Skip to content

Commit 9fa74bc

Browse files
sheensantoscapadngansheensantoscapadngan
authored
Merge pull request #4554 from Infisical/misc/added-audit-logs-for-role-ops
misc: added audit logs for project and org role management operations
2 parents 31c1006 + b519d00 commit 9fa74bc

File tree

7 files changed

+307
-11
lines changed

7 files changed

+307
-11
lines changed

‎backend/src/ee/routes/v1/deprecated-project-role-router.ts‎

Lines changed: 59 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra";
22
import { z } from "zod";
33

44
import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas";
5+
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
56
import {
67
backfillPermissionV1SchemaToV2Schema,
78
ProjectPermissionV1Schema
@@ -50,6 +51,10 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
5051
},
5152
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
5253
handler: async (req) => {
54+
const stringifiedPermissions = JSON.stringify(
55+
packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true))
56+
);
57+
5358
const role = await server.services.projectRole.createRole({
5459
actorAuthMethod: req.permission.authMethod,
5560
actorId: req.permission.id,
@@ -61,7 +66,23 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
6166
},
6267
data: {
6368
...req.body,
64-
permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true)))
69+
permissions: stringifiedPermissions
70+
}
71+
});
72+
73+
await server.services.auditLog.createAuditLog({
74+
...req.auditLogInfo,
75+
orgId: req.permission.orgId,
76+
projectId: role.projectId,
77+
event: {
78+
type: EventType.CREATE_PROJECT_ROLE,
79+
metadata: {
80+
roleId: role.id,
81+
slug: req.body.slug,
82+
name: req.body.name,
83+
description: req.body.description,
84+
permissions: stringifiedPermissions
85+
}
6586
}
6687
});
6788

@@ -106,6 +127,10 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
106127
},
107128
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
108129
handler: async (req) => {
130+
const stringifiedPermissions = req.body.permissions
131+
? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true)))
132+
: undefined;
133+
109134
const role = await server.services.projectRole.updateRole({
110135
actorAuthMethod: req.permission.authMethod,
111136
actorId: req.permission.id,
@@ -114,11 +139,26 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
114139
roleId: req.params.roleId,
115140
data: {
116141
...req.body,
117-
permissions: req.body.permissions
118-
? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions, true)))
119-
: undefined
142+
permissions: stringifiedPermissions
143+
}
144+
});
145+
146+
await server.services.auditLog.createAuditLog({
147+
...req.auditLogInfo,
148+
orgId: req.permission.orgId,
149+
projectId: role.projectId,
150+
event: {
151+
type: EventType.UPDATE_PROJECT_ROLE,
152+
metadata: {
153+
roleId: role.id,
154+
slug: req.body.slug,
155+
name: req.body.name,
156+
description: req.body.description,
157+
permissions: stringifiedPermissions
158+
}
120159
}
121160
});
161+
122162
return { role };
123163
}
124164
});
@@ -155,6 +195,21 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
155195
actor: req.permission.type,
156196
roleId: req.params.roleId
157197
});
198+
199+
await server.services.auditLog.createAuditLog({
200+
...req.auditLogInfo,
201+
orgId: req.permission.orgId,
202+
projectId: role.projectId,
203+
event: {
204+
type: EventType.DELETE_PROJECT_ROLE,
205+
metadata: {
206+
roleId: role.id,
207+
slug: role.slug,
208+
name: role.name
209+
}
210+
}
211+
});
212+
158213
return { role };
159214
}
160215
});

‎backend/src/ee/routes/v1/org-role-router.ts‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import { z } from "zod";
22

33
import { OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
4+
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
45
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
56
import { slugSchema } from "@app/server/lib/schemas";
67
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -42,6 +43,22 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
4243
req.permission.authMethod,
4344
req.permission.orgId
4445
);
46+
47+
await server.services.auditLog.createAuditLog({
48+
...req.auditLogInfo,
49+
orgId: req.permission.orgId,
50+
event: {
51+
type: EventType.CREATE_ORG_ROLE,
52+
metadata: {
53+
roleId: role.id,
54+
slug: req.body.slug,
55+
name: req.body.name,
56+
description: req.body.description,
57+
permissions: JSON.stringify(req.body.permissions)
58+
}
59+
}
60+
});
61+
4562
return { role };
4663
}
4764
});
@@ -116,6 +133,22 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
116133
req.permission.authMethod,
117134
req.permission.orgId
118135
);
136+
137+
await server.services.auditLog.createAuditLog({
138+
...req.auditLogInfo,
139+
orgId: req.permission.orgId,
140+
event: {
141+
type: EventType.UPDATE_ORG_ROLE,
142+
metadata: {
143+
roleId: role.id,
144+
slug: req.body.slug,
145+
name: req.body.name,
146+
description: req.body.description,
147+
permissions: req.body.permissions ? JSON.stringify(req.body.permissions) : undefined
148+
}
149+
}
150+
});
151+
119152
return { role };
120153
}
121154
});
@@ -146,6 +179,16 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
146179
req.permission.authMethod,
147180
req.permission.orgId
148181
);
182+
183+
await server.services.auditLog.createAuditLog({
184+
...req.auditLogInfo,
185+
orgId: req.permission.orgId,
186+
event: {
187+
type: EventType.DELETE_ORG_ROLE,
188+
metadata: { roleId: role.id, slug: role.slug, name: role.name }
189+
}
190+
});
191+
149192
return { role };
150193
}
151194
});

‎backend/src/ee/routes/v1/project-role-router.ts‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra";
22
import { z } from "zod";
33

44
import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas";
5+
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
56
import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
67
import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
78
import { ApiDocsTags, PROJECT_ROLE } from "@app/lib/api-docs";
@@ -52,6 +53,8 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
5253
},
5354
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
5455
handler: async (req) => {
56+
const stringifiedPermissions = JSON.stringify(packRules(req.body.permissions));
57+
5558
const role = await server.services.projectRole.createRole({
5659
actorAuthMethod: req.permission.authMethod,
5760
actorId: req.permission.id,
@@ -63,9 +66,26 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
6366
},
6467
data: {
6568
...req.body,
66-
permissions: JSON.stringify(packRules(req.body.permissions))
69+
permissions: stringifiedPermissions
70+
}
71+
});
72+
73+
await server.services.auditLog.createAuditLog({
74+
...req.auditLogInfo,
75+
orgId: req.permission.orgId,
76+
projectId: role.projectId,
77+
event: {
78+
type: EventType.CREATE_PROJECT_ROLE,
79+
metadata: {
80+
roleId: role.id,
81+
slug: req.body.slug,
82+
name: req.body.name,
83+
description: req.body.description,
84+
permissions: stringifiedPermissions
85+
}
6786
}
6887
});
88+
6989
return { role };
7090
}
7191
});
@@ -112,6 +132,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
112132
},
113133
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
114134
handler: async (req) => {
135+
const stringifiedPermissions = req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined;
115136
const role = await server.services.projectRole.updateRole({
116137
actorAuthMethod: req.permission.authMethod,
117138
actorId: req.permission.id,
@@ -120,9 +141,26 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
120141
roleId: req.params.roleId,
121142
data: {
122143
...req.body,
123-
permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
144+
permissions: stringifiedPermissions
124145
}
125146
});
147+
148+
await server.services.auditLog.createAuditLog({
149+
...req.auditLogInfo,
150+
orgId: req.permission.orgId,
151+
projectId: role.projectId,
152+
event: {
153+
type: EventType.UPDATE_PROJECT_ROLE,
154+
metadata: {
155+
roleId: role.id,
156+
slug: req.body.slug,
157+
name: req.body.name,
158+
description: req.body.description,
159+
permissions: stringifiedPermissions
160+
}
161+
}
162+
});
163+
126164
return { role };
127165
}
128166
});
@@ -161,6 +199,21 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
161199
actor: req.permission.type,
162200
roleId: req.params.roleId
163201
});
202+
203+
await server.services.auditLog.createAuditLog({
204+
...req.auditLogInfo,
205+
orgId: req.permission.orgId,
206+
projectId: role.projectId,
207+
event: {
208+
type: EventType.DELETE_PROJECT_ROLE,
209+
metadata: {
210+
roleId: role.id,
211+
slug: role.slug,
212+
name: role.name
213+
}
214+
}
215+
});
216+
164217
return { role };
165218
}
166219
});

‎backend/src/ee/routes/v2/deprecated-project-role-router.ts‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { packRules } from "@casl/ability/extra";
22
import { z } from "zod";
33

44
import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas";
5+
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
56
import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
67
import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
78
import { ApiDocsTags, PROJECT_ROLE } from "@app/lib/api-docs";
@@ -52,6 +53,8 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
5253
},
5354
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
5455
handler: async (req) => {
56+
const stringifiedPermissions = JSON.stringify(packRules(req.body.permissions));
57+
5558
const role = await server.services.projectRole.createRole({
5659
actorAuthMethod: req.permission.authMethod,
5760
actorId: req.permission.id,
@@ -63,9 +66,26 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
6366
},
6467
data: {
6568
...req.body,
66-
permissions: JSON.stringify(packRules(req.body.permissions))
69+
permissions: stringifiedPermissions
70+
}
71+
});
72+
73+
await server.services.auditLog.createAuditLog({
74+
...req.auditLogInfo,
75+
orgId: req.permission.orgId,
76+
projectId: role.projectId,
77+
event: {
78+
type: EventType.CREATE_PROJECT_ROLE,
79+
metadata: {
80+
roleId: role.id,
81+
slug: req.body.slug,
82+
name: req.body.name,
83+
description: req.body.description,
84+
permissions: stringifiedPermissions
85+
}
6786
}
6887
});
88+
6989
return { role };
7090
}
7191
});
@@ -112,6 +132,7 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
112132
},
113133
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
114134
handler: async (req) => {
135+
const stringifiedPermissions = req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined;
115136
const role = await server.services.projectRole.updateRole({
116137
actorAuthMethod: req.permission.authMethod,
117138
actorId: req.permission.id,
@@ -120,9 +141,26 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
120141
roleId: req.params.roleId,
121142
data: {
122143
...req.body,
123-
permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
144+
permissions: stringifiedPermissions
124145
}
125146
});
147+
148+
await server.services.auditLog.createAuditLog({
149+
...req.auditLogInfo,
150+
orgId: req.permission.orgId,
151+
projectId: role.projectId,
152+
event: {
153+
type: EventType.UPDATE_PROJECT_ROLE,
154+
metadata: {
155+
roleId: role.id,
156+
slug: req.body.slug,
157+
name: req.body.name,
158+
description: req.body.description,
159+
permissions: stringifiedPermissions
160+
}
161+
}
162+
});
163+
126164
return { role };
127165
}
128166
});
@@ -161,6 +199,21 @@ export const registerDeprecatedProjectRoleRouter = async (server: FastifyZodProv
161199
actor: req.permission.type,
162200
roleId: req.params.roleId
163201
});
202+
203+
await server.services.auditLog.createAuditLog({
204+
...req.auditLogInfo,
205+
orgId: req.permission.orgId,
206+
projectId: role.projectId,
207+
event: {
208+
type: EventType.DELETE_PROJECT_ROLE,
209+
metadata: {
210+
roleId: role.id,
211+
slug: role.slug,
212+
name: role.name
213+
}
214+
}
215+
});
216+
164217
return { role };
165218
}
166219
});

0 commit comments

Comments
 (0)