From 649f7b560f7e9dc37633967dd17a1b682f4cd906 Mon Sep 17 00:00:00 2001
From: = <akhilmhdh@gmail.com>
Date: Fri, 18 Apr 2025 18:24:43 +0530
Subject: [PATCH] feat: added audit log for assume

---
 .../ee/routes/v1/assume-privilege-router.ts   | 31 +++++++++++++++++++
 .../ee/services/audit-log/audit-log-types.ts  | 26 +++++++++++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/backend/src/ee/routes/v1/assume-privilege-router.ts b/backend/src/ee/routes/v1/assume-privilege-router.ts
index 3ad8eeac0..31ca3c542 100644
--- a/backend/src/ee/routes/v1/assume-privilege-router.ts
+++ b/backend/src/ee/routes/v1/assume-privilege-router.ts
@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { writeLimit } from "@app/server/config/rateLimiter";
@@ -37,6 +38,7 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
           projectPermission: req.permission,
           tokenVersionId: req.auth.tokenVersionId
         });
+
         const appCfg = getConfig();
         void res.setCookie("infisical-project-assume-privileges", payload.assumePrivilegesToken, {
           httpOnly: true,
@@ -44,6 +46,22 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
           sameSite: "strict",
           secure: appCfg.HTTPS_ENABLED
         });
+
+        await server.services.auditLog.createAuditLog({
+          ...req.auditLogInfo,
+          orgId: req.permission.orgId,
+          event: {
+            type: EventType.PROJECT_ASSUME_PRIVILEGE,
+            metadata: {
+              projectId: req.params.projectId,
+              requesterEmail: req.auth.user.username,
+              requesterId: req.auth.user.id,
+              targetActorType: req.body.actorType,
+              targetActorId: req.body.actorId
+            }
+          }
+        });
+
         return { message: "Successfully assumed role" };
       }
 
@@ -77,6 +95,19 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
           sameSite: "strict",
           secure: appCfg.HTTPS_ENABLED
         });
+
+        await server.services.auditLog.createAuditLog({
+          ...req.auditLogInfo,
+          orgId: req.permission.orgId,
+          event: {
+            type: EventType.PROJECT_ASSUME_PRIVILEGE_EXIT,
+            metadata: {
+              projectId: req.params.projectId,
+              requesterEmail: req.auth.user.username,
+              requesterId: req.auth.user.id
+            }
+          }
+        });
         return { message: "Successfully exited assumed role" };
       }
 
diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts
index 91464bc0b..e36061e24 100644
--- a/backend/src/ee/services/audit-log/audit-log-types.ts
+++ b/backend/src/ee/services/audit-log/audit-log-types.ts
@@ -317,7 +317,9 @@ export enum EventType {
   DELETE_SECRET_ROTATION = "delete-secret-rotation",
   SECRET_ROTATION_ROTATE_SECRETS = "secret-rotation-rotate-secrets",
 
-  PROJECT_ACCESS_REQUEST = "project-access-request"
+  PROJECT_ACCESS_REQUEST = "project-access-request",
+  PROJECT_ASSUME_PRIVILEGE = "project-assume-privileges",
+  PROJECT_ASSUME_PRIVILEGE_EXIT = "project-assume-privileges-exit"
 }
 
 export const filterableSecretEvents: EventType[] = [
@@ -2425,6 +2427,26 @@ interface ProjectAccessRequestEvent {
   };
 }
 
+interface ProjectAssumePrivilegesEvent {
+  type: EventType.PROJECT_ASSUME_PRIVILEGE;
+  metadata: {
+    projectId: string;
+    requesterId: string;
+    requesterEmail: string;
+    targetActorType: ActorType;
+    targetActorId: string;
+  };
+}
+
+interface ProjectAssumePrivilegesExitEvent {
+  type: EventType.PROJECT_ASSUME_PRIVILEGE_EXIT;
+  metadata: {
+    projectId: string;
+    requesterId: string;
+    requesterEmail: string;
+  };
+}
+
 interface SetupKmipEvent {
   type: EventType.SETUP_KMIP;
   metadata: {
@@ -2727,6 +2749,8 @@ export type Event =
   | KmipOperationLocateEvent
   | KmipOperationRegisterEvent
   | ProjectAccessRequestEvent
+  | ProjectAssumePrivilegesEvent
+  | ProjectAssumePrivilegesExitEvent
   | CreateSecretRequestEvent
   | SecretApprovalRequestReview
   | GetSecretRotationsEvent