feat: changed backend-pg to backend

backend/src/ee/services/audit-log/audit-log-dal.ts

@@ -0,0 +1,61 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify, stripUndefinedInWhere } from "@app/lib/knex";
+
+export type TAuditLogDALFactory = ReturnType<typeof auditLogDALFactory>;
+
+type TFindQuery = {
+  actor?: string;
+  projectId?: string;
+  orgId?: string;
+  eventType?: string;
+  startDate?: string;
+  endDate?: string;
+  userAgentType?: string;
+  limit?: number;
+  offset?: number;
+};
+
+export const auditLogDALFactory = (db: TDbClient) => {
+  const auditLogOrm = ormify(db, TableName.AuditLog);
+
+  const find = async (
+    {
+      orgId,
+      projectId,
+      userAgentType,
+      startDate,
+      endDate,
+      limit = 20,
+      offset = 0,
+      actor,
+      eventType
+    }: TFindQuery,
+    tx?: Knex
+  ) => {
+    const sqlQuery = (tx || db)(TableName.AuditLog)
+      .where(
+        stripUndefinedInWhere({
+          projectId,
+          orgId,
+          eventType,
+          actor,
+          userAgentType
+        })
+      )
+      .limit(limit)
+      .offset(offset);
+    if (startDate) {
+      sqlQuery.where("createdAt", ">=", startDate);
+    }
+    if (endDate) {
+      sqlQuery.where("createdAt", "<=", endDate);
+    }
+    const docs = await sqlQuery;
+    return docs;
+  };
+
+  return { ...auditLogOrm, find };
+};

backend/src/ee/services/audit-log/audit-log-queue.ts

@@ -0,0 +1,63 @@
+import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+
+import { TLicenseServiceFactory } from "../license/license-service";
+import { TAuditLogDALFactory } from "./audit-log-dal";
+import { TCreateAuditLogDTO } from "./audit-log-types";
+
+type TAuditLogQueueServiceFactoryDep = {
+  auditLogDAL: TAuditLogDALFactory;
+  queueService: TQueueServiceFactory;
+  projectDAL: Pick<TProjectDALFactory, "findById">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+};
+
+export type TAuditLogQueueServiceFactory = ReturnType<typeof auditLogQueueServiceFactory>;
+
+export const auditLogQueueServiceFactory = ({
+  auditLogDAL,
+  queueService,
+  projectDAL,
+  licenseService
+}: TAuditLogQueueServiceFactoryDep) => {
+  const pushToLog = async (data: TCreateAuditLogDTO) => {
+    await queueService.queue(QueueName.AuditLog, QueueJobs.AuditLog, data, {
+      removeOnFail: {
+        count: 5
+      },
+      removeOnComplete: true
+    });
+  };
+
+  queueService.start(QueueName.AuditLog, async (job) => {
+    const { actor, event, ipAddress, projectId, userAgent, userAgentType } = job.data;
+    let { orgId } = job.data;
+    const MS_IN_DAY = 24 * 60 * 60 * 1000;
+
+    if (!orgId) {
+      // it will never be undefined for both org and project id
+      // TODO(akhilmhdh): use caching here in dal to avoid db calls
+      const project = await projectDAL.findById(projectId as string);
+      orgId = project.orgId;
+    }
+
+    const plan = await licenseService.getPlan(orgId);
+    const ttl = plan.auditLogsRetentionDays * MS_IN_DAY;
+    await auditLogDAL.create({
+      actor: actor.type,
+      actorMetadata: actor.metadata,
+      userAgent,
+      projectId,
+      ipAddress,
+      orgId,
+      eventType: event.type,
+      expiresAt: new Date(Date.now() + ttl),
+      eventMetadata: event.metadata,
+      userAgentType
+    });
+  });
+
+  return {
+    pushToLog
+  };
+};

backend/src/ee/services/audit-log/audit-log-service.ts

@@ -0,0 +1,73 @@
+import { ForbiddenError } from "@casl/ability";
+
+import { BadRequestError } from "@app/lib/errors";
+
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { TAuditLogDALFactory } from "./audit-log-dal";
+import { TAuditLogQueueServiceFactory } from "./audit-log-queue";
+import { EventType, TCreateAuditLogDTO, TListProjectAuditLogDTO } from "./audit-log-types";
+
+type TAuditLogServiceFactoryDep = {
+  auditLogDAL: TAuditLogDALFactory;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  auditLogQueue: TAuditLogQueueServiceFactory;
+};
+
+export type TAuditLogServiceFactory = ReturnType<typeof auditLogServiceFactory>;
+
+export const auditLogServiceFactory = ({
+  auditLogDAL,
+  auditLogQueue,
+  permissionService
+}: TAuditLogServiceFactoryDep) => {
+  const listProjectAuditLogs = async ({
+    userAgentType,
+    eventType,
+    offset,
+    limit,
+    endDate,
+    startDate,
+    actor,
+    actorId,
+    projectId,
+    auditLogActor
+  }: TListProjectAuditLogDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.AuditLogs
+    );
+    const auditLogs = await auditLogDAL.find({
+      startDate,
+      endDate,
+      limit,
+      offset,
+      eventType,
+      userAgentType,
+      actor: auditLogActor,
+      projectId
+    });
+    return auditLogs.map(
+      ({ eventType: logEventType, actor: eActor, actorMetadata, eventMetadata, ...el }) => ({
+        ...el,
+        event: { type: logEventType, metadata: eventMetadata },
+        actor: { type: eActor, metadata: actorMetadata }
+      })
+    );
+  };
+
+  const createAuditLog = async (data: TCreateAuditLogDTO) => {
+    // add all cases in which project id or org id cannot be added
+    if (data.event.type !== EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH) {
+      if (!data.projectId && !data.orgId)
+        throw new BadRequestError({ message: "Must either project id or org id" });
+    }
+    return auditLogQueue.pushToLog(data);
+  };
+
+  return {
+    createAuditLog,
+    listProjectAuditLogs
+  };
+};

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -0,0 +1,676 @@
+import { TProjectPermission } from "@app/lib/types";
+import { ActorType } from "@app/services/auth/auth-type";
+import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
+
+export type TListProjectAuditLogDTO = {
+  auditLogActor?: string;
+  projectId: string;
+  eventType?: string;
+  startDate?: string;
+  endDate?: string;
+  userAgentType?: string;
+  limit?: number;
+  offset?: number;
+} & TProjectPermission;
+
+export type TCreateAuditLogDTO = {
+  event: Event;
+  actor: UserActor | IdentityActor | ServiceActor;
+  orgId?: string;
+  projectId?: string;
+} & BaseAuthData;
+
+interface BaseAuthData {
+  ipAddress?: string;
+  userAgent?: string;
+  userAgentType?: UserAgentType;
+}
+
+export enum UserAgentType {
+  WEB = "web",
+  CLI = "cli",
+  K8_OPERATOR = "k8-operator",
+  TERRAFORM = "terraform",
+  OTHER = "other",
+  PYTHON_SDK = "InfisicalPythonSDK",
+  NODE_SDK = "InfisicalNodeSDK"
+}
+
+export enum EventType {
+  GET_SECRETS = "get-secrets",
+  GET_SECRET = "get-secret",
+  REVEAL_SECRET = "reveal-secret",
+  CREATE_SECRET = "create-secret",
+  CREATE_SECRETS = "create-secrets",
+  UPDATE_SECRET = "update-secret",
+  UPDATE_SECRETS = "update-secrets",
+  DELETE_SECRET = "delete-secret",
+  DELETE_SECRETS = "delete-secrets",
+  GET_WORKSPACE_KEY = "get-workspace-key",
+  AUTHORIZE_INTEGRATION = "authorize-integration",
+  UNAUTHORIZE_INTEGRATION = "unauthorize-integration",
+  CREATE_INTEGRATION = "create-integration",
+  DELETE_INTEGRATION = "delete-integration",
+  ADD_TRUSTED_IP = "add-trusted-ip",
+  UPDATE_TRUSTED_IP = "update-trusted-ip",
+  DELETE_TRUSTED_IP = "delete-trusted-ip",
+  CREATE_SERVICE_TOKEN = "create-service-token", // v2
+  DELETE_SERVICE_TOKEN = "delete-service-token", // v2
+  CREATE_IDENTITY = "create-identity",
+  UPDATE_IDENTITY = "update-identity",
+  DELETE_IDENTITY = "delete-identity",
+  LOGIN_IDENTITY_UNIVERSAL_AUTH = "login-identity-universal-auth",
+  ADD_IDENTITY_UNIVERSAL_AUTH = "add-identity-universal-auth",
+  UPDATE_IDENTITY_UNIVERSAL_AUTH = "update-identity-universal-auth",
+  GET_IDENTITY_UNIVERSAL_AUTH = "get-identity-universal-auth",
+  CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "create-identity-universal-auth-client-secret",
+  REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "revoke-identity-universal-auth-client-secret",
+  GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS = "get-identity-universal-auth-client-secret",
+  CREATE_ENVIRONMENT = "create-environment",
+  UPDATE_ENVIRONMENT = "update-environment",
+  DELETE_ENVIRONMENT = "delete-environment",
+  ADD_WORKSPACE_MEMBER = "add-workspace-member",
+  ADD_BATCH_WORKSPACE_MEMBER = "add-workspace-members",
+  REMOVE_WORKSPACE_MEMBER = "remove-workspace-member",
+  CREATE_FOLDER = "create-folder",
+  UPDATE_FOLDER = "update-folder",
+  DELETE_FOLDER = "delete-folder",
+  CREATE_WEBHOOK = "create-webhook",
+  UPDATE_WEBHOOK_STATUS = "update-webhook-status",
+  DELETE_WEBHOOK = "delete-webhook",
+  GET_SECRET_IMPORTS = "get-secret-imports",
+  CREATE_SECRET_IMPORT = "create-secret-import",
+  UPDATE_SECRET_IMPORT = "update-secret-import",
+  DELETE_SECRET_IMPORT = "delete-secret-import",
+  UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
+  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions",
+  SECRET_APPROVAL_MERGED = "secret-approval-merged",
+  SECRET_APPROVAL_REQUEST = "secret-approval-request",
+  SECRET_APPROVAL_CLOSED = "secret-approval-closed",
+  SECRET_APPROVAL_REOPENED = "secret-approval-reopened"
+}
+
+interface UserActorMetadata {
+  userId: string;
+  email: string;
+}
+
+interface ServiceActorMetadata {
+  serviceId: string;
+  name: string;
+}
+
+interface IdentityActorMetadata {
+  identityId: string;
+  name: string;
+}
+
+export interface UserActor {
+  type: ActorType.USER;
+  metadata: UserActorMetadata;
+}
+
+export interface ServiceActor {
+  type: ActorType.SERVICE;
+  metadata: ServiceActorMetadata;
+}
+
+export interface IdentityActor {
+  type: ActorType.IDENTITY;
+  metadata: IdentityActorMetadata;
+}
+
+export type Actor = UserActor | ServiceActor | IdentityActor;
+
+interface GetSecretsEvent {
+  type: EventType.GET_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    numberOfSecrets: number;
+  };
+}
+
+interface GetSecretEvent {
+  type: EventType.GET_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface CreateSecretEvent {
+  type: EventType.CREATE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface CreateSecretBatchEvent {
+  type: EventType.CREATE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface UpdateSecretEvent {
+  type: EventType.UPDATE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface UpdateSecretBatchEvent {
+  type: EventType.UPDATE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface DeleteSecretEvent {
+  type: EventType.DELETE_SECRET;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secretId: string;
+    secretKey: string;
+    secretVersion: number;
+  };
+}
+
+interface DeleteSecretBatchEvent {
+  type: EventType.DELETE_SECRETS;
+  metadata: {
+    environment: string;
+    secretPath: string;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
+  };
+}
+
+interface GetWorkspaceKeyEvent {
+  type: EventType.GET_WORKSPACE_KEY;
+  metadata: {
+    keyId: string;
+  };
+}
+
+interface AuthorizeIntegrationEvent {
+  type: EventType.AUTHORIZE_INTEGRATION;
+  metadata: {
+    integration: string;
+  };
+}
+
+interface UnauthorizeIntegrationEvent {
+  type: EventType.UNAUTHORIZE_INTEGRATION;
+  metadata: {
+    integration: string;
+  };
+}
+
+interface CreateIntegrationEvent {
+  type: EventType.CREATE_INTEGRATION;
+  metadata: {
+    integrationId: string;
+    integration: string; // TODO: fix type
+    environment: string;
+    secretPath: string;
+    url?: string;
+    app?: string;
+    appId?: string;
+    targetEnvironment?: string;
+    targetEnvironmentId?: string;
+    targetService?: string;
+    targetServiceId?: string;
+    path?: string;
+    region?: string;
+  };
+}
+
+interface DeleteIntegrationEvent {
+  type: EventType.DELETE_INTEGRATION;
+  metadata: {
+    integrationId: string;
+    integration: string; // TODO: fix type
+    environment: string;
+    secretPath: string;
+    url?: string;
+    app?: string;
+    appId?: string;
+    targetEnvironment?: string;
+    targetEnvironmentId?: string;
+    targetService?: string;
+    targetServiceId?: string;
+    path?: string;
+    region?: string;
+  };
+}
+
+interface AddTrustedIPEvent {
+  type: EventType.ADD_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface UpdateTrustedIPEvent {
+  type: EventType.UPDATE_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface DeleteTrustedIPEvent {
+  type: EventType.DELETE_TRUSTED_IP;
+  metadata: {
+    trustedIpId: string;
+    ipAddress: string;
+    prefix?: number;
+  };
+}
+
+interface CreateServiceTokenEvent {
+  type: EventType.CREATE_SERVICE_TOKEN;
+  metadata: {
+    name: string;
+    scopes: Array<{
+      environment: string;
+      secretPath: string;
+    }>;
+  };
+}
+
+interface DeleteServiceTokenEvent {
+  type: EventType.DELETE_SERVICE_TOKEN;
+  metadata: {
+    name: string;
+    scopes: Array<{
+      environment: string;
+      secretPath: string;
+    }>;
+  };
+}
+
+interface CreateIdentityEvent {
+  // note: currently not logging org-role
+  type: EventType.CREATE_IDENTITY;
+  metadata: {
+    identityId: string;
+    name: string;
+  };
+}
+
+interface UpdateIdentityEvent {
+  type: EventType.UPDATE_IDENTITY;
+  metadata: {
+    identityId: string;
+    name?: string;
+  };
+}
+
+interface DeleteIdentityEvent {
+  type: EventType.DELETE_IDENTITY;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface LoginIdentityUniversalAuthEvent {
+  type: EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    identityUniversalAuthId: string;
+    clientSecretId: string;
+    identityAccessTokenId: string;
+  };
+}
+
+interface AddIdentityUniversalAuthEvent {
+  type: EventType.ADD_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    clientSecretTrustedIps: Array<TIdentityTrustedIp>;
+    accessTokenTTL: number;
+    accessTokenMaxTTL: number;
+    accessTokenNumUsesLimit: number;
+    accessTokenTrustedIps: Array<TIdentityTrustedIp>;
+  };
+}
+
+interface UpdateIdentityUniversalAuthEvent {
+  type: EventType.UPDATE_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+    clientSecretTrustedIps?: Array<TIdentityTrustedIp>;
+    accessTokenTTL?: number;
+    accessTokenMaxTTL?: number;
+    accessTokenNumUsesLimit?: number;
+    accessTokenTrustedIps?: Array<TIdentityTrustedIp>;
+  };
+}
+
+interface GetIdentityUniversalAuthEvent {
+  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface CreateIdentityUniversalAuthClientSecretEvent {
+  type: EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET;
+  metadata: {
+    identityId: string;
+    clientSecretId: string;
+  };
+}
+
+interface GetIdentityUniversalAuthClientSecretsEvent {
+  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface RevokeIdentityUniversalAuthClientSecretEvent {
+  type: EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET;
+  metadata: {
+    identityId: string;
+    clientSecretId: string;
+  };
+}
+
+interface CreateEnvironmentEvent {
+  type: EventType.CREATE_ENVIRONMENT;
+  metadata: {
+    name: string;
+    slug: string;
+  };
+}
+
+interface UpdateEnvironmentEvent {
+  type: EventType.UPDATE_ENVIRONMENT;
+  metadata: {
+    oldName: string;
+    newName: string;
+    oldSlug: string;
+    newSlug: string;
+    oldPos: number;
+    newPos: number;
+  };
+}
+
+interface DeleteEnvironmentEvent {
+  type: EventType.DELETE_ENVIRONMENT;
+  metadata: {
+    name: string;
+    slug: string;
+  };
+}
+
+interface AddWorkspaceMemberEvent {
+  type: EventType.ADD_WORKSPACE_MEMBER;
+  metadata: {
+    userId: string;
+    email: string;
+  };
+}
+
+interface AddBatchWorkspaceMemberEvent {
+  type: EventType.ADD_BATCH_WORKSPACE_MEMBER;
+  metadata: Array<{
+    userId: string;
+    email: string;
+  }>;
+}
+
+interface RemoveWorkspaceMemberEvent {
+  type: EventType.REMOVE_WORKSPACE_MEMBER;
+  metadata: {
+    userId: string;
+    email: string;
+  };
+}
+
+interface CreateFolderEvent {
+  type: EventType.CREATE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    folderName: string;
+    folderPath: string;
+  };
+}
+
+interface UpdateFolderEvent {
+  type: EventType.UPDATE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    oldFolderName: string;
+    newFolderName: string;
+    folderPath: string;
+  };
+}
+
+interface DeleteFolderEvent {
+  type: EventType.DELETE_FOLDER;
+  metadata: {
+    environment: string;
+    folderId: string;
+    folderName: string;
+    folderPath: string;
+  };
+}
+
+interface CreateWebhookEvent {
+  type: EventType.CREATE_WEBHOOK;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface UpdateWebhookStatusEvent {
+  type: EventType.UPDATE_WEBHOOK_STATUS;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface DeleteWebhookEvent {
+  type: EventType.DELETE_WEBHOOK;
+  metadata: {
+    webhookId: string;
+    environment: string;
+    secretPath: string;
+    webhookUrl: string;
+    isDisabled: boolean;
+  };
+}
+
+interface GetSecretImportsEvent {
+  type: EventType.GET_SECRET_IMPORTS;
+  metadata: {
+    environment: string;
+    folderId: string;
+    numberOfImports: number;
+  };
+}
+
+interface CreateSecretImportEvent {
+  type: EventType.CREATE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importFromEnvironment: string;
+    importFromSecretPath: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+  };
+}
+
+interface UpdateSecretImportEvent {
+  type: EventType.UPDATE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+    position: number;
+    orderBefore?: {
+      environment: string;
+      secretPath: string;
+    }[];
+    orderAfter?: {
+      environment: string;
+      secretPath: string;
+    }[];
+  };
+}
+
+interface DeleteSecretImportEvent {
+  type: EventType.DELETE_SECRET_IMPORT;
+  metadata: {
+    secretImportId: string;
+    folderId: string;
+    importFromEnvironment: string;
+    importFromSecretPath: string;
+    importToEnvironment: string;
+    importToSecretPath: string;
+  };
+}
+
+interface UpdateUserRole {
+  type: EventType.UPDATE_USER_WORKSPACE_ROLE;
+  metadata: {
+    userId: string;
+    email: string;
+    oldRole: string;
+    newRole: string;
+  };
+}
+
+interface UpdateUserDeniedPermissions {
+  type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS;
+  metadata: {
+    userId: string;
+    email: string;
+    deniedPermissions: {
+      environmentSlug: string;
+      ability: string;
+    }[];
+  };
+}
+interface SecretApprovalMerge {
+  type: EventType.SECRET_APPROVAL_MERGED;
+  metadata: {
+    mergedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalClosed {
+  type: EventType.SECRET_APPROVAL_CLOSED;
+  metadata: {
+    closedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalReopened {
+  type: EventType.SECRET_APPROVAL_REOPENED;
+  metadata: {
+    reopenedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalRequest {
+  type: EventType.SECRET_APPROVAL_REQUEST;
+  metadata: {
+    committedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+export type Event =
+  | GetSecretsEvent
+  | GetSecretEvent
+  | CreateSecretEvent
+  | CreateSecretBatchEvent
+  | UpdateSecretEvent
+  | UpdateSecretBatchEvent
+  | DeleteSecretEvent
+  | DeleteSecretBatchEvent
+  | GetWorkspaceKeyEvent
+  | AuthorizeIntegrationEvent
+  | UnauthorizeIntegrationEvent
+  | CreateIntegrationEvent
+  | DeleteIntegrationEvent
+  | AddTrustedIPEvent
+  | UpdateTrustedIPEvent
+  | DeleteTrustedIPEvent
+  | CreateServiceTokenEvent
+  | DeleteServiceTokenEvent
+  | CreateIdentityEvent
+  | UpdateIdentityEvent
+  | DeleteIdentityEvent
+  | LoginIdentityUniversalAuthEvent
+  | AddIdentityUniversalAuthEvent
+  | UpdateIdentityUniversalAuthEvent
+  | GetIdentityUniversalAuthEvent
+  | CreateIdentityUniversalAuthClientSecretEvent
+  | GetIdentityUniversalAuthClientSecretsEvent
+  | RevokeIdentityUniversalAuthClientSecretEvent
+  | CreateEnvironmentEvent
+  | UpdateEnvironmentEvent
+  | DeleteEnvironmentEvent
+  | AddWorkspaceMemberEvent
+  | AddBatchWorkspaceMemberEvent
+  | RemoveWorkspaceMemberEvent
+  | CreateFolderEvent
+  | UpdateFolderEvent
+  | DeleteFolderEvent
+  | CreateWebhookEvent
+  | UpdateWebhookStatusEvent
+  | DeleteWebhookEvent
+  | GetSecretImportsEvent
+  | CreateSecretImportEvent
+  | UpdateSecretImportEvent
+  | DeleteSecretImportEvent
+  | UpdateUserRole
+  | UpdateUserDeniedPermissions
+  | SecretApprovalMerge
+  | SecretApprovalClosed
+  | SecretApprovalRequest
+  | SecretApprovalReopened;