feat: switched audit log stream from project level to org level

This commit is contained in:
Akhil Mohan
2024-04-23 22:49:50 +05:30
parent fa18ca41ac
commit 68a1aa6f46
18 changed files with 92 additions and 147 deletions

View File

@@ -13,8 +13,8 @@ export async function up(knex: Knex): Promise<void> {
t.text("encryptedTokenTag");
t.string("encryptedTokenAlgorithm");
t.string("encryptedTokenKeyEncoding");
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("orgId").notNullable();
t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
t.timestamps(true, true, true);
});
}

View File

@@ -15,7 +15,7 @@ export const AuditLogStreamsSchema = z.object({
encryptedTokenTag: z.string().nullable().optional(),
encryptedTokenAlgorithm: z.string().nullable().optional(),
encryptedTokenKeyEncoding: z.string().nullable().optional(),
projectId: z.string(),
orgId: z.string().uuid(),
createdAt: z.date(),
updatedAt: z.date()
});

View File

@@ -21,7 +21,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
}
],
body: z.object({
projectSlug: z.string().min(1).describe(AUDIT_LOG_STREAMS.CREATE.projectSlug),
url: z.string().min(1).describe(AUDIT_LOG_STREAMS.CREATE.url),
token: z.string().optional().describe(AUDIT_LOG_STREAMS.CREATE.token)
}),
@@ -38,7 +37,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
actor: req.permission.type,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod,
projectSlug: req.body.projectSlug,
url: req.body.url,
token: req.body.token
});
@@ -174,9 +172,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
bearerAuth: []
}
],
querystring: z.object({
projectSlug: z.string().describe(AUDIT_LOG_STREAMS.LIST.projectSlug)
}),
response: {
200: z.object({
auditLogStreams: SanitizedAuditLogStreamSchema.array()
@@ -189,8 +184,7 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
actorId: req.permission.id,
actor: req.permission.type,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod,
projectSlug: req.query.projectSlug
actorAuthMethod: req.permission.authMethod
});
return { auditLogStreams };

View File

@@ -4,11 +4,10 @@ import { SecretKeyEncoding } from "@app/db/schemas";
import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
import { BadRequestError } from "@app/lib/errors";
import { validateLocalIps } from "@app/lib/validator";
import { TProjectDALFactory } from "@app/services/project/project-dal";
import { TLicenseServiceFactory } from "../license/license-service";
import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
import { TPermissionServiceFactory } from "../permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
import { TAuditLogStreamDALFactory } from "./audit-log-stream-dal";
import {
TCreateAuditLogStreamDTO,
@@ -20,8 +19,7 @@ import {
type TAuditLogStreamServiceFactoryDep = {
auditLogStreamDAL: TAuditLogStreamDALFactory;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
};
@@ -30,40 +28,29 @@ export type TAuditLogStreamServiceFactory = ReturnType<typeof auditLogStreamServ
export const auditLogStreamServiceFactory = ({
auditLogStreamDAL,
permissionService,
projectDAL,
licenseService
}: TAuditLogStreamServiceFactoryDep) => {
const create = async ({
projectSlug,
url,
actor,
token,
actorId,
actorOrgId,
actorAuthMethod
}: TCreateAuditLogStreamDTO) => {
const create = async ({ url, actor, token, actorId, actorOrgId, actorAuthMethod }: TCreateAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const plan = await licenseService.getPlan(actorOrgId);
if (!plan.auditLogStreams)
throw new BadRequestError({
message: "Failed to create audit log streams due to plan restriction. Upgrade plan to create group."
});
const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
if (!project) throw new BadRequestError({ message: "Project not found" });
const projectId = project.id;
const { permission } = await permissionService.getProjectPermission(
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
projectId,
actorOrgId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
validateLocalIps(url);
const totalStreams = await auditLogStreamDAL.find({ projectId });
const totalStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
if (totalStreams.length >= plan.auditLogStreamLimit) {
throw new BadRequestError({
message:
@@ -72,7 +59,7 @@ export const auditLogStreamServiceFactory = ({
}
const encryptedToken = token ? infisicalSymmetricEncypt(token) : undefined;
const logStream = await auditLogStreamDAL.create({
projectId,
orgId: actorOrgId,
url,
...(encryptedToken
? {
@@ -96,6 +83,8 @@ export const auditLogStreamServiceFactory = ({
actorOrgId,
actorAuthMethod
}: TUpdateAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const plan = await licenseService.getPlan(actorOrgId);
if (!plan.auditLogStreams)
throw new BadRequestError({
@@ -105,20 +94,13 @@ export const auditLogStreamServiceFactory = ({
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
if (url) validateLocalIps(url);
const encryptedToken = token ? infisicalSymmetricEncypt(token) : undefined;
const updatedLogStream = await auditLogStreamDAL.updateById(id, {
projectId,
url,
...(encryptedToken
? {
@@ -134,18 +116,14 @@ export const auditLogStreamServiceFactory = ({
};
const deleteById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TDeleteAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Settings);
const deletedLogStream = await auditLogStreamDAL.deleteById(id);
return deletedLogStream;
@@ -155,15 +133,10 @@ export const auditLogStreamServiceFactory = ({
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
const token =
logStream?.encryptedTokenCiphertext && logStream?.encryptedTokenIV && logStream?.encryptedTokenTag
? infisicalSymmetricDecrypt({
@@ -177,21 +150,17 @@ export const auditLogStreamServiceFactory = ({
return { ...logStream, token };
};
const list = async ({ projectSlug, actor, actorId, actorOrgId, actorAuthMethod }: TListAuditLogStreamDTO) => {
const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
if (!project) throw new BadRequestError({ message: "Project not found" });
const projectId = project.id;
const { permission } = await permissionService.getProjectPermission(
const list = async ({ actor, actorId, actorOrgId, actorAuthMethod }: TListAuditLogStreamDTO) => {
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
projectId,
actorOrgId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
const logStreams = await auditLogStreamDAL.find({ projectId });
const logStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
return logStreams;
};

View File

@@ -1,25 +1,22 @@
import { TProjectPermission } from "@app/lib/types";
import { TOrgPermission } from "@app/lib/types";
export type TCreateAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
projectSlug: string;
export type TCreateAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
url: string;
token?: string;
};
export type TUpdateAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TUpdateAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
url?: string;
token?: string;
};
export type TDeleteAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TDeleteAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
};
export type TListAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
projectSlug: string;
};
export type TListAuditLogStreamDTO = Omit<TOrgPermission, "orgId">;
export type TGetDetailsAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TGetDetailsAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
};

View File

@@ -71,7 +71,7 @@ export const auditLogQueueServiceFactory = ({
userAgentType
});
const logStreams = projectId ? await auditLogStreamDAL.find({ projectId }) : [];
const logStreams = orgId ? await auditLogStreamDAL.find({ orgId }) : [];
await Promise.allSettled(
logStreams.map(
async ({ url, encryptedTokenTag, encryptedTokenIV, encryptedTokenKeyEncoding, encryptedTokenCiphertext }) => {

View File

@@ -617,7 +617,6 @@ export const INTEGRATION = {
export const AUDIT_LOG_STREAMS = {
CREATE: {
projectSlug: "The slug of the project to create audit log stream.",
url: "The socket URL to push logs to.",
token: "Authentication token for the external provider used for identification."
},
@@ -629,9 +628,6 @@ export const AUDIT_LOG_STREAMS = {
DELETE: {
id: "The ID of the audit log stream to delete."
},
LIST: {
projectSlug: "The slug of the project to list audit log streams."
},
GET_BY_ID: {
id: "The ID of the audit log stream to get details."
}

View File

@@ -17,7 +17,7 @@ export type TOrgPermission = {
actorId: string;
orgId: string;
actorAuthMethod: ActorAuthMethod;
actorOrgId: string | undefined;
actorOrgId: string;
};
export type TProjectPermission = {

View File

@@ -251,7 +251,6 @@ export const registerRoutes = async (
});
const auditLogService = auditLogServiceFactory({ auditLogDAL, permissionService, auditLogQueue });
const auditLogStreamService = auditLogStreamServiceFactory({
projectDAL,
licenseService,
permissionService,
auditLogStreamDAL

View File

@@ -21,8 +21,8 @@ export const useCreateAuditLogStream = () => {
);
return data;
},
onSuccess: (_, { projectSlug }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(projectSlug));
onSuccess: (_, { orgId }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(orgId));
}
});
};
@@ -38,8 +38,8 @@ export const useUpdateAuditLogStream = () => {
);
return data;
},
onSuccess: (_, { projectSlug }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(projectSlug));
onSuccess: (_, { orgId }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(orgId));
}
});
};
@@ -54,8 +54,8 @@ export const useDeleteAuditLogStream = () => {
);
return data;
},
onSuccess: (_, { projectSlug }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(projectSlug));
onSuccess: (_, { orgId }) => {
queryClient.invalidateQueries(auditLogStreamKeys.list(orgId));
}
});
};

View File

@@ -5,28 +5,23 @@ import { apiRequest } from "@app/config/request";
import { TAuditLogStream } from "./types";
export const auditLogStreamKeys = {
list: (projectSlug: string) => ["audit-log-stream", { projectSlug }],
list: (orgId: string) => ["audit-log-stream", { orgId }],
getById: (id: string) => ["audit-log-stream-details", { id }]
};
const fetchAuditLogStreams = async (projectSlug: string) => {
const fetchAuditLogStreams = async () => {
const { data } = await apiRequest.get<{ auditLogStreams: TAuditLogStream[] }>(
"/api/v1/audit-log-streams",
{
params: {
projectSlug
}
}
"/api/v1/audit-log-streams"
);
return data.auditLogStreams;
};
export const useGetAuditLogStreams = (projectSlug: string) =>
export const useGetAuditLogStreams = (orgId: string) =>
useQuery({
queryKey: auditLogStreamKeys.list(projectSlug),
queryFn: () => fetchAuditLogStreams(projectSlug),
enabled: Boolean(projectSlug)
queryKey: auditLogStreamKeys.list(orgId),
queryFn: () => fetchAuditLogStreams(),
enabled: Boolean(orgId)
});
const fetchAuditLogStreamDetails = async (id: string) => {

View File

@@ -5,19 +5,19 @@ export type TAuditLogStream = {
};
export type TCreateAuditLogStreamDTO = {
projectSlug: string;
url: string;
token?: string;
orgId: string;
};
export type TUpdateAuditLogStreamDTO = {
id: string;
projectSlug: string;
url?: string;
token?: string;
orgId: string;
};
export type TDeleteAuditLogStreamDTO = {
id: string;
projectSlug: string;
orgId: string;
};

View File

@@ -3,7 +3,7 @@ import { z } from "zod";
import { createNotification } from "@app/components/notifications";
import { Button, FormControl, Input, Spinner } from "@app/components/v2";
import { useWorkspace } from "@app/context";
import { useOrganization } from "@app/context";
import {
useCreateAuditLogStream,
useGetAuditLogStreamDetails,
@@ -23,8 +23,8 @@ type TForm = z.infer<typeof formSchema>;
export const AuditLogStreamForm = ({ id = "", onClose }: Props) => {
const isEdit = Boolean(id);
const { currentWorkspace } = useWorkspace();
const projectSlug = currentWorkspace?.slug || "";
const { currentOrg } = useOrganization();
const orgId = currentOrg?.id || "";
const auditLogStream = useGetAuditLogStreamDetails(id);
const createAuditLogStream = useCreateAuditLogStream();
@@ -43,7 +43,7 @@ export const AuditLogStreamForm = ({ id = "", onClose }: Props) => {
try {
await updateAuditLogStream.mutateAsync({
id,
projectSlug,
orgId,
token,
url
});
@@ -69,7 +69,7 @@ export const AuditLogStreamForm = ({ id = "", onClose }: Props) => {
}
try {
await createAuditLogStream.mutateAsync({
projectSlug,
orgId,
token,
url
});

View File

@@ -2,7 +2,7 @@ import { faPlug, faPlus } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import { OrgPermissionCan } from "@app/components/permissions";
import {
Button,
DeleteActionModal,
@@ -19,21 +19,21 @@ import {
UpgradePlanModal
} from "@app/components/v2";
import {
ProjectPermissionActions,
ProjectPermissionSub,
useSubscription,
useWorkspace
OrgPermissionActions,
OrgPermissionSubjects,
useOrganization,
useSubscription
} from "@app/context";
import { withProjectPermission } from "@app/hoc";
import { withPermission } from "@app/hoc";
import { usePopUp } from "@app/hooks";
import { useDeleteAuditLogStream, useGetAuditLogStreams } from "@app/hooks/api";
import { AuditLogStreamForm } from "./AuditLogStreamForm";
export const AuditLogStreamsTab = withProjectPermission(
export const AuditLogStreamsTab = withPermission(
() => {
const { currentWorkspace } = useWorkspace();
const projectSlug = currentWorkspace?.slug || "";
const { currentOrg } = useOrganization();
const orgId = currentOrg?.id || "";
const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
"auditLogStreamForm",
"deleteAuditLogStream",
@@ -42,7 +42,7 @@ export const AuditLogStreamsTab = withProjectPermission(
const { subscription } = useSubscription();
const { data: auditLogStreams, isLoading: isAuditLogStreamsLoading } =
useGetAuditLogStreams(projectSlug);
useGetAuditLogStreams(orgId);
// mutation
const { mutateAsync: deleteAuditLogStream } = useDeleteAuditLogStream();
@@ -52,7 +52,7 @@ export const AuditLogStreamsTab = withProjectPermission(
const auditLogStreamId = popUp?.deleteAuditLogStream?.data as string;
await deleteAuditLogStream({
id: auditLogStreamId,
projectSlug
orgId
});
handlePopUpClose("deleteAuditLogStream");
createNotification({
@@ -72,10 +72,7 @@ export const AuditLogStreamsTab = withProjectPermission(
<div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
<div className="flex justify-between">
<p className="text-xl font-semibold text-mineshaft-100">Audit Log Streams</p>
<ProjectPermissionCan
I={ProjectPermissionActions.Create}
a={ProjectPermissionSub.Settings}
>
<OrgPermissionCan I={OrgPermissionActions.Create} a={OrgPermissionSubjects.Settings}>
{(isAllowed) => (
<Button
onClick={() => {
@@ -91,7 +88,7 @@ export const AuditLogStreamsTab = withProjectPermission(
Create
</Button>
)}
</ProjectPermissionCan>
</OrgPermissionCan>
</div>
<p className="mb-8 text-gray-400">
Manage audit log streams to send audit log to any logging providers with syslog support.
@@ -124,9 +121,9 @@ export const AuditLogStreamsTab = withProjectPermission(
</Td>
<Td>
<div className="flex items-center justify-end space-x-2">
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.Settings}
<OrgPermissionCan
I={OrgPermissionActions.Edit}
a={OrgPermissionSubjects.Settings}
>
{(isAllowed) => (
<Button
@@ -138,10 +135,10 @@ export const AuditLogStreamsTab = withProjectPermission(
Edit
</Button>
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.Settings}
</OrgPermissionCan>
<OrgPermissionCan
I={OrgPermissionActions.Delete}
a={OrgPermissionSubjects.Settings}
>
{(isAllowed) => (
<Button
@@ -155,7 +152,7 @@ export const AuditLogStreamsTab = withProjectPermission(
Delete
</Button>
)}
</ProjectPermissionCan>
</OrgPermissionCan>
</div>
</Td>
</Tr>
@@ -196,5 +193,5 @@ export const AuditLogStreamsTab = withProjectPermission(
</div>
);
},
{ action: ProjectPermissionActions.Read, subject: ProjectPermissionSub.Settings }
{ action: OrgPermissionActions.Read, subject: OrgPermissionSubjects.Settings }
);

View File

@@ -1,12 +1,14 @@
import { Fragment } from "react";
import { Tab } from "@headlessui/react";
import { AuditLogStreamsTab } from "../AuditLogStreamTab";
import { OrgAuthTab } from "../OrgAuthTab";
import { OrgGeneralTab } from "../OrgGeneralTab";
const tabs = [
{ name: "General", key: "tab-org-general" },
{ name: "Security", key: "tab-org-security" }
{ name: "Security", key: "tab-org-security" },
{ name: "Audit Log Streams", key: "tag-audit-log-streams" }
];
export const OrgTabGroup = () => {
return (
@@ -17,9 +19,8 @@ export const OrgTabGroup = () => {
{({ selected }) => (
<button
type="button"
className={`w-30 mx-2 mr-4 py-2 text-sm font-medium outline-none ${
selected ? "border-b border-white text-white" : "text-mineshaft-400"
}`}
className={`w-30 mx-2 mr-4 py-2 text-sm font-medium outline-none ${selected ? "border-b border-white text-white" : "text-mineshaft-400"
}`}
>
{tab.name}
</button>
@@ -34,6 +35,9 @@ export const OrgTabGroup = () => {
<Tab.Panel>
<OrgAuthTab />
</Tab.Panel>
<Tab.Panel>
<AuditLogStreamsTab />
</Tab.Panel>
</Tab.Panels>
</Tab.Group>
);

View File

@@ -4,12 +4,10 @@ import { Tab } from "@headlessui/react";
import { ProjectGeneralTab } from "./components/ProjectGeneralTab";
import { WebhooksTab } from "./components/WebhooksTab";
import { AuditLogStreamsTab } from "./components";
const tabs = [
{ name: "General", key: "tab-project-general" },
{ name: "Webhooks", key: "tab-project-webhooks" },
{ name: "Audit Log Streams", key: "tab-project-audit-log-stream" }
];
export const ProjectSettingsPage = () => {
@@ -43,9 +41,6 @@ export const ProjectSettingsPage = () => {
<Tab.Panel>
<WebhooksTab />
</Tab.Panel>
<Tab.Panel>
<AuditLogStreamsTab />
</Tab.Panel>
</Tab.Panels>
</Tab.Group>
</div>

View File

@@ -1,4 +1,3 @@
export { AuditLogStreamsTab } from "./AuditLogStreamTab";
export { AutoCapitalizationSection } from "./AutoCapitalizationSection";
export { DeleteProjectSection } from "./DeleteProjectSection";
export { E2EESection } from "./E2EESection";