service.ts @@ -355,7 +355,8 @@ export const approvalPolicyServiceFactory = ({ await approvalPolicyDAL.deleteById(policyId); return { - policyId + policyId, + projectId: policy.projectId }; }; diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index a11504193..3ace3f841 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -291,7 +291,22 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.SIGN_CERTIFICATE_FROM_PROFILE]: "Sign Certificate From Profile", [EventType.ORDER_CERTIFICATE_FROM_PROFILE]: "Order Certificate From Profile", [EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE]: - "Get Certificate Profile Latest Active Bundle" + "Get Certificate Profile Latest Active Bundle", + + [EventType.APPROVAL_POLICY_CREATE]: "Create Approval Policy", + [EventType.APPROVAL_POLICY_UPDATE]: "Update Approval Policy", + [EventType.APPROVAL_POLICY_DELETE]: "Delete Approval Policy", + [EventType.APPROVAL_POLICY_LIST]: "List Approval Policies", + [EventType.APPROVAL_POLICY_GET]: "Get Approval Policy", + [EventType.APPROVAL_REQUEST_GET]: "Get Approval Request", + [EventType.APPROVAL_REQUEST_LIST]: "List Approval Requests", + [EventType.APPROVAL_REQUEST_CREATE]: "Create Approval Request", + [EventType.APPROVAL_REQUEST_APPROVE]: "Approve Approval Request", + [EventType.APPROVAL_REQUEST_REJECT]: "Reject Approval Request", + [EventType.APPROVAL_REQUEST_CANCEL]: "Cancel Approval Request", + [EventType.APPROVAL_REQUEST_GRANT_LIST]: "List Approval Request Grants", + [EventType.APPROVAL_REQUEST_GRANT_GET]: "Get Approval Request Grant", + [EventType.APPROVAL_REQUEST_GRANT_REVOKE]: "Revoke Approval Request Grant" }; export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = { @@ -309,7 +324,21 @@ const sharedProjectEvents = [ EventType.REMOVE_PROJECT_MEMBER, EventType.CREATE_PROJECT_ROLE, EventType.UPDATE_PROJECT_ROLE, - EventType.DELETE_PROJECT_ROLE + EventType.DELETE_PROJECT_ROLE, + EventType.APPROVAL_POLICY_CREATE, + EventType.APPROVAL_POLICY_UPDATE, + EventType.APPROVAL_POLICY_DELETE, + EventType.APPROVAL_POLICY_LIST, + EventType.APPROVAL_POLICY_GET, + EventType.APPROVAL_REQUEST_GET, + EventType.APPROVAL_REQUEST_LIST, + EventType.APPROVAL_REQUEST_CREATE, + EventType.APPROVAL_REQUEST_APPROVE, + EventType.APPROVAL_REQUEST_REJECT, + EventType.APPROVAL_REQUEST_CANCEL, + EventType.APPROVAL_REQUEST_GRANT_LIST, + EventType.APPROVAL_REQUEST_GRANT_GET, + EventType.APPROVAL_REQUEST_GRANT_REVOKE ]; export const projectToEventsMap: Partial> = { diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index bde306450..b3be5a6fd 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -282,5 +282,20 @@ export enum EventType { ISSUE_CERTIFICATE_FROM_PROFILE = "issue-certificate-from-profile", SIGN_CERTIFICATE_FROM_PROFILE = "sign-certificate-from-profile", ORDER_CERTIFICATE_FROM_PROFILE = "order-certificate-from-profile", - GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE = "get-certificate-profile-latest-active-bundle" + GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE = "get-certificate-profile-latest-active-bundle", + + APPROVAL_POLICY_CREATE = "approval-policy-create", + APPROVAL_POLICY_UPDATE = "approval-policy-update", + APPROVAL_POLICY_DELETE = "approval-policy-delete", + APPROVAL_POLICY_LIST = "approval-policy-list", + APPROVAL_POLICY_GET = "approval-policy-get", + APPROVAL_REQUEST_GET = "approval-request-get", + APPROVAL_REQUEST_LIST = "approval-request-list", + APPROVAL_REQUEST_CREATE = "approval-request-create", + APPROVAL_REQUEST_APPROVE = "approval-request-approve", + APPROVAL_REQUEST_REJECT = "approval-request-reject", + APPROVAL_REQUEST_CANCEL = "approval-request-cancel", + APPROVAL_REQUEST_GRANT_LIST = "approval-request-grant-list", + APPROVAL_REQUEST_GRANT_GET = "approval-request-grant-get", + APPROVAL_REQUEST_GRANT_REVOKE = "approval-request-grant-revoke" }