awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added audit log for assume

Browse Source
This commit is contained in:
=
2025-04-18 18:24:43 +05:30
parent 7219ba3b46
commit 649f7b560f
2 changed files with 56 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
backend/src/ee/routes/v1/assume-privilege-router.ts
View File

@@ -1,5 +1,6 @@
import { z } from "zod";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError } from "@app/lib/errors";
import { writeLimit } from "@app/server/config/rateLimiter";
@@ -37,6 +38,7 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
projectPermission: req.permission,
tokenVersionId: req.auth.tokenVersionId
});
const appCfg = getConfig();
void res.setCookie("infisical-project-assume-privileges", payload.assumePrivilegesToken, {
httpOnly: true,
@@ -44,6 +46,22 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
sameSite: "strict",
secure: appCfg.HTTPS_ENABLED
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.PROJECT_ASSUME_PRIVILEGE,
metadata: {
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id,
targetActorType: req.body.actorType,
targetActorId: req.body.actorId
}
}
});
return { message: "Successfully assumed role" };
}
@@ -77,6 +95,19 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
sameSite: "strict",
secure: appCfg.HTTPS_ENABLED
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.PROJECT_ASSUME_PRIVILEGE_EXIT,
metadata: {
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id
}
}
});
return { message: "Successfully exited assumed role" };
}

26
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -317,7 +317,9 @@ export enum EventType {
DELETE_SECRET_ROTATION = "delete-secret-rotation",
SECRET_ROTATION_ROTATE_SECRETS = "secret-rotation-rotate-secrets",
PROJECT_ACCESS_REQUEST = "project-access-request"
PROJECT_ACCESS_REQUEST = "project-access-request",
PROJECT_ASSUME_PRIVILEGE = "project-assume-privileges",
PROJECT_ASSUME_PRIVILEGE_EXIT = "project-assume-privileges-exit"
}
export const filterableSecretEvents: EventType[] = [
@@ -2425,6 +2427,26 @@ interface ProjectAccessRequestEvent {
};
}
interface ProjectAssumePrivilegesEvent {
type: EventType.PROJECT_ASSUME_PRIVILEGE;
metadata: {
projectId: string;
requesterId: string;
requesterEmail: string;
targetActorType: ActorType;
targetActorId: string;
};
}
interface ProjectAssumePrivilegesExitEvent {
type: EventType.PROJECT_ASSUME_PRIVILEGE_EXIT;
metadata: {
projectId: string;
requesterId: string;
requesterEmail: string;
};
}
interface SetupKmipEvent {
type: EventType.SETUP_KMIP;
metadata: {
@@ -2727,6 +2749,8 @@ export type Event =
| KmipOperationLocateEvent
| KmipOperationRegisterEvent
| ProjectAccessRequestEvent
| ProjectAssumePrivilegesEvent
| ProjectAssumePrivilegesExitEvent
| CreateSecretRequestEvent
| SecretApprovalRequestReview
| GetSecretRotationsEvent