misc: audit logs

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -41,7 +41,14 @@ export type TListProjectAuditLogDTO = {
 
 export type TCreateAuditLogDTO = {
   event: Event;
-  actor: UserActor | IdentityActor | ServiceActor | ScimClientActor | PlatformActor | UnknownUserActor;
+  actor:
+    | UserActor
+    | IdentityActor
+    | ServiceActor
+    | ScimClientActor
+    | PlatformActor
+    | UnknownUserActor
+    | KmipClientActor;
   orgId?: string;
   projectId?: string;
 } & BaseAuthData;
@@ -259,7 +266,10 @@ export enum EventType {
   DELETE_KMIP_CLIENT = "delete-kmip-client",
   GET_KMIP_CLIENT = "get-kmip-client",
   GET_KMIP_CLIENTS = "get-kmip-clients",
-  CREATE_KMIP_CLIENT_CERTIFICATE = "create-kmip-client-certificate"
+  CREATE_KMIP_CLIENT_CERTIFICATE = "create-kmip-client-certificate",
+  KMIP_OPERATION_CREATE = "kmip-operation-create",
+  KMIP_OPERATION_GET = "kmip-operation-get",
+  KMIP_OPERATION_DELETE = "kmip-operation-delete"
 }
 
 interface UserActorMetadata {
@@ -282,6 +292,11 @@ interface ScimClientActorMetadata {}
 
 interface PlatformActorMetadata {}
 
+interface KmipClientActorMetadata {
+  clientId: string;
+  name: string;
+}
+
 interface UnknownUserActorMetadata {}
 
 export interface UserActor {
@@ -299,6 +314,11 @@ export interface PlatformActor {
   metadata: PlatformActorMetadata;
 }
 
+export interface KmipClientActor {
+  type: ActorType.KMIP_CLIENT;
+  metadata: KmipClientActorMetadata;
+}
+
 export interface UnknownUserActor {
   type: ActorType.UNKNOWN_USER;
   metadata: UnknownUserActorMetadata;
@@ -314,7 +334,7 @@ export interface ScimClientActor {
   metadata: ScimClientActorMetadata;
 }
 
-export type Actor = UserActor | ServiceActor | IdentityActor | ScimClientActor | PlatformActor;
+export type Actor = UserActor | ServiceActor | IdentityActor | ScimClientActor | PlatformActor | KmipClientActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;
@@ -2123,6 +2143,28 @@ interface CreateKmipClientCertificateEvent {
   };
 }
 
+interface KmipOperationGetEvent {
+  type: EventType.KMIP_OPERATION_GET;
+  metadata: {
+    id: string;
+  };
+}
+
+interface KmipOperationDeleteEvent {
+  type: EventType.KMIP_OPERATION_DELETE;
+  metadata: {
+    id: string;
+  };
+}
+
+interface KmipOperationCreateEvent {
+  type: EventType.KMIP_OPERATION_CREATE;
+  metadata: {
+    id: string;
+    algorithm: string;
+  };
+}
+
 export type Event =
   | GetSecretsEvent
   | GetSecretEvent
@@ -2319,4 +2361,7 @@ export type Event =
   | DeleteKmipClientEvent
   | GetKmipClientEvent
   | GetKmipClientsEvent
-  | CreateKmipClientCertificateEvent;
+  | CreateKmipClientCertificateEvent
+  | KmipOperationGetEvent
+  | KmipOperationDeleteEvent
+  | KmipOperationCreateEvent;

backend/src/ee/services/kmip/kmip-enum.ts

@@ -2,5 +2,6 @@ export enum KmipPermission {
   Create = "create",
   Locate = "locate",
   Check = "check",
-  Get = "get"
+  Get = "get",
+  Delete = "delete"
 }

backend/src/ee/services/kmip/kmip-operation-service.ts

@@ -6,7 +6,7 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TKmipClientDALFactory } from "./kmip-client-dal";
 import { KmipPermission } from "./kmip-enum";
-import { TKmipCreateDTO, TKmipGetDTO } from "./kmip-types";
+import { TKmipCreateDTO, TKmipDeleteDTO, TKmipGetDTO } from "./kmip-types";
 
 type TKmipOperationServiceFactoryDep = {
   kmsService: TKmsServiceFactory;
@@ -23,7 +23,7 @@ export const kmipOperationServiceFactory = ({
   projectDAL,
   kmipClientDAL
 }: TKmipOperationServiceFactoryDep) => {
-  const create = async ({ projectId: preSplitProjectId, clientId, encryptionAlgorithm }: TKmipCreateDTO) => {
+  const create = async ({ projectId: preSplitProjectId, clientId, algorithm }: TKmipCreateDTO) => {
     let projectId = preSplitProjectId;
     const cmekProjectFromSplit = await projectDAL.getProjectFromSplitId(projectId, ProjectType.KMS);
     if (cmekProjectFromSplit) {
@@ -43,7 +43,7 @@ export const kmipOperationServiceFactory = ({
     }
 
     const kmsKey = await kmsService.generateKmsKey({
-      encryptionAlgorithm,
+      encryptionAlgorithm: algorithm,
       orgId: project.orgId,
       projectId,
       isReserved: false
@@ -52,6 +52,50 @@ export const kmipOperationServiceFactory = ({
     return kmsKey;
   };
 
+  const deleteOp = async ({ projectId: preSplitProjectId, id, clientId }: TKmipDeleteDTO) => {
+    let projectId = preSplitProjectId;
+    const cmekProjectFromSplit = await projectDAL.getProjectFromSplitId(projectId, ProjectType.KMS);
+
+    if (cmekProjectFromSplit) {
+      projectId = cmekProjectFromSplit.id;
+    }
+
+    const kmipClient = await kmipClientDAL.findOne({
+      id: clientId,
+      projectId
+    });
+
+    if (!kmipClient.permissions?.includes(KmipPermission.Delete)) {
+      throw new ForbiddenRequestError({
+        message: "Client does not have sufficient permission to perform KMIP delete"
+      });
+    }
+
+    const key = await kmsDAL.findOne({
+      id,
+      projectId
+    });
+
+    if (!key) {
+      throw new NotFoundError({ message: `Key with ID ${id} not found` });
+    }
+
+    if (key.isReserved) {
+      throw new BadRequestError({ message: "Cannot delete reserved keys" });
+    }
+
+    const completeKeyDetails = await kmsDAL.findByIdWithAssociatedKms(id);
+    if (!completeKeyDetails.internalKms) {
+      throw new BadRequestError({
+        message: "Cannot delete external keys"
+      });
+    }
+
+    const kms = kmsDAL.deleteById(id);
+
+    return kms;
+  };
+
   const get = async ({ projectId: preSplitProjectId, id, clientId }: TKmipGetDTO) => {
     let projectId = preSplitProjectId;
     const cmekProjectFromSplit = await projectDAL.getProjectFromSplitId(projectId, ProjectType.KMS);
@@ -88,7 +132,7 @@ export const kmipOperationServiceFactory = ({
 
     if (!completeKeyDetails.internalKms) {
       throw new BadRequestError({
-        message: "Cannot get external key"
+        message: "Cannot get external keys"
       });
     }
 
@@ -105,6 +149,7 @@ export const kmipOperationServiceFactory = ({
 
   return {
     create,
-    get
+    get,
+    deleteOp
   };
 };

backend/src/ee/services/kmip/kmip-types.ts

@@ -43,14 +43,19 @@ export type TListKmipClientsByProjectIdDTO = {
   search?: string;
 } & TProjectPermission;
 
-export type TKmipCreateDTO = {
+type KmipOperationBaseDTO = {
   clientId: string;
   projectId: string;
-  encryptionAlgorithm: SymmetricEncryption;
 };
 
+export type TKmipCreateDTO = {
+  algorithm: SymmetricEncryption;
+} & KmipOperationBaseDTO;
+
 export type TKmipGetDTO = {
-  clientId: string;
-  projectId: string;
   id: string;
-};
+} & KmipOperationBaseDTO;
+
+export type TKmipDeleteDTO = {
+  id: string;
+} & KmipOperationBaseDTO;