awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-12 00:29:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(audit-log-stream): frontend rework + some backend changes

Browse Source
This commit is contained in:
x032205
2025-09-04 22:14:11 -04:00
parent fcb931670a
commit d534e82646
36 changed files with 1664 additions and 490 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/audit-log-stream-routers/index.ts
+14 -11
View File
@@ -1,15 +1,18 @@
import { LogProvider } from "@app/ee/services/audit-log-stream/audit-log-stream-enums";
import {
CustomProviderSchema,
SanitizedCustomProviderSchema
CreateCustomProviderLogStreamSchema,
SanitizedCustomProviderSchema,
UpdateCustomProviderLogStreamSchema
} from "@app/ee/services/audit-log-stream/custom/custom-provider-schemas";
import {
DatadogProviderSchema,
SanitizedDatadogProviderSchema
CreateDatadogProviderLogStreamSchema,
SanitizedDatadogProviderSchema,
UpdateDatadogProviderLogStreamSchema
} from "@app/ee/services/audit-log-stream/datadog/datadog-provider-schemas";
import {
CreateSplunkProviderLogStreamSchema,
SanitizedSplunkProviderSchema,
SplunkProviderSchema
UpdateSplunkProviderLogStreamSchema
} from "@app/ee/services/audit-log-stream/splunk/splunk-provider-schemas";
import { registerAuditLogStreamEndpoints } from "./audit-log-stream-endpoints";
@@ -23,8 +26,8 @@ export const AUDIT_LOG_STREAM_REGISTER_ROUTER_MAP: Record<LogProvider, (server:
server,
provider: LogProvider.Custom,
sanitizedResponseSchema: SanitizedCustomProviderSchema,
createSchema: CustomProviderSchema,
updateSchema: CustomProviderSchema
createSchema: CreateCustomProviderLogStreamSchema,
updateSchema: UpdateCustomProviderLogStreamSchema
});
},
[LogProvider.Datadog]: async (server: FastifyZodProvider) => {
@@ -32,8 +35,8 @@ export const AUDIT_LOG_STREAM_REGISTER_ROUTER_MAP: Record<LogProvider, (server:
server,
provider: LogProvider.Datadog,
sanitizedResponseSchema: SanitizedDatadogProviderSchema,
createSchema: DatadogProviderSchema,
updateSchema: DatadogProviderSchema
createSchema: CreateDatadogProviderLogStreamSchema,
updateSchema: UpdateDatadogProviderLogStreamSchema
});
},
[LogProvider.Splunk]: async (server: FastifyZodProvider) => {
@@ -41,8 +44,8 @@ export const AUDIT_LOG_STREAM_REGISTER_ROUTER_MAP: Record<LogProvider, (server:
server,
provider: LogProvider.Splunk,
sanitizedResponseSchema: SanitizedSplunkProviderSchema,
createSchema: SplunkProviderSchema,
updateSchema: SplunkProviderSchema
createSchema: CreateSplunkProviderLogStreamSchema,
updateSchema: UpdateSplunkProviderLogStreamSchema
});
}
};
backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts
+1 -1
View File
@@ -8,7 +8,7 @@ import { getDatadogProviderListItem } from "./datadog/datadog-provider-fns";
import { getSplunkProviderListItem } from "./splunk/splunk-provider-fns";
export const listProviderOptions = () => {
return [getCustomProviderListItem(), getDatadogProviderListItem(), getSplunkProviderListItem()].sort((a, b) =>
return [getDatadogProviderListItem(), getSplunkProviderListItem(), getCustomProviderListItem()].sort((a, b) =>
a.name.localeCompare(b.name)
);
};
backend/src/ee/services/audit-log-stream/audit-log-stream-schemas.ts
+14
View File
@@ -0,0 +1,14 @@
import { AuditLogStreamsSchema } from "@app/db/schemas";
export const BaseProviderSchema = AuditLogStreamsSchema.omit({
encryptedCredentials: true,
provider: true,
// Old "archived" values
encryptedHeadersAlgorithm: true,
encryptedHeadersCiphertext: true,
encryptedHeadersIV: true,
encryptedHeadersKeyEncoding: true,
encryptedHeadersTag: true,
url: true
});
backend/src/ee/services/audit-log-stream/custom/custom-provider-schemas.ts
+13 -4
View File
@@ -1,6 +1,7 @@
import { z } from "zod";
import { LogProvider } from "../audit-log-stream-enums";
import { BaseProviderSchema } from "../audit-log-stream-schemas";
export const CustomProviderCredentialsSchema = z.object({
url: z.string().url().trim().min(1).max(255),
@@ -12,13 +13,13 @@ export const CustomProviderCredentialsSchema = z.object({
.array()
});
export const CustomProviderSchema = z.object({
provider: z.literal(LogProvider.Custom),
const BaseCustomProviderSchema = BaseProviderSchema.extend({ provider: z.literal(LogProvider.Custom) });
export const CustomProviderSchema = BaseCustomProviderSchema.extend({
credentials: CustomProviderCredentialsSchema
});
export const SanitizedCustomProviderSchema = z.object({
provider: z.literal(LogProvider.Custom),
export const SanitizedCustomProviderSchema = BaseCustomProviderSchema.extend({
credentials: z.object({
url: CustomProviderCredentialsSchema.shape.url,
// Only return header keys
@@ -30,3 +31,11 @@ export const CustomProviderListItemSchema = z.object({
name: z.literal("Custom"),
provider: z.literal(LogProvider.Custom)
});
export const CreateCustomProviderLogStreamSchema = z.object({
credentials: CustomProviderCredentialsSchema
});
export const UpdateCustomProviderLogStreamSchema = z.object({
credentials: CustomProviderCredentialsSchema
});
backend/src/ee/services/audit-log-stream/datadog/datadog-provider-factory.ts
+25 -18
View File
@@ -1,5 +1,6 @@
import { RawAxiosRequestHeaders } from "axios";
import { getConfig } from "@app/lib/config/env";
import { request } from "@app/lib/config/request";
import { BadRequestError } from "@app/lib/errors";
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
@@ -8,6 +9,20 @@ import { AUDIT_LOG_STREAM_TIMEOUT } from "../../audit-log/audit-log-queue";
import { TLogStreamFactoryStreamLog, TLogStreamFactoryValidateCredentials } from "../audit-log-stream-types";
import { TDatadogProviderCredentials } from "./datadog-provider-types";
function createPayload(event: Record<string, unknown>) {
const appCfg = getConfig();
const ddtags = [`env:${appCfg.NODE_ENV || "unknown"}`].join(",");
return {
...event,
hostname: new URL(appCfg.SITE_URL || "http://infisical").hostname,
ddsource: "infisical",
service: "infisical",
ddtags
};
}
export const DatadogProviderFactory = () => {
const validateCredentials: TLogStreamFactoryValidateCredentials<TDatadogProviderCredentials> = async ({
credentials
@@ -19,15 +34,11 @@ export const DatadogProviderFactory = () => {
const streamHeaders: RawAxiosRequestHeaders = { "Content-Type": "application/json", "DD-API-KEY": token };
await request
.post(
url,
{ ping: "ok" },
{
headers: streamHeaders,
timeout: AUDIT_LOG_STREAM_TIMEOUT,
signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
}
)
.post(url, createPayload({ ping: "ok" }), {
headers: streamHeaders,
timeout: AUDIT_LOG_STREAM_TIMEOUT,
signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
})
.catch((err) => {
throw new BadRequestError({ message: `Failed to connect with Datadog: ${(err as Error)?.message}` });
});
@@ -42,15 +53,11 @@ export const DatadogProviderFactory = () => {
const streamHeaders: RawAxiosRequestHeaders = { "Content-Type": "application/json", "DD-API-KEY": token };
await request.post(
url,
{ ...auditLog, ddsource: "infisical", service: "audit-logs" },
{
headers: streamHeaders,
timeout: AUDIT_LOG_STREAM_TIMEOUT,
signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
}
);
await request.post(url, createPayload(auditLog), {
headers: streamHeaders,
timeout: AUDIT_LOG_STREAM_TIMEOUT,
signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
});
};
return {
backend/src/ee/services/audit-log-stream/datadog/datadog-provider-schemas.ts
+13 -4
View File
@@ -2,6 +2,7 @@ import RE2 from "re2";
import { z } from "zod";
import { LogProvider } from "../audit-log-stream-enums";
import { BaseProviderSchema } from "../audit-log-stream-schemas";
export const DatadogProviderCredentialsSchema = z.object({
url: z.string().url().trim().min(1).max(255),
@@ -11,13 +12,13 @@ export const DatadogProviderCredentialsSchema = z.object({
.refine((val) => new RE2(/^[a-fA-F0-9]{32}$/).test(val), "Invalid Datadog API key format")
});
export const DatadogProviderSchema = z.object({
provider: z.literal(LogProvider.Datadog),
const BaseDatadogProviderSchema = BaseProviderSchema.extend({ provider: z.literal(LogProvider.Datadog) });
export const DatadogProviderSchema = BaseDatadogProviderSchema.extend({
credentials: DatadogProviderCredentialsSchema
});
export const SanitizedDatadogProviderSchema = z.object({
provider: z.literal(LogProvider.Datadog),
export const SanitizedDatadogProviderSchema = BaseDatadogProviderSchema.extend({
credentials: DatadogProviderCredentialsSchema.pick({
url: true
})
@@ -27,3 +28,11 @@ export const DatadogProviderListItemSchema = z.object({
name: z.literal("Datadog"),
provider: z.literal(LogProvider.Datadog)
});
export const CreateDatadogProviderLogStreamSchema = z.object({
credentials: DatadogProviderCredentialsSchema
});
export const UpdateDatadogProviderLogStreamSchema = z.object({
credentials: DatadogProviderCredentialsSchema
});
backend/src/ee/services/audit-log-stream/splunk/splunk-provider-schemas.ts
+39 -5
View File
@@ -1,19 +1,45 @@
import { z } from "zod";
import { LogProvider } from "../audit-log-stream-enums";
import { BaseProviderSchema } from "../audit-log-stream-schemas";
export const SplunkProviderCredentialsSchema = z.object({
hostname: z.string().url().trim().min(1).max(255),
hostname: z
.string()
.trim()
.min(1)
.max(255)
.superRefine((val, ctx) => {
if (val.includes("://")) {
ctx.addIssue({
code: "custom",
message: "Hostname should not include protocol"
});
return;
}
try {
const url = new URL(`https://${val}`);
if (url.hostname !== val) {
ctx.addIssue({
code: "custom",
message: "Must be a valid hostname without port or path"
});
}
} catch {
ctx.addIssue({ code: "custom", message: "Invalid hostname" });
}
}),
token: z.string().uuid().trim().min(1)
});
export const SplunkProviderSchema = z.object({
provider: z.literal(LogProvider.Splunk),
const BaseSplunkProviderSchema = BaseProviderSchema.extend({ provider: z.literal(LogProvider.Splunk) });
export const SplunkProviderSchema = BaseSplunkProviderSchema.extend({
credentials: SplunkProviderCredentialsSchema
});
export const SanitizedSplunkProviderSchema = z.object({
provider: z.literal(LogProvider.Splunk),
export const SanitizedSplunkProviderSchema = BaseSplunkProviderSchema.extend({
credentials: SplunkProviderCredentialsSchema.pick({
hostname: true
})
@@ -23,3 +49,11 @@ export const SplunkProviderListItemSchema = z.object({
name: z.literal("Splunk"),
provider: z.literal(LogProvider.Splunk)
});
export const CreateSplunkProviderLogStreamSchema = z.object({
credentials: SplunkProviderCredentialsSchema
});
export const UpdateSplunkProviderLogStreamSchema = z.object({
credentials: SplunkProviderCredentialsSchema
});