From eb2553270bd21741ccd7697b2abf7e3e35e75d40 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Mon, 10 Nov 2025 21:23:02 +0800 Subject: [PATCH] misc: added audit logs --- .../ee/services/audit-log/audit-log-types.ts | 13 ++++++++++ .../routes/v1/certificate-profiles-router.ts | 26 ++++++++++++++++--- .../certificate-profile-service.ts | 3 ++- .../src/hooks/api/auditLogs/constants.tsx | 13 +++++++++- frontend/src/hooks/api/auditLogs/enums.tsx | 12 ++++++++- 5 files changed, 61 insertions(+), 6 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 0b45544e3..bcc2a0770 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -371,6 +371,7 @@ export enum EventType { SIGN_CERTIFICATE_FROM_PROFILE = "sign-certificate-from-profile", ORDER_CERTIFICATE_FROM_PROFILE = "order-certificate-from-profile", RENEW_CERTIFICATE = "renew-certificate", + GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE = "get-certificate-profile-latest-active-bundle", UPDATE_CERTIFICATE_RENEWAL_CONFIG = "update-certificate-renewal-config", DISABLE_CERTIFICATE_RENEWAL_CONFIG = "disable-certificate-renewal-config", ATTEMPT_CREATE_SLACK_INTEGRATION = "attempt-create-slack-integration", @@ -2752,6 +2753,17 @@ interface OrderCertificateFromProfile { }; } +interface GetCertificateProfileLatestActiveBundle { + type: EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE; + metadata: { + certificateProfileId: string; + certificateId: string; + commonName: string; + profileName: string; + serialNumber: string; + }; +} + interface RenewCertificate { type: EventType.RENEW_CERTIFICATE; metadata: { @@ -4282,6 +4294,7 @@ export type Event = | DeleteCertificateProfile | GetCertificateProfile | ListCertificateProfiles + | GetCertificateProfileLatestActiveBundle | IssueCertificateFromProfile | SignCertificateFromProfile | OrderCertificateFromProfile diff --git a/backend/src/server/routes/v1/certificate-profiles-router.ts b/backend/src/server/routes/v1/certificate-profiles-router.ts index ecda1186a..5792c5e83 100644 --- a/backend/src/server/routes/v1/certificate-profiles-router.ts +++ b/backend/src/server/routes/v1/certificate-profiles-router.ts @@ -522,7 +522,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const bundle = await server.services.certificateProfile.getLatestActiveCertificateBundle({ + const response = await server.services.certificateProfile.getLatestActiveCertificateBundle({ actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, @@ -530,7 +530,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid profileId: req.params.id }); - if (!bundle) { + if (!response) { return { certificate: null, certificateChain: null, @@ -539,7 +539,27 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid }; } - return bundle; + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: response.certObj.projectId, + event: { + type: EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE, + metadata: { + certificateProfileId: response.profile.id, + certificateId: response.certObj.id, + commonName: response.certObj.commonName, + profileName: response.profile.slug, + serialNumber: response.certObj.serialNumber + } + } + }); + + return { + certificate: response.certificate, + certificateChain: response.certificateChain, + privateKey: response.privateKey, + serialNumber: response.certObj.serialNumber + }; } }); diff --git a/backend/src/services/certificate-profile/certificate-profile-service.ts b/backend/src/services/certificate-profile/certificate-profile-service.ts index d5e34eec1..66a23a0e7 100644 --- a/backend/src/services/certificate-profile/certificate-profile-service.ts +++ b/backend/src/services/certificate-profile/certificate-profile-service.ts @@ -835,7 +835,8 @@ export const certificateProfileServiceFactory = ({ certificate, certificateChain, privateKey, - serialNumber: cert.serialNumber + profile, + certObj: cert }; }; diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 33bc2107d..b465474e8 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -268,7 +268,18 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.PAM_RESOURCE_GET]: "PAM Resource Get", [EventType.PAM_RESOURCE_CREATE]: "PAM Resource Create", [EventType.PAM_RESOURCE_UPDATE]: "PAM Resource Update", - [EventType.PAM_RESOURCE_DELETE]: "PAM Resource Delete" + [EventType.PAM_RESOURCE_DELETE]: "PAM Resource Delete", + + [EventType.CREATE_CERTIFICATE_PROFILE]: "Create Certificate Profile", + [EventType.UPDATE_CERTIFICATE_PROFILE]: "Update Certificate Profile", + [EventType.DELETE_CERTIFICATE_PROFILE]: "Delete Certificate Profile", + [EventType.GET_CERTIFICATE_PROFILE]: "Get Certificate Profile", + [EventType.LIST_CERTIFICATE_PROFILES]: "List Certificate Profiles", + [EventType.ISSUE_CERTIFICATE_FROM_PROFILE]: "Issue Certificate From Profile", + [EventType.SIGN_CERTIFICATE_FROM_PROFILE]: "Sign Certificate From Profile", + [EventType.ORDER_CERTIFICATE_FROM_PROFILE]: "Order Certificate From Profile", + [EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE]: + "Get Certificate Profile Latest Active Bundle" }; export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = { diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index ea684a4bb..995d22624 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -260,5 +260,15 @@ export enum EventType { PAM_RESOURCE_GET = "pam-resource-get", PAM_RESOURCE_CREATE = "pam-resource-create", PAM_RESOURCE_UPDATE = "pam-resource-update", - PAM_RESOURCE_DELETE = "pam-resource-delete" + PAM_RESOURCE_DELETE = "pam-resource-delete", + + CREATE_CERTIFICATE_PROFILE = "create-certificate-profile", + UPDATE_CERTIFICATE_PROFILE = "update-certificate-profile", + DELETE_CERTIFICATE_PROFILE = "delete-certificate-profile", + GET_CERTIFICATE_PROFILE = "get-certificate-profile", + LIST_CERTIFICATE_PROFILES = "list-certificate-profiles", + ISSUE_CERTIFICATE_FROM_PROFILE = "issue-certificate-from-profile", + SIGN_CERTIFICATE_FROM_PROFILE = "sign-certificate-from-profile", + ORDER_CERTIFICATE_FROM_PROFILE = "order-certificate-from-profile", + GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE = "get-certificate-profile-latest-active-bundle" }