awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add audit logging for pki alerts / collections

Browse Source
This commit is contained in:
Tuan Dang
2024-08-09 09:07:02 -07:00
parent fc4a20caf2
commit 705b4f7513
4 changed files with 260 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -2,6 +2,7 @@ import { TProjectPermission } from "@app/lib/types";
import { ActorType } from "@app/services/auth/auth-type";
import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
import { PkiItemType } from "@app/services/pki-collection/pki-collection-types";
export type TListProjectAuditLogDTO = {
auditLogActor?: string;
@@ -143,6 +144,19 @@ export enum EventType {
DELETE_CERT = "delete-cert",
REVOKE_CERT = "revoke-cert",
GET_CERT_BODY = "get-cert-body",
CREATE_PKI_ALERT = "create-pki-alert",
GET_PKI_ALERT = "get-pki-alert",
UPDATE_PKI_ALERT = "update-pki-alert",
DELETE_PKI_ALERT = "delete-pki-alert",
// new
CREATE_PKI_COLLECTION = "create-pki-collection",
GET_PKI_COLLECTION = "get-pki-collection",
UPDATE_PKI_COLLECTION = "update-pki-collection",
DELETE_PKI_COLLECTION = "delete-pki-collection",
GET_PKI_COLLECTION_ITEMS = "get-pki-collection-items",
ADD_PKI_COLLECTION_ITEM = "add-pki-collection-item",
DELETE_PKI_COLLECTION_ITEM = "delete-pki-collection-item",
// end
CREATE_KMS = "create-kms",
UPDATE_KMS = "update-kms",
DELETE_KMS = "delete-kms",
@@ -1208,6 +1222,95 @@ interface GetCertBody {
};
}
interface CreatePkiAlert {
type: EventType.CREATE_PKI_ALERT;
metadata: {
pkiAlertId: string;
pkiCollectionId: string;
name: string;
alertBeforeDays: number;
recipientEmails: string;
};
}
interface GetPkiAlert {
type: EventType.GET_PKI_ALERT;
metadata: {
pkiAlertId: string;
};
}
interface UpdatePkiAlert {
type: EventType.UPDATE_PKI_ALERT;
metadata: {
pkiAlertId: string;
pkiCollectionId?: string;
name?: string;
alertBeforeDays?: number;
recipientEmails?: string;
};
}
interface DeletePkiAlert {
type: EventType.DELETE_PKI_ALERT;
metadata: {
pkiAlertId: string;
};
}
interface CreatePkiCollection {
type: EventType.CREATE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
name: string;
};
}
interface GetPkiCollection {
type: EventType.GET_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
};
}
interface UpdatePkiCollection {
type: EventType.UPDATE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
name?: string;
};
}
interface DeletePkiCollection {
type: EventType.DELETE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
};
}
interface GetPkiCollectionItems {
type: EventType.GET_PKI_COLLECTION_ITEMS;
metadata: {
pkiCollectionId: string;
};
}
interface AddPkiCollectionItem {
type: EventType.ADD_PKI_COLLECTION_ITEM;
metadata: {
pkiCollectionItemId: string;
pkiCollectionId: string;
type: PkiItemType;
itemId: string;
};
}
interface DeletePkiCollectionItem {
type: EventType.DELETE_PKI_COLLECTION_ITEM;
metadata: {
pkiCollectionItemId: string;
pkiCollectionId: string;
};
}
interface CreateKmsEvent {
type: EventType.CREATE_KMS;
metadata: {
@@ -1379,6 +1482,17 @@ export type Event =
| DeleteCert
| RevokeCert
| GetCertBody
| CreatePkiAlert
| GetPkiAlert
| UpdatePkiAlert
| DeletePkiAlert
| CreatePkiCollection
| GetPkiCollection
| UpdatePkiCollection
| DeletePkiCollection
| GetPkiCollectionItems
| AddPkiCollectionItem
| DeletePkiCollectionItem
| CreateKmsEvent
| UpdateKmsEvent
| DeleteKmsEvent

103
backend/src/server/routes/v1/pki-alert-router.ts
View File

@@ -1,6 +1,7 @@
import { z } from "zod";
import { PkiAlertsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
@@ -35,20 +36,20 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: alert.projectId,
event: {
type: EventType.CREATE_PKI_ALERT,
metadata: {
pkiAlertId: alert.id,
pkiCollectionId: alert.pkiCollectionId,
name: alert.name,
alertBeforeDays: alert.alertBeforeDays,
recipientEmails: alert.recipientEmails
}
}
});
return alert;
}
@@ -79,19 +80,16 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: alert.projectId,
event: {
type: EventType.GET_PKI_ALERT,
metadata: {
pkiAlertId: alert.id
}
}
});
return alert;
}
@@ -129,19 +127,20 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: alert.projectId,
event: {
type: EventType.UPDATE_PKI_ALERT,
metadata: {
pkiAlertId: alert.id,
pkiCollectionId: alert.pkiCollectionId,
name: alert.name,
alertBeforeDays: alert.alertBeforeDays,
recipientEmails: alert.recipientEmails
}
}
});
return alert;
}
@@ -172,20 +171,16 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.DELETE_CERT,
// metadata: {
// certId: deletedCert.id,
// cn: deletedCert.commonName,
// serialNumber: deletedCert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: alert.projectId,
event: {
type: EventType.DELETE_PKI_ALERT,
metadata: {
pkiAlertId: alert.id
}
}
});
return alert;
}

194
backend/src/server/routes/v1/pki-collection-router.ts
View File

@@ -1,6 +1,7 @@
import { z } from "zod";
import { PkiCollectionItemsSchema, PkiCollectionsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
@@ -33,20 +34,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.CREATE_PKI_COLLECTION,
metadata: {
pkiCollectionId: pkiCollection.id,
name: pkiCollection.name
}
}
});
return pkiCollection;
}
@@ -77,19 +75,16 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.GET_PKI_COLLECTION,
metadata: {
pkiCollectionId: pkiCollection.id
}
}
});
return pkiCollection;
}
@@ -124,19 +119,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.UPDATE_PKI_COLLECTION,
metadata: {
pkiCollectionId: pkiCollection.id,
name: pkiCollection.name
}
}
});
return pkiCollection;
}
@@ -167,20 +160,16 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.DELETE_CERT,
// metadata: {
// certId: deletedCert.id,
// cn: deletedCert.commonName,
// serialNumber: deletedCert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.DELETE_PKI_COLLECTION,
metadata: {
pkiCollectionId: pkiCollection.id
}
}
});
return pkiCollection;
}
@@ -215,30 +204,27 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
}
},
handler: async (req) => {
const { pkiCollectionItems, totalCount } = await server.services.pkiCollection.getPkiCollectionItems({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.query
const { pkiCollection, pkiCollectionItems, totalCount } =
await server.services.pkiCollection.getPkiCollectionItems({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.query
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.GET_PKI_COLLECTION_ITEMS,
metadata: {
pkiCollectionId: pkiCollection.id
}
}
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
return {
collectionItems: pkiCollectionItems,
totalCount
@@ -270,7 +256,7 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
}
},
handler: async (req) => {
const pkiCollectionItem = await server.services.pkiCollection.addItemToPkiCollection({
const { pkiCollection, pkiCollectionItem } = await server.services.pkiCollection.addItemToPkiCollection({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
@@ -279,20 +265,19 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.ADD_PKI_COLLECTION_ITEM,
metadata: {
pkiCollectionId: pkiCollection.id,
pkiCollectionItemId: pkiCollectionItem.id,
type: pkiCollectionItem.type,
itemId: pkiCollectionItem.itemId
}
}
});
return pkiCollectionItem;
}
@@ -319,7 +304,7 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
}
},
handler: async (req) => {
const pkiCollectionItem = await server.services.pkiCollection.removeItemFromPkiCollection({
const { pkiCollection, pkiCollectionItem } = await server.services.pkiCollection.removeItemFromPkiCollection({
collectionId: req.params.collectionId,
itemId: req.params.itemId,
actor: req.permission.type,
@@ -328,20 +313,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.DELETE_CERT,
// metadata: {
// certId: deletedCert.id,
// cn: deletedCert.commonName,
// serialNumber: deletedCert.serialNumber
// }
// }
// });
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.DELETE_PKI_COLLECTION_ITEM,
metadata: {
pkiCollectionId: pkiCollection.id,
pkiCollectionItemId: pkiCollectionItem.id
}
}
});
return pkiCollectionItem;
}

11
backend/src/services/pki-collection/pki-collection-service.ts
View File

@@ -172,6 +172,7 @@ export const pkiCollectionServiceFactory = ({
const count = await pkiCollectionItemDAL.countItemsInPkiCollection(collectionId);
return {
pkiCollection,
pkiCollectionItems: pkiCollectionItems.map(transformPkiCollectionItem),
totalCount: count
};
@@ -258,7 +259,10 @@ export const pkiCollectionServiceFactory = ({
}
}
return transformPkiCollectionItem(pkiCollectionItem);
return {
pkiCollection,
pkiCollectionItem: transformPkiCollectionItem(pkiCollectionItem)
};
};
const removeItemFromPkiCollection = async ({
@@ -294,7 +298,10 @@ export const pkiCollectionServiceFactory = ({
pkiCollectionItem = await pkiCollectionItemDAL.deleteById(itemId);
return transformPkiCollectionItem(pkiCollectionItem);
return {
pkiCollection,
pkiCollectionItem: transformPkiCollectionItem(pkiCollectionItem)
};
};
return {