132 lines
3.6 KiB
TypeScript
132 lines
3.6 KiB
TypeScript
import { count, desc, inArray, like, or } from "drizzle-orm";
|
|
import { AdminAuditLog, db, User } from "@/lib/db";
|
|
|
|
interface AuditEntry {
|
|
userId: number;
|
|
action: string;
|
|
target: string;
|
|
targetId?: number;
|
|
before?: Record<string, unknown>;
|
|
after?: Record<string, unknown>;
|
|
}
|
|
|
|
const SENSITIVE_KEY_RE =
|
|
/password|secret|token|otp|recovery|authTicket|two_factor|two_factor_secret|api_key/i;
|
|
const REDACTED = "[Redacted]";
|
|
|
|
function sanitizeAuditPayload(value: unknown, depth = 0): unknown {
|
|
if (depth > 6 || value == null) return value;
|
|
if (Array.isArray(value))
|
|
return value.map((v) => sanitizeAuditPayload(v, depth + 1));
|
|
if (typeof value !== "object") return value;
|
|
|
|
const out: Record<string, unknown> = {};
|
|
for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
|
|
out[key] = SENSITIVE_KEY_RE.test(key)
|
|
? REDACTED
|
|
: sanitizeAuditPayload(val, depth + 1);
|
|
}
|
|
return out;
|
|
}
|
|
|
|
function computeDiff(
|
|
before?: Record<string, unknown>,
|
|
after?: Record<string, unknown>,
|
|
): Record<string, { from: unknown; to: unknown }> | null {
|
|
if (!before || !after) return null;
|
|
|
|
const diff: Record<string, { from: unknown; to: unknown }> = {};
|
|
const allKeys = new Set([...Object.keys(before), ...Object.keys(after)]);
|
|
|
|
for (const key of allKeys) {
|
|
if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
|
|
diff[key] = { from: before[key], to: after[key] };
|
|
}
|
|
}
|
|
|
|
return Object.keys(diff).length > 0 ? diff : null;
|
|
}
|
|
|
|
export async function logAudit(entry: AuditEntry): Promise<void> {
|
|
const sanitizedBefore = entry.before
|
|
? (sanitizeAuditPayload(entry.before) as Record<string, unknown>)
|
|
: undefined;
|
|
const sanitizedAfter = entry.after
|
|
? (sanitizeAuditPayload(entry.after) as Record<string, unknown>)
|
|
: undefined;
|
|
const diff = computeDiff(sanitizedBefore, sanitizedAfter);
|
|
|
|
await db.insert(AdminAuditLog).values({
|
|
userId: entry.userId,
|
|
action: entry.action,
|
|
target: entry.target,
|
|
targetId: entry.targetId,
|
|
before: sanitizedBefore ? JSON.stringify(sanitizedBefore) : null,
|
|
after: sanitizedAfter ? JSON.stringify(sanitizedAfter) : null,
|
|
diff: diff ? JSON.stringify(diff) : null,
|
|
createdAt: new Date().toISOString(),
|
|
});
|
|
}
|
|
|
|
interface GetLogsOptions {
|
|
search?: string;
|
|
page?: number;
|
|
perPage?: number;
|
|
}
|
|
|
|
export async function getAuditLogs(options: GetLogsOptions = {}) {
|
|
const { search, page = 1, perPage = 20 } = options;
|
|
const skip = (page - 1) * perPage;
|
|
|
|
const where = search
|
|
? or(
|
|
like(AdminAuditLog.action, `%${search}%`),
|
|
like(AdminAuditLog.target, `%${search}%`),
|
|
)
|
|
: undefined;
|
|
|
|
const [rows, totalResult] = await Promise.all([
|
|
db
|
|
.select({
|
|
id: AdminAuditLog.id,
|
|
userId: AdminAuditLog.userId,
|
|
action: AdminAuditLog.action,
|
|
target: AdminAuditLog.target,
|
|
targetId: AdminAuditLog.targetId,
|
|
diff: AdminAuditLog.diff,
|
|
createdAt: AdminAuditLog.createdAt,
|
|
})
|
|
.from(AdminAuditLog)
|
|
.where(where)
|
|
.orderBy(desc(AdminAuditLog.id))
|
|
.limit(perPage)
|
|
.offset(skip),
|
|
db.select({ value: count() }).from(AdminAuditLog).where(where),
|
|
]);
|
|
|
|
const total = Number(totalResult[0]?.value ?? 0);
|
|
|
|
const userIds = [...new Set(rows.map((r) => r.userId))];
|
|
const users =
|
|
userIds.length > 0
|
|
? await db
|
|
.select({ id: User.id, username: User.username })
|
|
.from(User)
|
|
.where(inArray(User.id, userIds))
|
|
: [];
|
|
const userMap = new Map(users.map((u) => [u.id, u.username]));
|
|
|
|
const enrichedRows = rows.map((r) => ({
|
|
...r,
|
|
username: userMap.get(r.userId) ?? `User #${r.userId}`,
|
|
}));
|
|
|
|
return {
|
|
rows: enrichedRows,
|
|
total,
|
|
page,
|
|
perPage,
|
|
lastPage: Math.ceil(total / perPage),
|
|
};
|
|
}
|