mirror of
https://github.com/appwrite/appwrite.git
synced 2026-05-26 13:51:13 +00:00
applied new logic for logs
This commit is contained in:
eldadfux
@@ -163,19 +163,19 @@ class Specs extends Action
|
||||
'ImpersonateUserId' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Id',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserEmail' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Email',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserPhone' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Phone',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
],
|
||||
@@ -219,19 +219,19 @@ class Specs extends Action
|
||||
'ImpersonateUserId' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Id',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserEmail' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Email',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserPhone' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Phone',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
],
|
||||
@@ -275,19 +275,19 @@ class Specs extends Action
|
||||
'ImpersonateUserId' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Id',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by ID on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserEmail' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Email',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by email on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
'ImpersonateUserPhone' => [
|
||||
'type' => 'apiKey',
|
||||
'name' => 'X-Appwrite-Impersonate-User-Phone',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins.',
|
||||
'description' => 'Impersonate a user by phone on an already user-authenticated request. Requires the current request to be authenticated as a user with impersonator capability; X-Appwrite-Key alone is not sufficient. Impersonator users are intentionally granted users.read so they can discover a target before impersonation begins. Internal audit logs still attribute actions to the original impersonator and record the impersonated target only in internal audit payload data.',
|
||||
'in' => 'header',
|
||||
],
|
||||
],
|
||||
|
||||
@@ -82,22 +82,31 @@ class Audits extends Action
|
||||
$ip = $payload['ip'] ?? '';
|
||||
$user = new Document($payload['user'] ?? []);
|
||||
|
||||
$userName = $user->getAttribute('name', '');
|
||||
$userEmail = $user->getAttribute('email', '');
|
||||
$impersonatorUserId = $user->getAttribute('impersonatorUserId');
|
||||
$actorUserId = $impersonatorUserId ?: $user->getId();
|
||||
$actorUserInternalId = $impersonatorUserId
|
||||
? $user->getAttribute('impersonatorUserInternalId')
|
||||
: $user->getSequence();
|
||||
$actorUserName = $impersonatorUserId
|
||||
? $user->getAttribute('impersonatorUserName', '')
|
||||
: $user->getAttribute('name', '');
|
||||
$actorUserEmail = $impersonatorUserId
|
||||
? $user->getAttribute('impersonatorUserEmail', '')
|
||||
: $user->getAttribute('email', '');
|
||||
$userType = $user->getAttribute('type', ACTIVITY_TYPE_USER);
|
||||
|
||||
// Create event data
|
||||
$eventData = [
|
||||
'userId' => $user->getSequence(),
|
||||
'userId' => $actorUserInternalId,
|
||||
'event' => $event,
|
||||
'resource' => $resource,
|
||||
'userAgent' => $userAgent,
|
||||
'ip' => $ip,
|
||||
'location' => '',
|
||||
'data' => [
|
||||
'userId' => $user->getId(),
|
||||
'userName' => $userName,
|
||||
'userEmail' => $userEmail,
|
||||
'userId' => $actorUserId,
|
||||
'userName' => $actorUserName,
|
||||
'userEmail' => $actorUserEmail,
|
||||
'userType' => $userType,
|
||||
'mode' => $mode,
|
||||
'data' => $auditPayload,
|
||||
@@ -105,6 +114,21 @@ class Audits extends Action
|
||||
'time' => date("Y-m-d H:i:s", $message->getTimestamp()),
|
||||
];
|
||||
|
||||
if (!empty($impersonatorUserId)) {
|
||||
$eventData['data']['data'] = \is_array($auditPayload)
|
||||
? \array_merge($auditPayload, [
|
||||
'impersonatedUserId' => $user->getId(),
|
||||
'impersonatedUserName' => $user->getAttribute('name', ''),
|
||||
'impersonatedUserEmail' => $user->getAttribute('email', ''),
|
||||
])
|
||||
: [
|
||||
'payload' => $auditPayload,
|
||||
'impersonatedUserId' => $user->getId(),
|
||||
'impersonatedUserName' => $user->getAttribute('name', ''),
|
||||
'impersonatedUserEmail' => $user->getAttribute('email', ''),
|
||||
];
|
||||
}
|
||||
|
||||
if (isset($this->logs[$project->getSequence()])) {
|
||||
$this->logs[$project->getSequence()]['logs'][] = $eventData;
|
||||
} else {
|
||||
|
||||
@@ -118,7 +118,7 @@ class Account extends Model
|
||||
])
|
||||
->addRule('impersonatorUserId', [
|
||||
'type' => self::TYPE_STRING,
|
||||
'description' => 'ID of the user performing the impersonation. Present only when the current request is impersonating another user.',
|
||||
'description' => 'ID of the original actor performing the impersonation. Present only when the current request is impersonating another user. Internal audit logs attribute the action to this user, while the impersonated target is recorded only in internal audit payload data.',
|
||||
'required' => false,
|
||||
'default' => '',
|
||||
'example' => '5e5ea5c16897e',
|
||||
|
||||
@@ -18,19 +18,19 @@ class Log extends Model
|
||||
])
|
||||
->addRule('userId', [
|
||||
'type' => self::TYPE_STRING,
|
||||
'description' => 'User ID.',
|
||||
'description' => 'User ID of the actor recorded for this log. During impersonation, this is the original impersonator, not the impersonated target user.',
|
||||
'default' => '',
|
||||
'example' => '610fc2f985ee0',
|
||||
])
|
||||
->addRule('userEmail', [
|
||||
'type' => self::TYPE_STRING,
|
||||
'description' => 'User Email.',
|
||||
'description' => 'User email of the actor recorded for this log. During impersonation, this is the original impersonator.',
|
||||
'default' => '',
|
||||
'example' => 'john@appwrite.io',
|
||||
])
|
||||
->addRule('userName', [
|
||||
'type' => self::TYPE_STRING,
|
||||
'description' => 'User Name.',
|
||||
'description' => 'User name of the actor recorded for this log. During impersonation, this is the original impersonator.',
|
||||
'default' => '',
|
||||
'example' => 'John Doe',
|
||||
])
|
||||
|
||||
@@ -148,7 +148,7 @@ class User extends Model
|
||||
])
|
||||
->addRule('impersonatorUserId', [
|
||||
'type' => self::TYPE_STRING,
|
||||
'description' => 'ID of the user performing the impersonation. Present only when the current request is impersonating another user.',
|
||||
'description' => 'ID of the original actor performing the impersonation. Present only when the current request is impersonating another user. Internal audit logs attribute the action to this user, while the impersonated target is recorded only in internal audit payload data.',
|
||||
'required' => false,
|
||||
'default' => '',
|
||||
'example' => '5e5ea5c16897e',
|
||||
|
||||
Reference in New Issue
Block a user