feat(secret-approval): added new audit log and subscription on policy creation

backend/src/controllers/v1/secretApprovalRequestsController.ts

@@ -9,6 +9,8 @@ import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { ISecretApprovalPolicy, SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
 import { performSecretApprovalRequestMerge } from "../../services/SecretApprovalService";
 import { Types } from "mongoose";
+import { EEAuditLogService } from "../../ee/services";
+import { EventType } from "../../ee/models";
 
 export const getSecretApprovalRequests = async (req: Request, res: Response) => {
   const {
@@ -31,6 +33,7 @@ export const getSecretApprovalRequests = async (req: Request, res: Response) =>
     {
       $match: query
     },
+    { $sort: { createdAt: -1 } },
     {
       $lookup: {
         from: SecretApprovalPolicy.collection.name,
@@ -234,5 +237,37 @@ export const updateSecretApprovalRequestStatus = async (req: Request, res: Respo
     { status, statusChangeBy: membership._id },
     { new: true }
   );
+
+  if (status === "close") {
+    await EEAuditLogService.createAuditLog(
+      req.authData,
+      {
+        type: EventType.SECRET_APPROVAL_CLOSED,
+        metadata: {
+          closedBy: membership._id.toString(),
+          secretApprovalRequestId: id,
+          secretApprovalRequestSlug: secretApprovalRequest.slug
+        }
+      },
+      {
+        workspaceId: secretApprovalRequest.workspace
+      }
+    );
+  } else {
+    await EEAuditLogService.createAuditLog(
+      req.authData,
+      {
+        type: EventType.SECRET_APPROVAL_REOPENED,
+        metadata: {
+          reopenedBy: membership._id.toString(),
+          secretApprovalRequestId: id,
+          secretApprovalRequestSlug: secretApprovalRequest.slug
+        }
+      },
+      {
+        workspaceId: secretApprovalRequest.workspace
+      }
+    );
+  }
   return res.send({ approval: updatedRequest });
 };

backend/src/controllers/v3/secretsController.ts

@@ -595,14 +595,17 @@ export const createSecret = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Create
   });
 
+
+  if (membership  && type !== "personal") {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership  && type !== "personal") {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
         secretPath,
         policy: secretApprovalPolicy,
         commiterMembershipId: membership._id.toString(),
+        authData:req.authData,
         data: {
           [CommitType.CREATE]: [
             {
@@ -623,6 +626,7 @@ export const createSecret = async (req: Request, res: Response) => {
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const secret = await SecretService.createSecret({
     secretName,
@@ -700,14 +704,16 @@ export const updateSecretByName = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Edit
   });
 
+  if (membership  && type !== "personal") {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership && type !== "personal") {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
         secretPath,
         policy: secretApprovalPolicy,
         commiterMembershipId: membership._id.toString(),
+        authData: req.authData,
         data: {
           [CommitType.UPDATE]: [
             {
@@ -730,6 +736,7 @@ export const updateSecretByName = async (req: Request, res: Response) => {
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const secret = await SecretService.updateSecret({
     secretName,
@@ -784,12 +791,14 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Delete
   });
 
+  if (membership  && type !== "personal") {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership && type !== "personal") {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
         secretPath,
+        authData: req.authData,
         policy: secretApprovalPolicy,
         commiterMembershipId: membership._id.toString(),
         data: {
@@ -802,6 +811,7 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const { secret } = await SecretService.deleteSecret({
     secretName,
@@ -838,12 +848,14 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Create
   });
 
+  if (membership) {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership) {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
         secretPath,
+        authData: req.authData,
         policy: secretApprovalPolicy,
         commiterMembershipId: membership._id.toString(),
         data: {
@@ -852,6 +864,7 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const createdSecrets = await SecretService.createSecretBatch({
     secretPath,
@@ -879,8 +892,9 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Edit
   });
 
+  if (membership) {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership) {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
@@ -889,10 +903,12 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
         commiterMembershipId: membership._id.toString(),
         data: {
           [CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
-      }
+        },
+        authData: req.authData
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const updatedSecrets = await SecretService.updateSecretBatch({
     secretPath,
@@ -920,8 +936,10 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Delete
   });
   
+
+  if (membership) {
     const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  if (secretApprovalPolicy && membership) {
+    if (secretApprovalPolicy) {
       const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
@@ -930,10 +948,12 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
         commiterMembershipId: membership._id.toString(),
         data: {
           [CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
-      }
+        },
+        authData: req.authData
       });
       return res.send({ approval: secretApprovalRequest });
     }
+  }
 
   const deletedSecrets = await SecretService.deleteSecretBatch({
     secretPath,

backend/src/ee/models/auditLog/enums.ts

@@ -50,5 +50,9 @@ export enum EventType {
   UPDATE_SECRET_IMPORT = "update-secret-import",
   DELETE_SECRET_IMPORT = "delete-secret-import",
   UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
-    UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
+  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions",
+  SECRET_APPROVAL_MERGED = "secret-approval-merged",
+  SECRET_APPROVAL_REQUEST = "secret-approval-request",
+  SECRET_APPROVAL_CLOSED = "secret-approval-closed",
+  SECRET_APPROVAL_REOPENED = "secret-approval-reopened"
 }

backend/src/ee/models/auditLog/types.ts

@@ -437,6 +437,41 @@ interface UpdateUserDeniedPermissions {
         }[]
     }
 }
+interface SecretApprovalMerge {
+  type: EventType.SECRET_APPROVAL_MERGED;
+  metadata: {
+    mergedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalClosed {
+  type: EventType.SECRET_APPROVAL_CLOSED;
+  metadata: {
+    closedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalReopened {
+  type: EventType.SECRET_APPROVAL_REOPENED;
+  metadata: {
+    reopenedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
+
+interface SecretApprovalRequest {
+  type: EventType.SECRET_APPROVAL_REQUEST;
+  metadata: {
+    committedBy: string;
+    secretApprovalRequestSlug: string;
+    secretApprovalRequestId: string;
+  };
+}
 
 export type Event =
   | GetSecretsEvent
@@ -476,4 +511,8 @@ export type Event =
   | UpdateSecretImportEvent
   | DeleteSecretImportEvent
   | UpdateUserRole
-    | UpdateUserDeniedPermissions;
+  | UpdateUserDeniedPermissions
+  | SecretApprovalMerge
+  | SecretApprovalClosed
+  | SecretApprovalRequest
+  | SecretApprovalReopened;

backend/src/models/secretApprovalRequest.ts

@@ -1,4 +1,5 @@
 import { Schema, Types, model } from "mongoose";
+import { customAlphabet } from "nanoid";
 import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64, ENCODING_SCHEME_UTF8 } from "../variables";
 
 export enum ApprovalStatus {
@@ -13,6 +14,9 @@ export enum CommitType {
   CREATE = "create"
 }
 
+const SLUG_ALPHABETS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+const nanoId = customAlphabet(SLUG_ALPHABETS, 10);
+
 export interface ISecretApprovalSecChange {
   _id: Types.ObjectId;
   version: number;
@@ -54,6 +58,7 @@ export type ISecretCommits<T = Types.ObjectId, J = Types.ObjectId> = Array<
 export interface ISecretApprovalRequest {
   _id: Types.ObjectId;
   committer: Types.ObjectId;
+  slug: string;
   statusChangeBy: Types.ObjectId;
   reviewers: {
     member: Types.ObjectId;
@@ -143,6 +148,10 @@ const secretApprovalRequestSchema = new Schema<ISecretApprovalRequest>(
       required: true,
       default: "root"
     },
+    slug: {
+      type: String,
+      default: () => nanoId()
+    },
     reviewers: {
       type: [
         {

backend/src/services/SecretApprovalService.ts

@@ -96,6 +96,7 @@ type TGenerateSecretApprovalRequestArg = {
     [CommitType.DELETE]?: { secretName: string }[];
   };
   commiterMembershipId: string;
+  authData: AuthData;
 };
 
 export const generateSecretApprovalRequest = async ({
@@ -104,7 +105,8 @@ export const generateSecretApprovalRequest = async ({
   secretPath,
   policy,
   data,
-  commiterMembershipId
+  commiterMembershipId,
+  authData
 }: TGenerateSecretApprovalRequestArg) => {
   // calculate folder id from secret path
   let folderId = "root";
@@ -313,6 +315,22 @@ export const generateSecretApprovalRequest = async ({
     committer: commiterMembershipId
   });
   await secretApprovalRequest.save();
+
+  await EEAuditLogService.createAuditLog(
+    authData,
+    {
+      type: EventType.SECRET_APPROVAL_REQUEST,
+      metadata: {
+        committedBy: commiterMembershipId,
+        secretApprovalRequestId: secretApprovalRequest._id.toString(),
+        secretApprovalRequestSlug: secretApprovalRequest.slug
+      }
+    },
+    {
+      workspaceId: secretApprovalRequest.workspace
+    }
+  );
+
   return secretApprovalRequest;
 };
 
@@ -436,26 +454,6 @@ export const performSecretApprovalRequestMerge = async (
           })
       )
     });
-
-    // question to team where to keep secretKey
-    await EEAuditLogService.createAuditLog(
-      authData,
-      {
-        type: EventType.CREATE_SECRETS,
-        metadata: {
-          environment,
-          secretPath: "/",
-          secrets: newlyCreatedSecrets.map(({ version, _id }) => ({
-            secretId: _id.toString(),
-            secretKey: "",
-            secretVersion: version
-          }))
-        }
-      },
-      {
-        workspaceId
-      }
-    );
   }
 
   const secretUpdationCommits = secretApprovalRequest.commits.filter(
@@ -570,25 +568,6 @@ export const performSecretApprovalRequestMerge = async (
         });
       })
     });
-
-    await EEAuditLogService.createAuditLog(
-      authData,
-      {
-        type: EventType.UPDATE_SECRETS,
-        metadata: {
-          environment,
-          secretPath: "/",
-          secrets: nonConflictSecrets.map(({ secret }) => ({
-            secretId: secret._id.toString(),
-            secretKey: "",
-            secretVersion: secret.version + 1
-          }))
-        }
-      },
-      {
-        workspaceId
-      }
-    );
   }
 
   const secretDeletionCommits = secretApprovalRequest.commits.filter(
@@ -614,25 +593,6 @@ export const performSecretApprovalRequestMerge = async (
     await EESecretService.markDeletedSecretVersions({
       secretIds: secretDeletionCommits.map(({ secret }) => secret._id)
     });
-
-    await EEAuditLogService.createAuditLog(
-      authData,
-      {
-        type: EventType.DELETE_SECRETS,
-        metadata: {
-          environment,
-          secretPath: "/",
-          secrets: secretDeletionCommits.map(({ secret: { _id, version } }) => ({
-            secretId: _id.toString(),
-            secretKey: "",
-            secretVersion: version
-          }))
-        }
-      },
-      {
-        workspaceId
-      }
-    );
   }
 
   const updatedSecretApproval = await SecretApprovalRequest.findByIdAndUpdate(
@@ -671,5 +631,21 @@ export const performSecretApprovalRequestMerge = async (
     folderId
   });
 
+  // question to team where to keep secretKey
+  await EEAuditLogService.createAuditLog(
+    authData,
+    {
+      type: EventType.SECRET_APPROVAL_MERGED,
+      metadata: {
+        mergedBy: userMembershipId,
+        secretApprovalRequestId: id,
+        secretApprovalRequestSlug: secretApprovalRequest.slug
+      }
+    },
+    {
+      workspaceId
+    }
+  );
+
   return updatedSecretApproval;
 };

frontend/src/hooks/api/secretApprovalRequest/types.ts

@@ -47,6 +47,7 @@ export type TSecretApprovalRequest<
   J extends unknown = EncryptedSecret
 > = {
   _id: string;
+  slug: string;
   createdAt: string;
   committer: string;
   reviewers: {

frontend/src/hooks/api/subscriptions/types.ts

@@ -11,12 +11,21 @@ export type SubscriptionPlan = {
   rbac: boolean;
   secretVersioning: boolean;
   slug: string;
+  secretApproval: string;
   tier: number;
   workspaceLimit: number;
   workspacesUsed: number;
   environmentLimit: number;
   samlSSO: boolean;
-  status: "incomplete" | "incomplete_expired" | "trialing" | "active" | "past_due" | "canceled" | "unpaid" | null;
+  status:
+    | "incomplete"
+    | "incomplete_expired"
+    | "trialing"
+    | "active"
+    | "past_due"
+    | "canceled"
+    | "unpaid"
+    | null;
   trial_end: number | null;
   has_used_trial: boolean;
 };

frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/SecretApprovalPolicyList.tsx

@@ -14,9 +14,15 @@ import {
   Td,
   Th,
   THead,
-  Tr
+  Tr,
+  UpgradePlanModal
 } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  useProjectPermission,
+  useSubscription
+} from "@app/context";
 import { usePopUp } from "@app/hooks";
 import {
   useDeleteSecretApprovalPolicy,
@@ -35,9 +41,11 @@ type Props = {
 export const SecretApprovalPolicyList = ({ workspaceId }: Props) => {
   const { handlePopUpToggle, handlePopUpOpen, handlePopUpClose, popUp } = usePopUp([
     "secretPolicyForm",
-    "deletePolicy"
+    "deletePolicy",
+    "upgradePlan"
   ] as const);
   const permission = useProjectPermission();
+  const { subscription } = useSubscription();
   const { createNotification } = useNotificationContext();
 
   const { data: members } = useGetWorkspaceUsers(workspaceId);
@@ -87,7 +95,13 @@ export const SecretApprovalPolicyList = ({ workspaceId }: Props) => {
           >
             {(isAllowed) => (
               <Button
-                onClick={() => handlePopUpOpen("secretPolicyForm")}
+                onClick={() => {
+                  if (subscription && !subscription?.secretApproval) {
+                    handlePopUpOpen("upgradePlan");
+                    return;
+                  }
+                  handlePopUpOpen("secretPolicyForm");
+                }}
                 leftIcon={<FontAwesomeIcon icon={faPlus} />}
                 isDisabled={!isAllowed}
               >
@@ -147,6 +161,11 @@ export const SecretApprovalPolicyList = ({ workspaceId }: Props) => {
         onChange={(isOpen) => handlePopUpToggle("deletePolicy", isOpen)}
         onDeleteApproved={handleDeletePolicy}
       />
+      <UpgradePlanModal
+        isOpen={popUp.upgradePlan.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
+        text="You can add secret approval policy if you switch to Infisical's Team plan."
+      />
     </div>
   );
 };

frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/SecretApprovalRequest.tsx

@@ -213,6 +213,7 @@ export const SecretApprovalRequest = () => {
                       <div className="mb-1">
                         <FontAwesomeIcon icon={faCodeBranch} className="mr-2" />
                         {generateCommitText(commits)}
+                        <span className="text-xs text-bunker-300"> #{secretApproval.slug}</span>
                       </div>
                       <span className="text-xs text-gray-500">
                         Opened {formatDistance(new Date(createdAt), new Date())} ago by{" "}

frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx

@@ -139,9 +139,11 @@ export const SecretApprovalRequestChanges = ({
   };
 
   if (isSecretApprovalRequestLoading) {
+    return (
       <div>
         <ContentLoader />
-    </div>;
+      </div>
+    );
   }
 
   if (!isSecretApprovalRequestSuccess)

frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx

@@ -245,7 +245,7 @@ export const SecretListView = ({
         });
       }
     },
-    [environment, secretPath]
+    [environment, secretPath, isProtectedBranch]
   );
 
   const handleSecretDelete = useCallback(async () => {