awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 10:29:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: switched audit log stream from project level to org level

Browse Source
This commit is contained in:
Akhil Mohan
2024-05-03 00:23:59 +05:30
parent fa18ca41ac
commit 68a1aa6f46
18 changed files with 92 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/20240423070528_audit-log-stream.ts
+2 -2
View File
@@ -13,8 +13,8 @@ export async function up(knex: Knex): Promise<void> {
t.text("encryptedTokenTag");
t.string("encryptedTokenAlgorithm");
t.string("encryptedTokenKeyEncoding");
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("orgId").notNullable();
t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
t.timestamps(true, true, true);
});
}
backend/src/db/schemas/audit-log-streams.ts
+1 -1
View File
@@ -15,7 +15,7 @@ export const AuditLogStreamsSchema = z.object({
encryptedTokenTag: z.string().nullable().optional(),
encryptedTokenAlgorithm: z.string().nullable().optional(),
encryptedTokenKeyEncoding: z.string().nullable().optional(),
projectId: z.string(),
orgId: z.string().uuid(),
createdAt: z.date(),
updatedAt: z.date()
});
backend/src/ee/routes/v1/audit-log-stream-router.ts
+1 -7
View File
@@ -21,7 +21,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
}
],
body: z.object({
projectSlug: z.string().min(1).describe(AUDIT_LOG_STREAMS.CREATE.projectSlug),
url: z.string().min(1).describe(AUDIT_LOG_STREAMS.CREATE.url),
token: z.string().optional().describe(AUDIT_LOG_STREAMS.CREATE.token)
}),
@@ -38,7 +37,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
actor: req.permission.type,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod,
projectSlug: req.body.projectSlug,
url: req.body.url,
token: req.body.token
});
@@ -174,9 +172,6 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
bearerAuth: []
}
],
querystring: z.object({
projectSlug: z.string().describe(AUDIT_LOG_STREAMS.LIST.projectSlug)
}),
response: {
200: z.object({
auditLogStreams: SanitizedAuditLogStreamSchema.array()
@@ -189,8 +184,7 @@ export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) =
actorId: req.permission.id,
actor: req.permission.type,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod,
projectSlug: req.query.projectSlug
actorAuthMethod: req.permission.authMethod
});
return { auditLogStreams };
backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts
+29 -60
View File
@@ -4,11 +4,10 @@ import { SecretKeyEncoding } from "@app/db/schemas";
import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
import { BadRequestError } from "@app/lib/errors";
import { validateLocalIps } from "@app/lib/validator";
import { TProjectDALFactory } from "@app/services/project/project-dal";
import { TLicenseServiceFactory } from "../license/license-service";
import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
import { TPermissionServiceFactory } from "../permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
import { TAuditLogStreamDALFactory } from "./audit-log-stream-dal";
import {
TCreateAuditLogStreamDTO,
@@ -20,8 +19,7 @@ import {
type TAuditLogStreamServiceFactoryDep = {
auditLogStreamDAL: TAuditLogStreamDALFactory;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
};
@@ -30,40 +28,29 @@ export type TAuditLogStreamServiceFactory = ReturnType<typeof auditLogStreamServ
export const auditLogStreamServiceFactory = ({
auditLogStreamDAL,
permissionService,
projectDAL,
licenseService
}: TAuditLogStreamServiceFactoryDep) => {
const create = async ({
projectSlug,
url,
actor,
token,
actorId,
actorOrgId,
actorAuthMethod
}: TCreateAuditLogStreamDTO) => {
const create = async ({ url, actor, token, actorId, actorOrgId, actorAuthMethod }: TCreateAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const plan = await licenseService.getPlan(actorOrgId);
if (!plan.auditLogStreams)
throw new BadRequestError({
message: "Failed to create audit log streams due to plan restriction. Upgrade plan to create group."
});
const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
if (!project) throw new BadRequestError({ message: "Project not found" });
const projectId = project.id;
const { permission } = await permissionService.getProjectPermission(
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
projectId,
actorOrgId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
validateLocalIps(url);
const totalStreams = await auditLogStreamDAL.find({ projectId });
const totalStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
if (totalStreams.length >= plan.auditLogStreamLimit) {
throw new BadRequestError({
message:
@@ -72,7 +59,7 @@ export const auditLogStreamServiceFactory = ({
}
const encryptedToken = token ? infisicalSymmetricEncypt(token) : undefined;
const logStream = await auditLogStreamDAL.create({
projectId,
orgId: actorOrgId,
url,
...(encryptedToken
? {
@@ -96,6 +83,8 @@ export const auditLogStreamServiceFactory = ({
actorOrgId,
actorAuthMethod
}: TUpdateAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const plan = await licenseService.getPlan(actorOrgId);
if (!plan.auditLogStreams)
throw new BadRequestError({
@@ -105,20 +94,13 @@ export const auditLogStreamServiceFactory = ({
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
if (url) validateLocalIps(url);
const encryptedToken = token ? infisicalSymmetricEncypt(token) : undefined;
const updatedLogStream = await auditLogStreamDAL.updateById(id, {
projectId,
url,
...(encryptedToken
? {
@@ -134,18 +116,14 @@ export const auditLogStreamServiceFactory = ({
};
const deleteById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TDeleteAuditLogStreamDTO) => {
if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" });
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Settings);
const deletedLogStream = await auditLogStreamDAL.deleteById(id);
return deletedLogStream;
@@ -155,15 +133,10 @@ export const auditLogStreamServiceFactory = ({
const logStream = await auditLogStreamDAL.findById(id);
if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" });
const { projectId } = logStream;
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
const { orgId } = logStream;
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
const token =
logStream?.encryptedTokenCiphertext && logStream?.encryptedTokenIV && logStream?.encryptedTokenTag
? infisicalSymmetricDecrypt({
@@ -177,21 +150,17 @@ export const auditLogStreamServiceFactory = ({
return { ...logStream, token };
};
const list = async ({ projectSlug, actor, actorId, actorOrgId, actorAuthMethod }: TListAuditLogStreamDTO) => {
const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
if (!project) throw new BadRequestError({ message: "Project not found" });
const projectId = project.id;
const { permission } = await permissionService.getProjectPermission(
const list = async ({ actor, actorId, actorOrgId, actorAuthMethod }: TListAuditLogStreamDTO) => {
const { permission } = await permissionService.getOrgPermission(
actor,
actorId,
projectId,
actorOrgId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
const logStreams = await auditLogStreamDAL.find({ projectId });
const logStreams = await auditLogStreamDAL.find({ orgId: actorOrgId });
return logStreams;
};
backend/src/ee/services/audit-log-stream/audit-log-stream-types.ts
+6 -9
View File
@@ -1,25 +1,22 @@
import { TProjectPermission } from "@app/lib/types";
import { TOrgPermission } from "@app/lib/types";
export type TCreateAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
projectSlug: string;
export type TCreateAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
url: string;
token?: string;
};
export type TUpdateAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TUpdateAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
url?: string;
token?: string;
};
export type TDeleteAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TDeleteAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
};
export type TListAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
projectSlug: string;
};
export type TListAuditLogStreamDTO = Omit<TOrgPermission, "orgId">;
export type TGetDetailsAuditLogStreamDTO = Omit<TProjectPermission, "projectId"> & {
export type TGetDetailsAuditLogStreamDTO = Omit<TOrgPermission, "orgId"> & {
id: string;
};
backend/src/ee/services/audit-log/audit-log-queue.ts
+1 -1
View File
@@ -71,7 +71,7 @@ export const auditLogQueueServiceFactory = ({
userAgentType
});
const logStreams = projectId ? await auditLogStreamDAL.find({ projectId }) : [];
const logStreams = orgId ? await auditLogStreamDAL.find({ orgId }) : [];
await Promise.allSettled(
logStreams.map(
async ({ url, encryptedTokenTag, encryptedTokenIV, encryptedTokenKeyEncoding, encryptedTokenCiphertext }) => {
backend/src/lib/api-docs/constants.ts
-4
View File
@@ -617,7 +617,6 @@ export const INTEGRATION = {
export const AUDIT_LOG_STREAMS = {
CREATE: {
projectSlug: "The slug of the project to create audit log stream.",
url: "The socket URL to push logs to.",
token: "Authentication token for the external provider used for identification."
},
@@ -629,9 +628,6 @@ export const AUDIT_LOG_STREAMS = {
DELETE: {
id: "The ID of the audit log stream to delete."
},
LIST: {
projectSlug: "The slug of the project to list audit log streams."
},
GET_BY_ID: {
id: "The ID of the audit log stream to get details."
}
backend/src/lib/types/index.ts
+1 -1
View File
@@ -17,7 +17,7 @@ export type TOrgPermission = {
actorId: string;
orgId: string;
actorAuthMethod: ActorAuthMethod;
actorOrgId: string | undefined;
actorOrgId: string;
};
export type TProjectPermission = {
backend/src/server/routes/index.ts
-1
View File
@@ -251,7 +251,6 @@ export const registerRoutes = async (
});
const auditLogService = auditLogServiceFactory({ auditLogDAL, permissionService, auditLogQueue });
const auditLogStreamService = auditLogStreamServiceFactory({
projectDAL,
licenseService,
permissionService,
auditLogStreamDAL