|
1 | | -/** |
2 | | - * Enterprise audit log authorization. |
3 | | - * |
4 | | - * Validates that the authenticated user is an admin/owner of an enterprise organization |
5 | | - * and returns the organization context needed for scoped queries. |
6 | | - */ |
7 | | - |
8 | | -import { db } from '@sim/db' |
9 | | -import { member, subscription } from '@sim/db/schema' |
10 | | -import { createLogger } from '@sim/logger' |
11 | | -import { and, eq, inArray } from 'drizzle-orm' |
12 | 1 | import { NextResponse } from 'next/server' |
13 | | -import { isOrganizationBillingBlocked } from '@/lib/billing/core/access' |
14 | | -import { USABLE_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils' |
15 | | -import { isAuditLogsEnabled, isBillingEnabled } from '@/lib/core/config/env-flags' |
16 | | - |
17 | | -const logger = createLogger('V1AuditLogsAuth') |
18 | | - |
19 | | -interface EnterpriseAuditContext { |
20 | | - organizationId: string |
21 | | - orgMemberIds: string[] |
22 | | -} |
| 2 | +import { |
| 3 | + type EnterpriseAuditContext, |
| 4 | + resolveEnterpriseAuditAccess, |
| 5 | +} from '@/lib/audit-logs/authorization' |
23 | 6 |
|
24 | 7 | type AuthResult = |
25 | 8 | | { success: true; context: EnterpriseAuditContext } |
26 | 9 | | { success: false; response: NextResponse } |
27 | 10 |
|
28 | | -/** |
29 | | - * Structured enterprise audit-access result shared by the v1 and v2 surfaces so |
30 | | - * each version can render the failure in its own response envelope. |
31 | | - */ |
32 | | -export type EnterpriseAuditAccessResult = |
33 | | - | { success: true; context: EnterpriseAuditContext } |
34 | | - | { success: false; status: number; message: string } |
35 | | - |
36 | | -/** |
37 | | - * Core enterprise audit-access check (no response rendering). |
38 | | - * |
39 | | - * Checks: |
40 | | - * 1. User belongs to an organization (the target one when |
41 | | - * `targetOrganizationId` is given) |
42 | | - * 2. User has admin or owner role |
43 | | - * 3. The organization is entitled to audit logs — an active enterprise |
44 | | - * subscription when billing runs, otherwise the deployment's audit-logs |
45 | | - * entitlement |
46 | | - * |
47 | | - * The subscription query is skipped entirely with billing off. Requiring it |
48 | | - * there made audit logs unreachable on every self-hosted deployment, since no |
49 | | - * subscription row is ever written without billing. |
50 | | - * |
51 | | - * Returns the organization ID and all member user IDs on success. |
52 | | - */ |
53 | | -export async function resolveEnterpriseAuditAccess( |
54 | | - userId: string, |
55 | | - targetOrganizationId?: string |
56 | | -): Promise<EnterpriseAuditAccessResult> { |
57 | | - const [membership] = await db |
58 | | - .select({ organizationId: member.organizationId, role: member.role }) |
59 | | - .from(member) |
60 | | - .where( |
61 | | - targetOrganizationId |
62 | | - ? and(eq(member.userId, userId), eq(member.organizationId, targetOrganizationId)) |
63 | | - : eq(member.userId, userId) |
64 | | - ) |
65 | | - .limit(1) |
66 | | - |
67 | | - if (!membership) { |
68 | | - return { |
69 | | - success: false, |
70 | | - status: 403, |
71 | | - message: targetOrganizationId |
72 | | - ? 'Not a member of the requested organization' |
73 | | - : 'Not a member of any organization', |
74 | | - } |
75 | | - } |
76 | | - |
77 | | - if (membership.role !== 'admin' && membership.role !== 'owner') { |
78 | | - return { success: false, status: 403, message: 'Organization admin or owner role required' } |
79 | | - } |
80 | | - |
81 | | - if (isBillingEnabled) { |
82 | | - const billingBlocked = await isOrganizationBillingBlocked(membership.organizationId) |
83 | | - if (billingBlocked) { |
84 | | - return { success: false, status: 403, message: 'Active enterprise subscription required' } |
85 | | - } |
86 | | - } else if (!isAuditLogsEnabled) { |
87 | | - return { |
88 | | - success: false, |
89 | | - status: 403, |
90 | | - message: |
91 | | - 'Audit logs are disabled. Set ENTERPRISE_ENABLED or AUDIT_LOGS_ENABLED to enable them.', |
92 | | - } |
93 | | - } |
94 | | - |
95 | | - const [orgSub, orgMembers] = await Promise.all([ |
96 | | - isBillingEnabled |
97 | | - ? db |
98 | | - .select({ id: subscription.id }) |
99 | | - .from(subscription) |
100 | | - .where( |
101 | | - and( |
102 | | - eq(subscription.referenceId, membership.organizationId), |
103 | | - eq(subscription.plan, 'enterprise'), |
104 | | - inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES) |
105 | | - ) |
106 | | - ) |
107 | | - .limit(1) |
108 | | - : Promise.resolve([]), |
109 | | - db |
110 | | - .select({ userId: member.userId }) |
111 | | - .from(member) |
112 | | - .where(eq(member.organizationId, membership.organizationId)), |
113 | | - ]) |
114 | | - |
115 | | - if (isBillingEnabled && orgSub.length === 0) { |
116 | | - return { success: false, status: 403, message: 'Active enterprise subscription required' } |
117 | | - } |
118 | | - |
119 | | - const orgMemberIds = orgMembers.map((m) => m.userId) |
120 | | - |
121 | | - logger.info('Enterprise audit access validated', { |
122 | | - userId, |
123 | | - organizationId: membership.organizationId, |
124 | | - memberCount: orgMemberIds.length, |
125 | | - }) |
126 | | - |
127 | | - return { |
128 | | - success: true, |
129 | | - context: { organizationId: membership.organizationId, orgMemberIds }, |
130 | | - } |
131 | | -} |
132 | | - |
133 | 11 | /** |
134 | 12 | * v1 wrapper: renders {@link resolveEnterpriseAuditAccess} as the v1 `{ error }` |
135 | 13 | * response body. |
|
0 commit comments