diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index daff35dad..eed743476 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -317,6 +317,8 @@ interface GetSecretsEvent { }; } +type TSecretMetadata = { key: string; value: string }[]; + interface GetSecretEvent { type: EventType.GET_SECRET; metadata: { @@ -325,6 +327,7 @@ interface GetSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: TSecretMetadata; }; } @@ -336,6 +339,7 @@ interface CreateSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: TSecretMetadata; }; } @@ -344,7 +348,12 @@ interface CreateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>; + secrets: Array<{ + secretId: string; + secretKey: string; + secretVersion: number; + secretMetadata?: TSecretMetadata; + }>; }; } @@ -356,6 +365,7 @@ interface UpdateSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: TSecretMetadata; }; } @@ -364,7 +374,7 @@ interface UpdateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>; + secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: TSecretMetadata }>; }; } diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 67fd09ac8..c5ab9e9fb 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -411,7 +411,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.query.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secret.secretMetadata } } }); @@ -519,7 +520,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.body.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: req.body.secretMetadata } } }); @@ -631,7 +633,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.body.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: req.body.secretMetadata } } }); @@ -1904,6 +1907,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } const { secrets } = secretOperation; + const secretMetadataMap = new Map( + inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata]) + ); + await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, ...req.auditLogInfo, @@ -1915,7 +1922,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secrets: secrets.map((secret) => ({ secretId: secret.id, secretKey: secret.secretKey, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secretMetadataMap.get(secret.secretKey) })) } } @@ -2010,6 +2018,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } const { secrets } = secretOperation; + const secretMetadataMap = new Map( + inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata]) + ); + await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, ...req.auditLogInfo, @@ -2021,7 +2033,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secrets: secrets.map((secret) => ({ secretId: secret.id, secretKey: secret.secretKey, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secretMetadataMap.get(secret.secretKey) })) } } diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index e9e04dbd8..b03a7a090 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -1291,8 +1291,13 @@ export const secretV2BridgeServiceFactory = ({ ] } }); - if (secretsToUpdate.length !== inputSecrets.length) - throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + if (secretsToUpdate.length !== inputSecrets.length) { + const secretsToUpdateNames = secretsToUpdate.map((secret) => secret.key); + const invalidSecrets = inputSecrets.filter((secret) => !secretsToUpdateNames.includes(secret.secretKey)); + throw new NotFoundError({ + message: `Secret does not exist: ${invalidSecrets.map((el) => el.secretKey).join(",")}` + }); + } const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key); secretsToUpdate.forEach((el) => { diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index a9bba106c..41026b16a 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1444,7 +1444,7 @@ export const secretServiceFactory = ({ decryptedSecret.secretValue = expandedSecretValue || ""; } - return decryptedSecret; + return { secretMetadata: undefined, ...decryptedSecret }; }; const createSecretRaw = async ({ diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 6a990f80e..7308f2fbf 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -4,6 +4,8 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.GET_SECRETS]: "List secrets", [EventType.GET_SECRET]: "Read secret", [EventType.DELETE_SECRETS]: "Delete secrets", + [EventType.CREATE_SECRETS]: "Create secrets", + [EventType.UPDATE_SECRETS]: "Update secrets", [EventType.CREATE_SECRET]: "Create secret", [EventType.UPDATE_SECRET]: "Update secret", [EventType.DELETE_SECRET]: "Delete secret", diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index 349811180..0da1eac02 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -19,6 +19,8 @@ export enum UserAgentType { export enum EventType { GET_SECRETS = "get-secrets", DELETE_SECRETS = "delete-secrets", + CREATE_SECRETS = "create-secrets", + UPDATE_SECRETS = "update-secrets", GET_SECRET = "get-secret", CREATE_SECRET = "create-secret", UPDATE_SECRET = "update-secret",