From 6d0534b165e3d65e6b5615500936f80ce148e692 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Fri, 31 Jan 2025 17:31:17 -0800 Subject: [PATCH 1/3] improvement: include secret metadata in audit logs --- .../ee/services/audit-log/audit-log-types.ts | 7 ++++-- backend/src/server/routes/v3/secret-router.ts | 23 +++++++++++++++---- .../secret-v2-bridge-service.ts | 9 ++++++-- backend/src/services/secret/secret-service.ts | 2 +- .../src/hooks/api/auditLogs/constants.tsx | 2 ++ frontend/src/hooks/api/auditLogs/enums.tsx | 2 ++ 6 files changed, 35 insertions(+), 10 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index ffabb3cc4..d526e0ca3 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -325,6 +325,7 @@ interface GetSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: unknown; }; } @@ -336,6 +337,7 @@ interface CreateSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: unknown; }; } @@ -344,7 +346,7 @@ interface CreateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>; + secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: unknown }>; }; } @@ -356,6 +358,7 @@ interface UpdateSecretEvent { secretId: string; secretKey: string; secretVersion: number; + secretMetadata?: unknown; }; } @@ -364,7 +367,7 @@ interface UpdateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>; + secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: unknown }>; }; } diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 67fd09ac8..c5ab9e9fb 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -411,7 +411,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.query.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secret.secretMetadata } } }); @@ -519,7 +520,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.body.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: req.body.secretMetadata } } }); @@ -631,7 +633,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: req.body.secretPath, secretId: secret.id, secretKey: req.params.secretName, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: req.body.secretMetadata } } }); @@ -1904,6 +1907,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } const { secrets } = secretOperation; + const secretMetadataMap = new Map( + inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata]) + ); + await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, ...req.auditLogInfo, @@ -1915,7 +1922,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secrets: secrets.map((secret) => ({ secretId: secret.id, secretKey: secret.secretKey, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secretMetadataMap.get(secret.secretKey) })) } } @@ -2010,6 +2018,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } const { secrets } = secretOperation; + const secretMetadataMap = new Map( + inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata]) + ); + await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, ...req.auditLogInfo, @@ -2021,7 +2033,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secrets: secrets.map((secret) => ({ secretId: secret.id, secretKey: secret.secretKey, - secretVersion: secret.version + secretVersion: secret.version, + secretMetadata: secretMetadataMap.get(secret.secretKey) })) } } diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index e9e04dbd8..b03a7a090 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -1291,8 +1291,13 @@ export const secretV2BridgeServiceFactory = ({ ] } }); - if (secretsToUpdate.length !== inputSecrets.length) - throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + if (secretsToUpdate.length !== inputSecrets.length) { + const secretsToUpdateNames = secretsToUpdate.map((secret) => secret.key); + const invalidSecrets = inputSecrets.filter((secret) => !secretsToUpdateNames.includes(secret.secretKey)); + throw new NotFoundError({ + message: `Secret does not exist: ${invalidSecrets.map((el) => el.secretKey).join(",")}` + }); + } const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key); secretsToUpdate.forEach((el) => { diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index a9bba106c..4ccf3b1f4 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1444,7 +1444,7 @@ export const secretServiceFactory = ({ decryptedSecret.secretValue = expandedSecretValue || ""; } - return decryptedSecret; + return decryptedSecret as typeof decryptedSecret & { secretMetadata: undefined }; }; const createSecretRaw = async ({ diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 6a990f80e..7308f2fbf 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -4,6 +4,8 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.GET_SECRETS]: "List secrets", [EventType.GET_SECRET]: "Read secret", [EventType.DELETE_SECRETS]: "Delete secrets", + [EventType.CREATE_SECRETS]: "Create secrets", + [EventType.UPDATE_SECRETS]: "Update secrets", [EventType.CREATE_SECRET]: "Create secret", [EventType.UPDATE_SECRET]: "Update secret", [EventType.DELETE_SECRET]: "Delete secret", diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index 349811180..0da1eac02 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -19,6 +19,8 @@ export enum UserAgentType { export enum EventType { GET_SECRETS = "get-secrets", DELETE_SECRETS = "delete-secrets", + CREATE_SECRETS = "create-secrets", + UPDATE_SECRETS = "update-secrets", GET_SECRET = "get-secret", CREATE_SECRET = "create-secret", UPDATE_SECRET = "update-secret", From 800d2c045452d912931eec660c097a5a4d692101 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Fri, 31 Jan 2025 17:38:58 -0800 Subject: [PATCH 2/3] improvement: add secret metadata type --- .../ee/services/audit-log/audit-log-types.ts | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index d526e0ca3..df68fcf71 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -317,6 +317,8 @@ interface GetSecretsEvent { }; } +type TSecretMetadata = { key: string; value: string }[]; + interface GetSecretEvent { type: EventType.GET_SECRET; metadata: { @@ -325,7 +327,7 @@ interface GetSecretEvent { secretId: string; secretKey: string; secretVersion: number; - secretMetadata?: unknown; + secretMetadata?: TSecretMetadata; }; } @@ -337,7 +339,7 @@ interface CreateSecretEvent { secretId: string; secretKey: string; secretVersion: number; - secretMetadata?: unknown; + secretMetadata?: TSecretMetadata; }; } @@ -346,7 +348,12 @@ interface CreateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: unknown }>; + secrets: Array<{ + secretId: string; + secretKey: string; + secretVersion: number; + secretMetadata?: TSecretMetadata; + }>; }; } @@ -358,7 +365,7 @@ interface UpdateSecretEvent { secretId: string; secretKey: string; secretVersion: number; - secretMetadata?: unknown; + secretMetadata?: TSecretMetadata; }; } @@ -367,7 +374,7 @@ interface UpdateSecretBatchEvent { metadata: { environment: string; secretPath: string; - secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: unknown }>; + secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: TSecretMetadata }>; }; } From 624be8076816220c47b3e56498255031211447dd Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Thu, 6 Feb 2025 08:25:39 -0800 Subject: [PATCH 3/3] improvement: address feedback --- backend/src/services/secret/secret-service.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 4ccf3b1f4..41026b16a 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1444,7 +1444,7 @@ export const secretServiceFactory = ({ decryptedSecret.secretValue = expandedSecretValue || ""; } - return decryptedSecret as typeof decryptedSecret & { secretMetadata: undefined }; + return { secretMetadata: undefined, ...decryptedSecret }; }; const createSecretRaw = async ({