Finish v1 audit logs, secret versioning, version all unversioned secrets

backend/src/ee/helpers/action.ts

@@ -0,0 +1,112 @@
+import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
+import { Secret } from '../../models';
+import { SecretVersion, Action } from '../models';
+import { ACTION_UPDATE_SECRETS } from '../../variables';
+
+/**
+ * Create an (audit) action for secrets including
+ * add, delete, update, and read actions.
+ * @param {Object} obj
+ * @param {String} obj.name - name of action
+ * @param {ObjectId[]} obj.secretIds - ids of relevant secrets
+ * @returns {Action} action - new action
+ */
+const createActionSecretHelper = async ({
+    name,
+    userId,
+    workspaceId,
+    secretIds
+}: {
+    name: string;
+    userId: string;
+    workspaceId: string;
+    secretIds: Types.ObjectId[];
+}) => {
+
+    let action;
+    let latestSecretVersions;
+    try {
+        if (name === ACTION_UPDATE_SECRETS) {
+            // case: action is updating secrets
+            // -> add old and new secret versions
+
+            // TODO: make query more efficient
+            latestSecretVersions = (await SecretVersion.aggregate([
+                    {
+                        $match: {
+                        secret: {
+                            $in: secretIds,
+                        },
+                        },
+                    },
+                    {
+                        $sort: { version: -1 },
+                    },
+                    {
+                        $group: {
+                        _id: "$secret",
+                        versions: { $push: "$$ROOT" },
+                        },
+                    },
+                    {
+                        $project: {
+                        _id: 0,
+                        secret: "$_id",
+                        versions: { $slice: ["$versions", 2] },
+                        },
+                    }
+                ]))
+                .map((s) => ({
+                    oldSecretVersion: s.versions[0]._id,
+                    newSecretVersion: s.versions[1]._id
+                }));
+
+
+        } else {
+            // case: action is adding, deleting, or reading secrets
+            // -> add new secret versions
+            latestSecretVersions = (await SecretVersion.aggregate([
+				{
+					$match: { 
+                        secret: { 
+                            $in: secretIds 
+                        } 
+                    }
+				},
+				{
+					$group: {
+						_id: '$secret',
+						version: { $max: '$version' },
+                        versionId: { $max: '$_id' } // secret version id
+					}
+				},
+				{
+					$sort: { version: -1 }
+				}
+				])
+				.exec())
+                .map((s) => ({
+                    newSecretVersion: s.versionId
+                }));
+        }
+
+        action = await new Action({
+            name,
+            user: userId,
+            workspace: workspaceId,
+            payload: {
+                secretVersions: latestSecretVersions
+            }
+        }).save();
+
+    } catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to create action');
+    }
+    
+    return action;
+}
+
+export { createActionSecretHelper };

backend/src/ee/helpers/log.ts

@@ -22,6 +22,7 @@ const createLogHelper = async ({
         log = await new Log({
             user: userId,
             workspace: workspaceId,
+            actionNames: actions.map((a) => a.name),
             actions,
             channel,
             ipAddress

backend/src/ee/helpers/secret.ts

@@ -1,3 +1,4 @@
+import { Types } from 'mongoose';
 import * as Sentry from '@sentry/node';
 import {
     Secret
@@ -59,16 +60,40 @@ const addSecretVersionsHelper = async ({
 }: {
 	secretVersions: ISecretVersion[]
 }) => {
+	let newSecretVersions;
 	try {
-		await SecretVersion.insertMany(secretVersions);
+		newSecretVersions = await SecretVersion.insertMany(secretVersions);
 	} catch (err) {
 		Sentry.setUser(null);
 		Sentry.captureException(err);
 		throw new Error('Failed to add secret versions');
 	}
+	
+	return newSecretVersions;
+}
+
+const markDeletedSecretVersionsHelper = async ({
+	secretIds
+}: {
+	secretIds: Types.ObjectId[];
+}) => {
+	try {
+		await SecretVersion.updateMany({
+			secret: { $in: secretIds }
+		}, {
+			isDeleted: true
+		}, {
+			new: true
+		});
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to mark secret versions as deleted');
+	}
 }
 
 export {
     takeSecretSnapshotHelper,
-	addSecretVersionsHelper
+	addSecretVersionsHelper,
+	markDeletedSecretVersionsHelper
 }