Add v1 audit log backend models and wiring to push secrets

backend/src/ee/controllers/v1/workspaceController.ts

@@ -1,6 +1,9 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
-import { SecretSnapshot } from '../../models';
+import { 
+	SecretSnapshot,
+	Log
+} from '../../models';
 
 /**
  * Return secret snapshots for workspace with id [workspaceId]
@@ -32,4 +35,33 @@ import { SecretSnapshot } from '../../models';
 	return res.status(200).send({
 		secretSnapshots
 	});
+}
+
+export const getWorkspaceLogs = async (req: Request, res: Response) => {
+	let logs
+	try {
+		const { workspaceId } = req.params;
+
+		const offset: number = parseInt(req.query.offset as string);
+		const limit: number = parseInt(req.query.limit as string);
+		const filters: any = req.query.filters || {};
+		
+		filters.workspace = workspaceId;
+		
+		logs = await Log.find(filters)
+		.skip(offset)
+		.limit(limit)
+		.populate('actions');
+
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace logs'
+		});
+	}
+	
+	return res.status(200).send({
+		logs
+	});
 }

backend/src/ee/helpers/log.ts

@@ -0,0 +1,40 @@
+import * as Sentry from '@sentry/node';
+import { 
+    Log,
+    IAction
+} from '../models';
+
+const createLogHelper = async ({
+    userId,
+    workspaceId,
+    actions,
+    channel,
+    ipAddress
+}: {
+    userId: string;
+    workspaceId: string;
+    actions: IAction[];
+    channel: string;
+    ipAddress: string;
+}) => {
+    let log;
+    try {
+        log = await new Log({
+            user: userId,
+            workspace: workspaceId,
+            actions,
+            channel,
+            ipAddress
+        }).save();
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to create log');
+    }
+
+    return log;
+}
+
+export {
+    createLogHelper
+}

backend/src/ee/models/action.ts

@@ -0,0 +1,40 @@
+import { Schema, model, Types } from 'mongoose';
+
+export interface IAction {
+    name: string;
+    user?: Types.ObjectId,
+    workspace?: Types.ObjectId,
+    payload: {
+        secretVersions?: Types.ObjectId[]
+    }
+}
+
+const actionSchema = new Schema<IAction>(
+    {
+        name: {
+            type: String,
+            required: true
+        },
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: 'User',
+            required: true
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace'
+        },
+        payload: {
+            secretVersions: [{
+                type: Schema.Types.ObjectId,
+                ref: 'SecretVersion'
+            }]
+        }
+    }, {
+        timestamps: true
+    }
+);
+
+const Action = model<IAction>('Action', actionSchema);
+
+export default Action;

backend/src/ee/models/index.ts

@@ -1,9 +1,15 @@
-import SecretSnapshot, { ISecretSnapshot } from "./secretSnapshot";
-import SecretVersion, { ISecretVersion } from "./secretVersion";
+import SecretSnapshot, { ISecretSnapshot } from './secretSnapshot';
+import SecretVersion, { ISecretVersion } from './secretVersion';
+import Log, { ILog } from './log';
+import Action, { IAction } from './action';
 
 export {
     SecretSnapshot,
     ISecretSnapshot,
     SecretVersion,
-    ISecretVersion
+    ISecretVersion,
+    Log,
+    ILog,
+    Action,
+    IAction
 }

backend/src/ee/models/log.ts

@@ -0,0 +1,41 @@
+import { Schema, model, Types } from 'mongoose';
+
+export interface ILog {
+    _id: Types.ObjectId;
+    user?: Types.ObjectId;
+    workspace?: Types.ObjectId;
+    actions: Types.ObjectId[];
+    channel: string;
+    ipAddress?: string;
+}
+
+const logSchema = new Schema<ILog>(
+    {
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: 'User'
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace'
+        },
+        actions: [{
+            type: Schema.Types.ObjectId,
+            ref: 'Action'
+        }],
+        channel: { 
+            type: String,
+            enum: ['web', 'cli', 'auto'],
+            required: true
+        },
+        ipAddress: {
+            type: String
+        }
+    }, {
+        timestamps: true
+    }
+);
+
+const Log = model<ILog>('Log', logSchema);
+
+export default Log;

backend/src/ee/routes/v1/index.ts

@@ -1,7 +1,9 @@
 import secret from './secret';
 import workspace from './workspace';
+import log from './log';
 
 export {
     secret,
-    workspace
+    workspace,
+    log
 }

backend/src/ee/routes/v1/log.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+const router = express.Router();
+
+export default router;

backend/src/ee/routes/v1/workspace.ts

@@ -23,5 +23,19 @@ router.get(
 	workspaceController.getWorkspaceSecretSnapshots
 );
 
+router.get(
+	'/:workspaceId/logs',
+	requireAuth,
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [GRANTED]
+	}),
+	param('workspaceId').exists().trim(),
+	query('offset').exists().isInt(),
+	query('limit').exists().isInt(),
+	query('filters').exists(),
+	validateRequest,
+	workspaceController.getWorkspaceLogs
+);
 
 export default router;

backend/src/ee/services/EELogService.ts

@@ -0,0 +1,47 @@
+import { 
+    Action,
+    IAction
+} from '../models';
+import {
+    createLogHelper
+} from '../helpers/log';
+import EELicenseService from './EELicenseService';
+
+/**
+ * Class to handle Enterprise Edition log actions
+ */
+class EELogService {
+    /**
+     * Create an (audit) log
+     * @param {Object} obj
+     * @param {String} obj.userId - id of user associated with the log
+     * @param {String} obj.workspaceId - id of workspace associated with the log
+     * @param {Action} obj.actions - actions to include in log
+     * @param {String} obj.channel - channel (web/cli/auto) associated with the log
+     * @param {String} obj.ipAddress - ip address associated with the log
+     */
+    static async createLog({
+        userId,
+        workspaceId,
+        actions,
+        channel,
+        ipAddress
+    }: {
+        userId: string;
+        workspaceId: string;
+        actions: IAction[];
+        channel: string;
+        ipAddress: string;
+    }) {
+        if (!EELicenseService.isLicenseValid) return;
+        return await createLogHelper({
+            userId,
+            workspaceId,
+            actions,
+            channel,
+            ipAddress
+        })
+    }
+}
+
+export default EELogService;

backend/src/ee/services/index.ts

@@ -1,7 +1,9 @@
 import EELicenseService from "./EELicenseService";
 import EESecretService from "./EESecretService";
+import EELogService from "./EELogService";
 
 export {
     EELicenseService,
-    EESecretService
+    EESecretService,
+    EELogService
 }