diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 834d91d887..c6a348cd1e 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -48,6 +48,7 @@ App::post('/v1/account') ->label('scope', 'public') ->label('auth.type', 'emailPassword') ->label('audits.resource', 'user/{response.$id}') + ->label('audits.userId', '{response.$id}') ->label('usage.metric', 'users.{scope}.requests.create') ->label('sdk.auth', []) ->label('sdk.namespace', 'account') @@ -133,6 +134,8 @@ App::post('/v1/account/sessions/email') ->label('event', 'users.[userId].sessions.[sessionId].create') ->label('scope', 'public') ->label('auth.type', 'emailPassword') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'sessions.{scope}.requests.create') ->label('usage.params', ['provider' => 'value.email']) ->label('sdk.auth', []) @@ -151,9 +154,8 @@ App::post('/v1/account/sessions/email') ->inject('dbForProject') ->inject('locale') ->inject('geodb') - ->inject('audits') ->inject('events') - ->action(function (string $email, string $password, Request $request, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audits, Event $events) { + ->action(function (string $email, string $password, Request $request, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Event $events) { $email = \strtolower($email); $protocol = $request->getProtocol(); @@ -199,11 +201,6 @@ App::post('/v1/account/sessions/email') $dbForProject->deleteCachedDocument('users', $profile->getId()); - $audits - ->setResource('user/' . $profile->getId()) - ->setUser($profile) - ; - if (!Config::getParam('domainVerification')) { $response ->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($profile->getId(), $secret)])) @@ -348,7 +345,6 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect') ->label('abuse-limit', 50) ->label('abuse-key', 'ip:{ip}') ->label('docs', false) - ->label('audits.resource', 'user/{response.$id}') ->label('usage.metric', 'sessions.{scope}.requests.create') ->label('usage.params', ['provider' => 'request.provider']) ->param('provider', '', new WhiteList(\array_keys(Config::getParam('providers')), true), 'OAuth2 provider.') @@ -360,8 +356,9 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect') ->inject('user') ->inject('dbForProject') ->inject('geodb') + ->inject('audits') ->inject('events') - ->action(function (string $provider, string $code, string $state, Request $request, Response $response, Document $project, Document $user, Database $dbForProject, Reader $geodb, Event $events) use ($oauthDefaultSuccess) { + ->action(function (string $provider, string $code, string $state, Request $request, Response $response, Document $project, Document $user, Database $dbForProject, Reader $geodb, Audit $audits, Event $events) use ($oauthDefaultSuccess) { $protocol = $request->getProtocol(); $callback = $protocol . '://' . $request->getHostname() . '/v1/account/sessions/oauth2/callback/' . $provider . '/' . $project->getId(); @@ -538,6 +535,10 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect') $dbForProject->deleteCachedDocument('users', $user->getId()); + $audits->setResource('user/' . $user->getId()) + ->setUser($user) + ; + $events ->setParam('userId', $user->getId()) ->setParam('sessionId', $session->getId()) @@ -575,7 +576,8 @@ App::post('/v1/account/sessions/magic-url') ->groups(['api', 'account']) ->label('scope', 'public') ->label('auth.type', 'magic-url') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('sdk.auth', []) ->label('sdk.namespace', 'account') ->label('sdk.method', 'createMagicURLSession') @@ -699,7 +701,8 @@ App::put('/v1/account/sessions/magic-url') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].sessions.[sessionId].create') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'sessions.{scope}.requests.create') ->label('usage.params', ['provider' => 'value.magic-url']) ->label('sdk.auth', []) @@ -813,7 +816,8 @@ App::post('/v1/account/sessions/phone') ->groups(['api', 'account']) ->label('scope', 'public') ->label('auth.type', 'phone') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('sdk.auth', []) ->label('sdk.namespace', 'account') ->label('sdk.method', 'createPhoneSession') @@ -926,7 +930,8 @@ App::put('/v1/account/sessions/phone') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].sessions.[sessionId].create') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'sessions.{scope}.requests.create') ->label('usage.params', ['provider' => 'value.phone']) ->label('sdk.auth', []) @@ -1037,7 +1042,8 @@ App::post('/v1/account/sessions/anonymous') ->label('event', 'users.[userId].sessions.[sessionId].create') ->label('scope', 'public') ->label('auth.type', 'anonymous') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{userId}') ->label('usage.metric', 'sessions.{scope}.requests.create') ->label('usage.params', ['provider' => 'value.anonymous']) ->label('sdk.auth', []) @@ -1379,6 +1385,7 @@ App::patch('/v1/account/name') ->label('event', 'users.[userId].update.name') ->label('scope', 'account') ->label('audits.resource', 'user/{response.$id}') + ->label('audits.userId', '{response.$id}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1409,6 +1416,7 @@ App::patch('/v1/account/password') ->label('event', 'users.[userId].update.password') ->label('scope', 'account') ->label('audits.resource', 'user/{response.$id}') + ->label('audits.userId', '{response.$id}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1449,6 +1457,7 @@ App::patch('/v1/account/email') ->label('event', 'users.[userId].update.email') ->label('scope', 'account') ->label('audits.resource', 'user/{response.$id}') + ->label('audits.userId', '{response.$id}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1499,6 +1508,7 @@ App::patch('/v1/account/phone') ->label('event', 'users.[userId].update.phone') ->label('scope', 'account') ->label('audits.resource', 'user/{response.$id}') + ->label('audits.userId', '{response.$id}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1607,6 +1617,7 @@ App::delete('/v1/account/sessions/:sessionId') ->groups(['api', 'account']) ->label('scope', 'account') ->label('event', 'users.[userId].sessions.[sessionId].delete') + ->label('audits.resource', 'user/{user.$id}') ->label('usage.metric', 'sessions.{scope}.requests.delete') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1621,9 +1632,8 @@ App::delete('/v1/account/sessions/:sessionId') ->inject('user') ->inject('dbForProject') ->inject('locale') - ->inject('audits') ->inject('events') - ->action(function (?string $sessionId, Request $request, Response $response, Document $user, Database $dbForProject, Locale $locale, Audit $audits, Event $events) { + ->action(function (?string $sessionId, Request $request, Response $response, Document $user, Database $dbForProject, Locale $locale, Event $events) { $protocol = $request->getProtocol(); $sessionId = ($sessionId === 'current') @@ -1638,8 +1648,6 @@ App::delete('/v1/account/sessions/:sessionId') $dbForProject->deleteDocument('sessions', $session->getId()); - $audits->setResource('user/' . $user->getId()); - $session->setAttribute('current', false); if ($session->getAttribute('secret') == Auth::hash(Auth::$secret)) { // If current session delete the cookies too @@ -1679,7 +1687,8 @@ App::patch('/v1/account/sessions/:sessionId') ->groups(['api', 'account']) ->label('scope', 'account') ->label('event', 'users.[userId].sessions.[sessionId].update') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'sessions.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1759,6 +1768,7 @@ App::delete('/v1/account/sessions') ->groups(['api', 'account']) ->label('scope', 'account') ->label('event', 'users.[userId].sessions.[sessionId].delete') + ->label('audits.resource', 'user/{user.$id}') ->label('usage.metric', 'sessions.{scope}.requests.delete') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1772,9 +1782,8 @@ App::delete('/v1/account/sessions') ->inject('user') ->inject('dbForProject') ->inject('locale') - ->inject('audits') ->inject('events') - ->action(function (Request $request, Response $response, Document $user, Database $dbForProject, Locale $locale, Audit $audits, Event $events) { + ->action(function (Request $request, Response $response, Document $user, Database $dbForProject, Locale $locale, Event $events) { $protocol = $request->getProtocol(); $sessions = $user->getAttribute('sessions', []); @@ -1782,8 +1791,6 @@ App::delete('/v1/account/sessions') foreach ($sessions as $session) {/** @var Document $session */ $dbForProject->deleteDocument('sessions', $session->getId()); - $audits->setResource('user/' . $user->getId()); - if (!Config::getParam('domainVerification')) { $response->addHeader('X-Fallback-Cookies', \json_encode([])); } @@ -1822,7 +1829,8 @@ App::post('/v1/account/recovery') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].recovery.[tokenId].create') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1923,7 +1931,8 @@ App::put('/v1/account/recovery') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].recovery.[tokenId].update') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{response.userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -1989,7 +1998,8 @@ App::post('/v1/account/verification') ->groups(['api', 'account']) ->label('scope', 'account') ->label('event', 'users.[userId].verification.[tokenId].create') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') + ->label('audits.userId', '{userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -2076,7 +2086,7 @@ App::put('/v1/account/verification') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].verification.[tokenId].update') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -2134,7 +2144,7 @@ App::post('/v1/account/verification/phone') ->groups(['api', 'account']) ->label('scope', 'account') ->label('event', 'users.[userId].verification.[tokenId].create') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') @@ -2217,7 +2227,7 @@ App::put('/v1/account/verification/phone') ->groups(['api', 'account']) ->label('scope', 'public') ->label('event', 'users.[userId].verification.[tokenId].update') - ->label('audits.resource', 'user/{response.$id}') + ->label('audits.resource', 'user/{response.userId}') ->label('usage.metric', 'users.{scope}.requests.update') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'account') diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php index c8612daa15..0d82b92223 100644 --- a/app/controllers/api/databases.php +++ b/app/controllers/api/databases.php @@ -36,7 +36,6 @@ use Appwrite\Utopia\Database\Validator\Queries as QueriesValidator; use Appwrite\Utopia\Database\Validator\OrderAttributes; use Appwrite\Utopia\Response; use Appwrite\Detector\Detector; -use Appwrite\Event\Audit as EventAudit; use Appwrite\Event\Database as EventDatabase; use Appwrite\Event\Event; use Utopia\Config\Config; @@ -420,9 +419,8 @@ App::delete('/v1/databases/:databaseId') ->inject('response') ->inject('dbForProject') ->inject('events') - ->inject('audits') ->inject('deletes') - ->action(function (string $databaseId, Response $response, Database $dbForProject, Event $events, EventAudit $audits, Delete $deletes) { + ->action(function (string $databaseId, Response $response, Database $dbForProject, Event $events, Delete $deletes) { $database = $dbForProject->getDocument('databases', $databaseId); @@ -446,8 +444,6 @@ App::delete('/v1/databases/:databaseId') ->setPayload($response->output($database, Response::MODEL_DATABASE)) ; - $audits->setPayload($database->getArrayCopy()); - $response->noContent(); }); @@ -698,7 +694,6 @@ App::put('/v1/databases/:databaseId/collections/:collectionId') ->label('scope', 'collections.write') ->label('event', 'databases.[databaseId].collections.[collectionId].update') ->label('audits.resource', 'database/{request.databaseId}/collection/{request.collectionId}') - ->label('audits-payload', true) ->label('usage.metric', 'collections.{scope}.requests.update') ->label('usage.params', ['databaseId' => 'request.databaseId']) ->label('sdk.auth', [APP_AUTH_TYPE_KEY]) @@ -777,9 +772,8 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId') ->inject('response') ->inject('dbForProject') ->inject('events') - ->inject('audits') ->inject('deletes') - ->action(function (string $databaseId, string $collectionId, Response $response, Database $dbForProject, Event $events, EventAudit $audits, Delete $deletes) { + ->action(function (string $databaseId, string $collectionId, Response $response, Database $dbForProject, Event $events, Delete $deletes) { $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); @@ -811,8 +805,6 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId') ->setPayload($response->output($collection, Response::MODEL_COLLECTION)) ; - $audits->setPayload($collection->getArrayCopy()); - $response->noContent(); }); @@ -1363,8 +1355,7 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/attributes/:key ->inject('dbForProject') ->inject('database') ->inject('events') - ->inject('audits') - ->action(function (string $databaseId, string $collectionId, string $key, Response $response, Database $dbForProject, EventDatabase $database, Event $events, EventAudit $audits) { + ->action(function (string $databaseId, string $collectionId, string $key, Response $response, Database $dbForProject, EventDatabase $database, Event $events) { $db = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); @@ -1425,8 +1416,6 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/attributes/:key ->setPayload($response->output($attribute, $model)) ; - $audits->setPayload($attribute->getArrayCopy()); - $response->noContent(); }); @@ -1687,8 +1676,7 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/indexes/:key') ->inject('dbForProject') ->inject('database') ->inject('events') - ->inject('audits') - ->action(function (string $databaseId, string $collectionId, string $key, Response $response, Database $dbForProject, EventDatabase $database, Event $events, EventAudit $audits) { + ->action(function (string $databaseId, string $collectionId, string $key, Response $response, Database $dbForProject, EventDatabase $database, Event $events) { $db = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); @@ -1730,8 +1718,6 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/indexes/:key') ->setPayload($response->output($index, Response::MODEL_INDEX)) ; - $audits->setPayload($index->getArrayCopy()); - $response->noContent(); }); @@ -2266,10 +2252,9 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/documents/:docu ->inject('response') ->inject('dbForProject') ->inject('events') - ->inject('audits') ->inject('deletes') ->inject('mode') - ->action(function (string $databaseId, string $collectionId, string $documentId, Response $response, Database $dbForProject, Event $events, EventAudit $audits, Delete $deletes, string $mode) { + ->action(function (string $databaseId, string $collectionId, string $documentId, Response $response, Database $dbForProject, Event $events, Delete $deletes, string $mode) { $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); @@ -2333,8 +2318,6 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/documents/:docu ->setPayload($response->output($document, Response::MODEL_DOCUMENT)) ; - $audits->setPayload($document->getArrayCopy()); - $response->noContent(); }); diff --git a/app/controllers/api/storage.php b/app/controllers/api/storage.php index 862e34f244..660d95c294 100644 --- a/app/controllers/api/storage.php +++ b/app/controllers/api/storage.php @@ -35,7 +35,6 @@ use Utopia\Storage\Validator\Upload; use Utopia\Validator\ArrayList; use Utopia\Validator\Boolean; use Utopia\Validator\HexColor; -use Utopia\Validator\Integer; use Utopia\Validator\Range; use Utopia\Validator\Text; use Utopia\Validator\WhiteList; @@ -274,10 +273,9 @@ App::delete('/v1/storage/buckets/:bucketId') ->param('bucketId', '', new UID(), 'Bucket unique ID.') ->inject('response') ->inject('dbForProject') - ->inject('audits') ->inject('deletes') ->inject('events') - ->action(function (string $bucketId, Response $response, Database $dbForProject, Audit $audits, Delete $deletes, Event $events) { + ->action(function (string $bucketId, Response $response, Database $dbForProject, Delete $deletes, Event $events) { $bucket = $dbForProject->getDocument('buckets', $bucketId); if ($bucket->isEmpty()) { @@ -297,8 +295,6 @@ App::delete('/v1/storage/buckets/:bucketId') ->setPayload($response->output($bucket, Response::MODEL_BUCKET)) ; - $audits->setPayload($bucket->getArrayCopy()); - $response->noContent(); }); diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php index 875c2835bf..76e99969bf 100644 --- a/app/controllers/api/teams.php +++ b/app/controllers/api/teams.php @@ -2,7 +2,6 @@ use Appwrite\Auth\Auth; use Appwrite\Detector\Detector; -use Appwrite\Event\Audit as EventAudit; use Appwrite\Event\Delete; use Appwrite\Event\Event; use Appwrite\Event\Mail; @@ -207,6 +206,7 @@ App::delete('/v1/teams/:teamId') ->groups(['api', 'teams']) ->label('event', 'teams.[teamId].delete') ->label('scope', 'teams.write') + ->label('audits.resource', 'team/{request.teamId}') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'teams') ->label('sdk.method', 'delete') @@ -218,8 +218,7 @@ App::delete('/v1/teams/:teamId') ->inject('dbForProject') ->inject('events') ->inject('deletes') - ->inject('audits') - ->action(function (string $teamId, Response $response, Database $dbForProject, Event $events, Delete $deletes, EventAudit $audits) { + ->action(function (string $teamId, Response $response, Database $dbForProject, Event $events, Delete $deletes) { $team = $dbForProject->getDocument('teams', $teamId); @@ -251,11 +250,6 @@ App::delete('/v1/teams/:teamId') ->setPayload($response->output($team, Response::MODEL_TEAM)) ; - $audits - ->setParam('resource', 'team/' . $teamId) - ->setParam('data', $team->getArrayCopy()) - ; - $response->noContent(); }); @@ -265,7 +259,8 @@ App::post('/v1/teams/:teamId/memberships') ->label('event', 'teams.[teamId].memberships.[membershipId].create') ->label('scope', 'teams.write') ->label('auth.type', 'invites') - ->label('audits.resource', 'team/{response.teamId}') + ->label('audits.resource', 'team/{request.teamId}') + ->label('audits.userId', '{request.userId}') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'teams') ->label('sdk.method', 'createMembership') @@ -544,7 +539,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId') ->groups(['api', 'teams']) ->label('event', 'teams.[teamId].memberships.[membershipId].update') ->label('scope', 'teams.write') - ->label('audits.resource', 'team/{response.teamId}') + ->label('audits.resource', 'team/{request.teamId}') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_KEY, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'teams') ->label('sdk.method', 'updateMembershipRoles') @@ -614,7 +609,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status') ->groups(['api', 'teams']) ->label('event', 'teams.[teamId].memberships.[membershipId].update.status') ->label('scope', 'public') - ->label('audits.resource', 'team/{response.teamId}') + ->label('audits.resource', 'team/{request.teamId}') + ->label('audits.userId', '{request.userId}') ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT]) ->label('sdk.namespace', 'teams') ->label('sdk.method', 'updateMembershipStatus') @@ -676,9 +672,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status') ->setAttribute('confirm', true) ; - $user - ->setAttribute('emailVerification', true) - ; + $user->setAttribute('emailVerification', true); // Log user in diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 539df72720..0f207913db 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -17,8 +17,6 @@ use Utopia\Abuse\Adapters\TimeLimit; use Utopia\Database\Database; use Utopia\Database\Document; use Utopia\Database\Validator\Authorization; -use Utopia\Registry\Registry; -use Utopia\Route; App::init() ->groups(['api']) @@ -254,44 +252,29 @@ App::shutdown() } $route = $utopia->match($request); + $requestParams = array_combine( + array_keys($route->getParams()), array_column($route->getParams(), 'value') + ); + $user = $audits->getUser(); - $getRequestParams = function () use ($route, $request): array { - $url = \parse_url($request->getURI(), PHP_URL_PATH); - $regex = '@' . \preg_replace('@:[^/]+@', '([^/]+)', $route->getPath()) . '@'; - \preg_match($regex, $url, $matches); - \array_shift($matches); - $url = $route->getIsAlias() ? $route->getAliasPath() : $route->getPath(); - $keyRegex = '@^' . \preg_replace('@:[^/]+@', ':([^/]+)', $url) . '$@'; - \preg_match($keyRegex, $url, $keys); - \array_shift($keys); - - return \array_combine($keys, $matches) ?? []; - }; - - - $parseLabel = function ($label) use ($responsePayload, $getRequestParams): string { + $parseLabel = function ($label) use ($responsePayload, $requestParams, $user) { preg_match_all('/{(.*?)}/', $label, $matches); foreach ($matches[1] ?? [] as $pos => $match) { $find = $matches[0][$pos]; $parts = explode('.', $match); if (count($parts) !== 2) { - return ''; + throw new Exception('Too less or too many parts', 400, Exception::GENERAL_ARGUMENT_INVALID); } $namespace = $parts[0]; - $replace = $parts[1]; + $replace = $parts[1]; - switch ($namespace) { - case 'response': - $params = $responsePayload; - break; - case 'request': - $params = $getRequestParams(); - break; - default: - $params = $responsePayload; - } + $params = match ($namespace) { + 'user' => $user, + 'request' => $requestParams, + default => $responsePayload, + }; if (array_key_exists($replace, $params)) { $label = \str_replace($find, $params[$replace], $label); @@ -301,28 +284,34 @@ App::shutdown() return $label; }; - $auditsResource = $route->getLabel('audits.resource', null); - if (!empty($auditsResource)) { - $resource = $parseLabel($auditsResource); - if (!empty($resource) && $resource !== $auditsResource) { + $pattern = $route->getLabel('audits.resource', null); + if (!empty($pattern)) { + $resource = $parseLabel($pattern); + if (!empty($resource) && $resource !== $pattern) { $audits->setResource($resource); } } + $pattern = $route->getLabel('audits.userId', null); + if (!empty($pattern)) { + $userId = $parseLabel($pattern); + $user = $dbForProject->getDocument('users', $userId); + $audits->setUser($user); + } + if (!empty($audits->getResource())) { /** * audits.payload is switched to default true * in order to auto audit payload for all endpoints */ - $auditsPayload = $route->getLabel('audits.payload', true); - if (!empty($auditsPayload)) { + $pattern = $route->getLabel('audits.payload', true); + if (!empty($pattern)) { $audits->setPayload($responsePayload); } foreach ($events->getParams() as $key => $value) { $audits->setParam($key, $value); } - $audits->trigger(); } @@ -334,7 +323,6 @@ App::shutdown() $database->trigger(); } - if ( App::getEnv('_APP_USAGE_STATS', 'enabled') == 'enabled' && $project->getId() @@ -357,7 +345,7 @@ App::shutdown() $params = $responsePayload; break; case 'request': - $params = $getRequestParams(); + $params = $requestParams; break; case 'value': $usage->setParam($param, $key); diff --git a/composer.lock b/composer.lock index bce5b90d88..e188cfa264 100644 --- a/composer.lock +++ b/composer.lock @@ -1894,16 +1894,16 @@ }, { "name": "utopia-php/cache", - "version": "0.6.0", + "version": "0.6.1", "source": { "type": "git", "url": "https://github.com/utopia-php/cache.git", - "reference": "8ea1353a4bbab617e23c865a7c97b60d8074aee3" + "reference": "9889235a6d3da6cbb1f435201529da4d27c30e79" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/utopia-php/cache/zipball/8ea1353a4bbab617e23c865a7c97b60d8074aee3", - "reference": "8ea1353a4bbab617e23c865a7c97b60d8074aee3", + "url": "https://api.github.com/repos/utopia-php/cache/zipball/9889235a6d3da6cbb1f435201529da4d27c30e79", + "reference": "9889235a6d3da6cbb1f435201529da4d27c30e79", "shasum": "" }, "require": { @@ -1941,9 +1941,9 @@ ], "support": { "issues": "https://github.com/utopia-php/cache/issues", - "source": "https://github.com/utopia-php/cache/tree/0.6.0" + "source": "https://github.com/utopia-php/cache/tree/0.6.1" }, - "time": "2022-04-04T12:30:05+00:00" + "time": "2022-08-10T08:12:46+00:00" }, { "name": "utopia-php/cli",