awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add audit logging for pki alerts / collections

Browse Source
This commit is contained in:
Tuan Dang
2024-08-09 09:07:02 -07:00
parent fc4a20caf2
commit 705b4f7513
4 changed files with 260 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -2,6 +2,7 @@ import { TProjectPermission } from "@app/lib/types";
import { ActorType } from "@app/services/auth/auth-type"; import { ActorType } from "@app/services/auth/auth-type";
import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types"; import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
import { TIdentityTrustedIp } from "@app/services/identity/identity-types"; import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
import { PkiItemType } from "@app/services/pki-collection/pki-collection-types";
export type TListProjectAuditLogDTO = { export type TListProjectAuditLogDTO = {
auditLogActor?: string; auditLogActor?: string;
@@ -143,6 +144,19 @@ export enum EventType {
DELETE_CERT = "delete-cert", DELETE_CERT = "delete-cert",
REVOKE_CERT = "revoke-cert", REVOKE_CERT = "revoke-cert",
GET_CERT_BODY = "get-cert-body", GET_CERT_BODY = "get-cert-body",
CREATE_PKI_ALERT = "create-pki-alert",
GET_PKI_ALERT = "get-pki-alert",
UPDATE_PKI_ALERT = "update-pki-alert",
DELETE_PKI_ALERT = "delete-pki-alert",
// new
CREATE_PKI_COLLECTION = "create-pki-collection",
GET_PKI_COLLECTION = "get-pki-collection",
UPDATE_PKI_COLLECTION = "update-pki-collection",
DELETE_PKI_COLLECTION = "delete-pki-collection",
GET_PKI_COLLECTION_ITEMS = "get-pki-collection-items",
ADD_PKI_COLLECTION_ITEM = "add-pki-collection-item",
DELETE_PKI_COLLECTION_ITEM = "delete-pki-collection-item",
// end
CREATE_KMS = "create-kms", CREATE_KMS = "create-kms",
UPDATE_KMS = "update-kms", UPDATE_KMS = "update-kms",
DELETE_KMS = "delete-kms", DELETE_KMS = "delete-kms",
@@ -1208,6 +1222,95 @@ interface GetCertBody {
}; };
} }
interface CreatePkiAlert {
type: EventType.CREATE_PKI_ALERT;
metadata: {
pkiAlertId: string;
pkiCollectionId: string;
name: string;
alertBeforeDays: number;
recipientEmails: string;
};
}
interface GetPkiAlert {
type: EventType.GET_PKI_ALERT;
metadata: {
pkiAlertId: string;
};
}
interface UpdatePkiAlert {
type: EventType.UPDATE_PKI_ALERT;
metadata: {
pkiAlertId: string;
pkiCollectionId?: string;
name?: string;
alertBeforeDays?: number;
recipientEmails?: string;
};
}
interface DeletePkiAlert {
type: EventType.DELETE_PKI_ALERT;
metadata: {
pkiAlertId: string;
};
}
interface CreatePkiCollection {
type: EventType.CREATE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
name: string;
};
}
interface GetPkiCollection {
type: EventType.GET_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
};
}
interface UpdatePkiCollection {
type: EventType.UPDATE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
name?: string;
};
}
interface DeletePkiCollection {
type: EventType.DELETE_PKI_COLLECTION;
metadata: {
pkiCollectionId: string;
};
}
interface GetPkiCollectionItems {
type: EventType.GET_PKI_COLLECTION_ITEMS;
metadata: {
pkiCollectionId: string;
};
}
interface AddPkiCollectionItem {
type: EventType.ADD_PKI_COLLECTION_ITEM;
metadata: {
pkiCollectionItemId: string;
pkiCollectionId: string;
type: PkiItemType;
itemId: string;
};
}
interface DeletePkiCollectionItem {
type: EventType.DELETE_PKI_COLLECTION_ITEM;
metadata: {
pkiCollectionItemId: string;
pkiCollectionId: string;
};
}
interface CreateKmsEvent { interface CreateKmsEvent {
type: EventType.CREATE_KMS; type: EventType.CREATE_KMS;
metadata: { metadata: {
@@ -1379,6 +1482,17 @@ export type Event =
| DeleteCert | DeleteCert
| RevokeCert | RevokeCert
| GetCertBody | GetCertBody
| CreatePkiAlert
| GetPkiAlert
| UpdatePkiAlert
| DeletePkiAlert
| CreatePkiCollection
| GetPkiCollection
| UpdatePkiCollection
| DeletePkiCollection
| GetPkiCollectionItems
| AddPkiCollectionItem
| DeletePkiCollectionItem
| CreateKmsEvent | CreateKmsEvent
| UpdateKmsEvent | UpdateKmsEvent
| DeleteKmsEvent | DeleteKmsEvent

103
backend/src/server/routes/v1/pki-alert-router.ts
View File

@@ -1,6 +1,7 @@
import { z } from "zod"; import { z } from "zod";
import { PkiAlertsSchema } from "@app/db/schemas"; import { PkiAlertsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type"; import { AuthMode } from "@app/services/auth/auth-type";
@@ -35,20 +36,20 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
...req.body ...req.body
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: alert.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.CREATE_PKI_ALERT,
// event: { metadata: {
// type: EventType.REVOKE_CERT, pkiAlertId: alert.id,
// metadata: { pkiCollectionId: alert.pkiCollectionId,
// certId: cert.id, name: alert.name,
// cn: cert.commonName, alertBeforeDays: alert.alertBeforeDays,
// serialNumber: cert.serialNumber recipientEmails: alert.recipientEmails
// } }
// } }
// }); });
return alert; return alert;
} }
@@ -79,19 +80,16 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
actorOrgId: req.permission.orgId actorOrgId: req.permission.orgId
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: alert.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.GET_PKI_ALERT,
// event: { metadata: {
// type: EventType.GET_CA, pkiAlertId: alert.id
// metadata: { }
// caId: ca.id, }
// dn: ca.dn });
// }
// }
// });
return alert; return alert;
} }
@@ -129,19 +127,20 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
...req.body ...req.body
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: alert.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.UPDATE_PKI_ALERT,
// event: { metadata: {
// type: EventType.GET_CA, pkiAlertId: alert.id,
// metadata: { pkiCollectionId: alert.pkiCollectionId,
// caId: ca.id, name: alert.name,
// dn: ca.dn alertBeforeDays: alert.alertBeforeDays,
// } recipientEmails: alert.recipientEmails
// } }
// }); }
});
return alert; return alert;
} }
@@ -172,20 +171,16 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
actorOrgId: req.permission.orgId actorOrgId: req.permission.orgId
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: alert.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.DELETE_PKI_ALERT,
// event: { metadata: {
// type: EventType.DELETE_CERT, pkiAlertId: alert.id
// metadata: { }
// certId: deletedCert.id, }
// cn: deletedCert.commonName, });
// serialNumber: deletedCert.serialNumber
// }
// }
// });
return alert; return alert;
} }

194
backend/src/server/routes/v1/pki-collection-router.ts
View File

@@ -1,6 +1,7 @@
import { z } from "zod"; import { z } from "zod";
import { PkiCollectionItemsSchema, PkiCollectionsSchema } from "@app/db/schemas"; import { PkiCollectionItemsSchema, PkiCollectionsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type"; import { AuthMode } from "@app/services/auth/auth-type";
@@ -33,20 +34,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body ...req.body
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.CREATE_PKI_COLLECTION,
// event: { metadata: {
// type: EventType.REVOKE_CERT, pkiCollectionId: pkiCollection.id,
// metadata: { name: pkiCollection.name
// certId: cert.id, }
// cn: cert.commonName, }
// serialNumber: cert.serialNumber });
// }
// }
// });
return pkiCollection; return pkiCollection;
} }
@@ -77,19 +75,16 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId actorOrgId: req.permission.orgId
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.GET_PKI_COLLECTION,
// event: { metadata: {
// type: EventType.GET_CA, pkiCollectionId: pkiCollection.id
// metadata: { }
// caId: ca.id, }
// dn: ca.dn });
// }
// }
// });
return pkiCollection; return pkiCollection;
} }
@@ -124,19 +119,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body ...req.body
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.UPDATE_PKI_COLLECTION,
// event: { metadata: {
// type: EventType.GET_CA, pkiCollectionId: pkiCollection.id,
// metadata: { name: pkiCollection.name
// caId: ca.id, }
// dn: ca.dn }
// } });
// }
// });
return pkiCollection; return pkiCollection;
} }
@@ -167,20 +160,16 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId actorOrgId: req.permission.orgId
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.DELETE_PKI_COLLECTION,
// event: { metadata: {
// type: EventType.DELETE_CERT, pkiCollectionId: pkiCollection.id
// metadata: { }
// certId: deletedCert.id, }
// cn: deletedCert.commonName, });
// serialNumber: deletedCert.serialNumber
// }
// }
// });
return pkiCollection; return pkiCollection;
} }
@@ -215,30 +204,27 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
} }
}, },
handler: async (req) => { handler: async (req) => {
const { pkiCollectionItems, totalCount } = await server.services.pkiCollection.getPkiCollectionItems({ const { pkiCollection, pkiCollectionItems, totalCount } =
collectionId: req.params.collectionId, await server.services.pkiCollection.getPkiCollectionItems({
actor: req.permission.type, collectionId: req.params.collectionId,
actorId: req.permission.id, actor: req.permission.type,
actorAuthMethod: req.permission.authMethod, actorId: req.permission.id,
actorOrgId: req.permission.orgId, actorAuthMethod: req.permission.authMethod,
...req.query actorOrgId: req.permission.orgId,
...req.query
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: pkiCollection.projectId,
event: {
type: EventType.GET_PKI_COLLECTION_ITEMS,
metadata: {
pkiCollectionId: pkiCollection.id
}
}
}); });
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
return { return {
collectionItems: pkiCollectionItems, collectionItems: pkiCollectionItems,
totalCount totalCount
@@ -270,7 +256,7 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
} }
}, },
handler: async (req) => { handler: async (req) => {
const pkiCollectionItem = await server.services.pkiCollection.addItemToPkiCollection({ const { pkiCollection, pkiCollectionItem } = await server.services.pkiCollection.addItemToPkiCollection({
collectionId: req.params.collectionId, collectionId: req.params.collectionId,
actor: req.permission.type, actor: req.permission.type,
actorId: req.permission.id, actorId: req.permission.id,
@@ -279,20 +265,19 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
...req.body ...req.body
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.ADD_PKI_COLLECTION_ITEM,
// event: { metadata: {
// type: EventType.REVOKE_CERT, pkiCollectionId: pkiCollection.id,
// metadata: { pkiCollectionItemId: pkiCollectionItem.id,
// certId: cert.id, type: pkiCollectionItem.type,
// cn: cert.commonName, itemId: pkiCollectionItem.itemId
// serialNumber: cert.serialNumber }
// } }
// } });
// });
return pkiCollectionItem; return pkiCollectionItem;
} }
@@ -319,7 +304,7 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
} }
}, },
handler: async (req) => { handler: async (req) => {
const pkiCollectionItem = await server.services.pkiCollection.removeItemFromPkiCollection({ const { pkiCollection, pkiCollectionItem } = await server.services.pkiCollection.removeItemFromPkiCollection({
collectionId: req.params.collectionId, collectionId: req.params.collectionId,
itemId: req.params.itemId, itemId: req.params.itemId,
actor: req.permission.type, actor: req.permission.type,
@@ -328,20 +313,17 @@ export const registerPkiCollectionRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId actorOrgId: req.permission.orgId
}); });
// TODO: audit logging await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
// await server.services.auditLog.createAuditLog({ projectId: pkiCollection.projectId,
// ...req.auditLogInfo, event: {
// projectId: ca.projectId, type: EventType.DELETE_PKI_COLLECTION_ITEM,
// event: { metadata: {
// type: EventType.DELETE_CERT, pkiCollectionId: pkiCollection.id,
// metadata: { pkiCollectionItemId: pkiCollectionItem.id
// certId: deletedCert.id, }
// cn: deletedCert.commonName, }
// serialNumber: deletedCert.serialNumber });
// }
// }
// });
return pkiCollectionItem; return pkiCollectionItem;
} }

11
backend/src/services/pki-collection/pki-collection-service.ts
View File

@@ -172,6 +172,7 @@ export const pkiCollectionServiceFactory = ({
const count = await pkiCollectionItemDAL.countItemsInPkiCollection(collectionId); const count = await pkiCollectionItemDAL.countItemsInPkiCollection(collectionId);
return { return {
pkiCollection,
pkiCollectionItems: pkiCollectionItems.map(transformPkiCollectionItem), pkiCollectionItems: pkiCollectionItems.map(transformPkiCollectionItem),
totalCount: count totalCount: count
}; };
@@ -258,7 +259,10 @@ export const pkiCollectionServiceFactory = ({
} }
} }
return transformPkiCollectionItem(pkiCollectionItem); return {
pkiCollection,
pkiCollectionItem: transformPkiCollectionItem(pkiCollectionItem)
};
}; };
const removeItemFromPkiCollection = async ({ const removeItemFromPkiCollection = async ({
@@ -294,7 +298,10 @@ export const pkiCollectionServiceFactory = ({
pkiCollectionItem = await pkiCollectionItemDAL.deleteById(itemId); pkiCollectionItem = await pkiCollectionItemDAL.deleteById(itemId);
return transformPkiCollectionItem(pkiCollectionItem); return {
pkiCollection,
pkiCollectionItem: transformPkiCollectionItem(pkiCollectionItem)
};
}; };
return { return {