From 51c0598b50cb57344ffb85f75877089349a52606 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 18 Sep 2024 16:54:51 +0400 Subject: [PATCH] feat: audit log permissions --- backend/src/ee/services/audit-log/audit-log-service.ts | 7 ++++--- backend/src/ee/services/permission/org-permission.ts | 9 ++++++++- frontend/src/context/OrgPermissionContext/types.ts | 6 ++++-- .../RolePage/components/OrgRoleModifySection.utils.ts | 2 ++ .../RolePermissionsSection/RolePermissionsSection.tsx | 4 ++++ 5 files changed, 22 insertions(+), 6 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-service.ts b/backend/src/ee/services/audit-log/audit-log-service.ts index a93b2a6e1..747c53c1a 100644 --- a/backend/src/ee/services/audit-log/audit-log-service.ts +++ b/backend/src/ee/services/audit-log/audit-log-service.ts @@ -24,6 +24,7 @@ export const auditLogServiceFactory = ({ permissionService }: TAuditLogServiceFactoryDep) => { const listAuditLogs = async ({ actorAuthMethod, actorId, actorOrgId, actor, filter }: TListProjectAuditLogDTO) => { + // Filter logs for specific project if (filter.projectId) { const { permission } = await permissionService.getProjectPermission( actor, @@ -34,6 +35,7 @@ export const auditLogServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs); } else { + // Organization-wide logs const { permission } = await permissionService.getOrgPermission( actor, actorId, @@ -44,13 +46,12 @@ export const auditLogServiceFactory = ({ /** * NOTE (dangtony98): Update this to organization-level audit log permission check once audit logs are moved - * to the organization level + * to the organization level ✅ */ - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs); } // If project ID is not provided, then we need to return all the audit logs for the organization itself. - const auditLogs = await auditLogDAL.find({ startDate: filter.startDate, endDate: filter.endDate, diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts index 64ca8ad41..075037574 100644 --- a/backend/src/ee/services/permission/org-permission.ts +++ b/backend/src/ee/services/permission/org-permission.ts @@ -25,7 +25,8 @@ export enum OrgPermissionSubjects { SecretScanning = "secret-scanning", Identity = "identity", Kms = "kms", - AdminConsole = "organization-admin-console" + AdminConsole = "organization-admin-console", + AuditLogs = "audit-logs" } export type OrgPermissionSet = @@ -43,6 +44,7 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Billing] | [OrgPermissionActions, OrgPermissionSubjects.Identity] | [OrgPermissionActions, OrgPermissionSubjects.Kms] + | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs] | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]; const buildAdminPermission = () => { @@ -111,6 +113,11 @@ const buildAdminPermission = () => { can(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms); can(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms); + can(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs); + can(OrgPermissionActions.Create, OrgPermissionSubjects.AuditLogs); + can(OrgPermissionActions.Edit, OrgPermissionSubjects.AuditLogs); + can(OrgPermissionActions.Delete, OrgPermissionSubjects.AuditLogs); + can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole); return rules; diff --git a/frontend/src/context/OrgPermissionContext/types.ts b/frontend/src/context/OrgPermissionContext/types.ts index 5b7ef0174..c950ec179 100644 --- a/frontend/src/context/OrgPermissionContext/types.ts +++ b/frontend/src/context/OrgPermissionContext/types.ts @@ -21,7 +21,8 @@ export enum OrgPermissionSubjects { SecretScanning = "secret-scanning", Identity = "identity", Kms = "kms", - AdminConsole = "organization-admin-console" + AdminConsole = "organization-admin-console", + AuditLogs = "audit-logs" } export enum OrgPermissionAdminConsoleAction { @@ -43,6 +44,7 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Billing] | [OrgPermissionActions, OrgPermissionSubjects.Identity] | [OrgPermissionActions, OrgPermissionSubjects.Kms] - | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]; + | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole] + | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs]; export type TOrgPermission = MongoAbility; diff --git a/frontend/src/views/Org/RolePage/components/OrgRoleModifySection.utils.ts b/frontend/src/views/Org/RolePage/components/OrgRoleModifySection.utils.ts index 13cf2316b..027ac1bfe 100644 --- a/frontend/src/views/Org/RolePage/components/OrgRoleModifySection.utils.ts +++ b/frontend/src/views/Org/RolePage/components/OrgRoleModifySection.utils.ts @@ -32,6 +32,8 @@ export const formSchema = z.object({ create: z.boolean().optional() }) .optional(), + + "audit-logs": generalPermissionSchema, member: generalPermissionSchema, groups: generalPermissionSchema, role: generalPermissionSchema, diff --git a/frontend/src/views/Org/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx b/frontend/src/views/Org/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx index f4b237cfe..54bb903c6 100644 --- a/frontend/src/views/Org/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx +++ b/frontend/src/views/Org/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx @@ -41,6 +41,10 @@ const SIMPLE_PERMISSION_OPTIONS = [ title: "Incident Contacts", formName: "incident-contact" }, + { + title: "Audit Logs", + formName: "audit-logs" + }, { title: "Organization Profile", formName: "settings"