diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 33adb428cb..dfb491594d 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -185,13 +185,14 @@ App::init() ->inject('request') ->inject('dbForPlatform') ->inject('dbForProject') + ->inject('queueForAudits') ->inject('project') ->inject('user') ->inject('session') ->inject('servers') ->inject('mode') ->inject('team') - ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team) { + ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team) { $route = $utopia->getRoute(); if ($project->isEmpty()) { @@ -243,9 +244,10 @@ App::init() $user = new Document([ '$id' => '', 'status' => true, + 'type' => Auth::AUDIT_TYPE_APP, 'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(), 'password' => '', - 'name' => $project->getAttribute('name', 'Untitled'), + 'name' => 'Dynamic Key', ]); $role = Auth::USER_ROLE_APPS; @@ -253,6 +255,9 @@ App::init() Authorization::setRole(Auth::USER_ROLE_APPS); Authorization::setDefaultStatus(false); // Cancel security segmentation for API keys. + + // dynamic api key user + $queueForAudits->setUser($user); } } elseif ($keyType === API_KEY_STANDARD) { // No underline means no prefix. Backwards compatibility. @@ -264,9 +269,10 @@ App::init() $user = new Document([ '$id' => '', 'status' => true, + 'type' => Auth::AUDIT_TYPE_APP, 'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(), 'password' => '', - 'name' => $project->getAttribute('name', 'Untitled'), + 'name' => $key->getAttribute('name', 'UNKNOWN'), ]); $role = Auth::USER_ROLE_APPS; @@ -301,6 +307,8 @@ App::init() $dbForPlatform->purgeCachedDocument('projects', $project->getId()); } } + + $queueForAudits->setUser($user); } } } @@ -508,8 +516,14 @@ App::init() ->setIP($request->getIP()) ->setHostname($request->getHostname()) ->setEvent($route->getLabel('audits.event', '')) - ->setProject($project) - ->setUser($user); + ->setProject($project); + + // check first, + // as api key user might already exists + if (!$user->isEmpty()) { + $user->setAttribute('type', Auth::AUDIT_TYPE_USER); + $queueForAudits->setUser($user); + } $queueForDeletes->setProject($project); $queueForDatabase->setProject($project); @@ -659,7 +673,6 @@ App::shutdown() ->inject('response') ->inject('project') ->inject('user') - ->inject('userType') ->inject('queueForEvents') ->inject('queueForAudits') ->inject('queueForUsage') @@ -671,7 +684,7 @@ App::shutdown() ->inject('queueForWebhooks') ->inject('queueForRealtime') ->inject('dbForProject') - ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Document $userType, Event $queueForEvents, Audit $queueForAudits, Usage $queueForUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject) use ($parseLabel) { + ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, Usage $queueForUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject) use ($parseLabel) { $responsePayload = $response->getPayload(); @@ -709,17 +722,12 @@ App::shutdown() } } - $localUserInstance = clone $user; - $localUserInstance->setAttributes([ - 'keyName' => $userType->getAttribute('key'), - 'userType' => $userType->getAttribute('type', 'user'), - ]); + if (!$user->isEmpty()) { + $user->setAttribute('type', Auth::AUDIT_TYPE_USER); + $queueForAudits->setUser($user); + } - // even if the user is empty, - // set the available info when using API Key. - $queueForAudits->setUser($localUserInstance); - - if (!empty($queueForAudits->getResource())) { + if (!empty($queueForAudits->getResource()) && !$queueForAudits->getUser()->isEmpty()) { /** * audits.payload is switched to default true * in order to auto audit payload for all endpoints diff --git a/app/init.php b/app/init.php index 43a5526f9e..0a241813b5 100644 --- a/app/init.php +++ b/app/init.php @@ -1349,46 +1349,6 @@ App::setResource('project', function ($dbForPlatform, $request, $console) { return $project; }, ['dbForPlatform', 'request', 'console']); -App::setResource('userType', function ($request, $project, $user) { - /** @var Appwrite\Utopia\Request $request */ - /** @var Utopia\Database\Document $project */ - /** @var Utopia\Database\Document $user */ - - $userType = new Document(); - $apiKey = $request->getHeader('x-appwrite-key', ''); - - // Case 1: User exists, no API key - if (!$user->isEmpty() && empty($apiKey)) { - $userType - ->setAttribute('key', null) - ->setAttribute('type', 'user'); - return $userType; - } - - // Case 2: API key exists, user is empty - if (!empty($apiKey) && $user->isEmpty()) { - $userType->setAttribute('type', 'app'); - - // covers both legacy and new format. - $keyType = \str_contains($apiKey, '_') - ? \explode('_', $apiKey, 2)[0] - : API_KEY_STANDARD; - - switch ($keyType) { - case API_KEY_STANDARD: - $key = $project->find('secret', $apiKey, 'keys'); - $userType->setAttribute('key', $key ? $key->getAttribute('name', 'UNKNOWN') : 'UNKNOWN'); - break; - - case API_KEY_DYNAMIC: - $userType->setAttribute('key', 'dynamic'); - break; - } - } - - return $userType; -}, ['request', 'project', 'user']); - App::setResource('session', function (Document $user) { if ($user->isEmpty()) { return; diff --git a/src/Appwrite/Auth/Auth.php b/src/Appwrite/Auth/Auth.php index 1e8109622e..a2bb2dea1c 100644 --- a/src/Appwrite/Auth/Auth.php +++ b/src/Appwrite/Auth/Auth.php @@ -43,6 +43,12 @@ class Auth public const USER_ROLE_APPS = 'apps'; public const USER_ROLE_SYSTEM = 'system'; + /** + * Audit User Types. + */ + public const AUDIT_TYPE_APP = 'app'; + public const AUDIT_TYPE_USER = 'user'; + /** * Token Types. */ diff --git a/src/Appwrite/Platform/Workers/Audits.php b/src/Appwrite/Platform/Workers/Audits.php index f2825abddf..86ca59d3fd 100644 --- a/src/Appwrite/Platform/Workers/Audits.php +++ b/src/Appwrite/Platform/Workers/Audits.php @@ -76,8 +76,6 @@ class Audits extends Action 'userEmail' => $userEmail, 'mode' => $mode, 'data' => $auditPayload, - 'keyName' => $user->getAttribute('keyName'), - 'userType' => $user->getAttribute('userType'), ] ); }