feat: add site audit logs generator

.aws/deploy/backend-task-definition.prod.json

@@ -185,6 +185,10 @@
         {
           "name": "SITE_CHECKER_FORM_KEY",
           "valueFrom": "PROD_SITE_CHECKER_FORM_KEY"
+        },
+        {
+          "name": "SITE_AUDIT_LOGS_FORM_KEY",
+          "valueFrom": "PROD_SITE_AUDIT_LOGS_FORM_KEY"
         }
       ],
       "logConfiguration": {

.aws/deploy/backend-task-definition.staging.json

@@ -194,6 +194,10 @@
         {
           "name": "SITE_CHECKER_FORM_KEY",
           "valueFrom": "STAGING_SITE_CHECKER_FORM_KEY"
+        },
+        {
+          "name": "SITE_AUDIT_LOGS_FORM_KEY",
+          "valueFrom": "STAGING_SITE_AUDIT_LOGS_FORM_KEY"
         }
       ],
       "logConfiguration": {

.platform/hooks/predeploy/06_fetch_ssm_parameters.sh

@@ -84,6 +84,7 @@ ENV_VARS=(
     "UPTIME_ROBOT_API_KEY"
     "GGS_REPAIR_FORM_KEY"
     "SITE_CHECKER_FORM_KEY"
+    "SITE_AUDIT_LOGS_FORM_KEY"
 )
 
 echo "Set AWS region"

src/config/config.ts

@@ -2,7 +2,7 @@
 
 convict.addFormat({
   name: "required-string",
   validate: (val: any) => {
     if (!val) throw new Error("value cannot be empty, null or undefined")
     if (typeof val !== "string") throw new Error("value must be a string")
   },
@@ -10,14 +10,14 @@
 
 convict.addFormat({
   name: "required-positive-number",
   validate: (val: any) => {
     if (val === null || val === undefined || val === "")
       throw new Error("value cannot be empty, null or undefined")
     if (typeof val !== "number") throw new Error("value must be a number")
   },
   coerce: (val: string) => {
     const coercedVal = Number(val)
     if (isNaN(coercedVal)) {
       throw new Error(
         "value provided is not a positive number. please provide a valid positive number"
       )
@@ -31,7 +31,7 @@
 
 convict.addFormat({
   name: "required-boolean",
   validate: (val: any) => {
     if (val === null || val === undefined)
       throw new Error("value cannot be empty, null or undefined")
     if (typeof val !== "boolean") throw new Error("value must be a boolean")
@@ -314,6 +314,13 @@
       format: "required-string",
       default: "",
     },
+    siteAuditLogsFormKey: {
+      doc: "FormSG API key for site audit logs form",
+      env: "SITE_AUDIT_LOGS_FORM_KEY",
+      sensitive: true,
+      format: "required-string",
+      default: "",
+    },
   },
   postman: {
     apiKey: {

src/constants/constants.ts

@@ -2,24 +2,24 @@
 
 import { config } from "@config/config"
 
 export enum JobStatus {
   Ready = "READY", // Ready to run jobs
   Running = "RUNNING", // A job is running
   Failed = "FAILED", // A job has failed and recovery is needed
 }
 
 export enum SiteStatus {
   Empty = "EMPTY", // A site record site is being initialized
   Initialized = "INITIALIZED",
   Launched = "LAUNCHED",
 }
 
 export enum RedirectionTypes {
   CNAME = "CNAME",
   A = "A",
 }
 
 export enum CollaboratorRoles {
   Admin = "ADMIN",
   Contributor = "CONTRIBUTOR",
   IsomerAdmin = "ISOMERADMIN",
@@ -30,7 +30,7 @@
   CollaboratorRoles.IsomerAdmin
 >
 
 export enum ReviewRequestStatus {
   Approved = "APPROVED",
   Open = "OPEN",
   Merged = "MERGED",
@@ -87,6 +87,10 @@
   config.get("aws.efs.volPath"),
   "repos-lite"
 )
+export const EFS_VOL_PATH_AUDIT_LOGS = path.join(
+  config.get("aws.efs.volPath"),
+  "audit-logs"
+)
 export const STAGING_BRANCH = "staging"
 export const STAGING_LITE_BRANCH = "staging-lite"
 export const PLACEHOLDER_FILE_NAME = ".keep"

src/errors/AuditLogsError.ts

@@ -0,0 +1,11 @@
+import { BaseIsomerError } from "./BaseError"
+
+export default class AuditLogsError extends BaseIsomerError {
+  constructor(message: string) {
+    super({
+      status: 500,
+      code: "AuditLogsError",
+      message,
+    })
+  }
+}

src/routes/formsg/formsgSiteAuditLogs.ts

@@ -0,0 +1,128 @@
+/* eslint-disable import/prefer-default-export */
+import type { DecryptedContentAndAttachments } from "@opengovsg/formsg-sdk/dist/types"
+import express, { RequestHandler } from "express"
+
+import { config } from "@root/config/config"
+import InitializationError from "@root/errors/InitializationError"
+import logger from "@root/logger/logger"
+import { attachFormSGHandler } from "@root/middleware"
+import AuditLogsService from "@root/services/admin/AuditLogsService"
+import { getField, getFieldsFromTable } from "@root/utils/formsg-utils"
+
+interface FormsgSiteAuditLogsRouterProps {
+  auditLogsService: AuditLogsService
+}
+
+const SITE_AUDIT_LOGS_FORM_KEY = config.get("formSg.siteAuditLogsFormKey")
+
+const REQUESTER_EMAIL_FIELD = "Where should we send the email address to?"
+const REPO_NAME_FIELD =
+  "What is the name of the Isomer site that you need logs for? (Repo Name (in GitHub))"
+const LOGS_TIMEFRAME_FIELD = "I need a log of edits made in:"
+const LOGS_TIMEFRAME_START_FIELD = "Start date"
+const LOGS_TIMEFRAME_END_FIELD = "End date"
+
+export class FormsgSiteAuditLogsRouter {
+  private readonly auditLogsService: FormsgSiteAuditLogsRouterProps["auditLogsService"]
+
+  constructor({ auditLogsService }: FormsgSiteAuditLogsRouterProps) {
+    this.auditLogsService = auditLogsService
+  }
+
+  getAuditLogsHandler: RequestHandler<
+    never,
+    Record<string, never>,
+    { data: { submissionId: string } },
+    never,
+    { submission: DecryptedContentAndAttachments }
+  > = async (req, res) => {
+    let startDate = "1970-01-01"
+    let endDate = new Date().toISOString().split("T")[0]
+    const repoNames: Set<string> = new Set()
+
+    const { responses } = res.locals.submission.content
+
+    const requesterEmail = getField(responses, REQUESTER_EMAIL_FIELD)
+
+    if (!requesterEmail) {
+      logger.error(
+        "No requester email was provided in site audit logs form submission"
+      )
+      return res.sendStatus(400)
+    }
+
+    const repoNamesFromTable = getFieldsFromTable(responses, REPO_NAME_FIELD)
+
+    if (!repoNamesFromTable) {
+      logger.error(
+        "No repo names were provided in site audit logs form submission"
+      )
+      return res.sendStatus(400)
+    }
+
+    repoNamesFromTable.forEach((repoName) => {
+      if (typeof repoName === "string") {
+        // actually wont happen based on our formsg form, but this code
+        // is added defensively
+        repoNames.add(repoName)
+      } else {
+        repoNames.add(repoName[0])
+      }
+    })
+
+    const logsTimeframe = getField(responses, LOGS_TIMEFRAME_FIELD)
+
+    if (logsTimeframe === "The past calendar year") {
+      startDate = `${new Date().getFullYear() - 1}-01-01`
+      endDate = `${new Date().getFullYear() - 1}-12-31`
+    } else if (logsTimeframe === "The past calendar month") {
+      const startDateObject = new Date()
+      startDateObject.setMonth(startDateObject.getMonth() - 1)
+      const endDateObject = new Date()
+      endDateObject.setDate(0)
+
+      startDate = `${startDateObject.getFullYear()}-${startDateObject
+        .getMonth()
+        .toString()
+        .padStart(2, "0")}-01`
+      endDate = `${endDateObject.getFullYear()}-${endDateObject
+        .getMonth()
+        .toString()
+        .padStart(2, "0")}-${endDateObject.getDate()}`
+    } else {
+      const startDateField = getField(responses, LOGS_TIMEFRAME_START_FIELD)
+      const endDateField = getField(responses, LOGS_TIMEFRAME_END_FIELD)
+      if (startDateField && endDateField) {
+        startDate = startDateField
+        endDate = endDateField
+      }
+    }
+
+    res.sendStatus(200)
+
+    this.auditLogsService.getAuditLogsViaFormsg(
+      requesterEmail,
+      Array.from(repoNames),
+      startDate,
+      endDate,
+      req.body.data.submissionId
+    )
+  }
+
+  getRouter() {
+    const router = express.Router({ mergeParams: true })
+    if (!SITE_AUDIT_LOGS_FORM_KEY) {
+      throw new InitializationError(
+        "Required SITE_AUDIT_LOGS_FORM_KEY environment variable is not defined"
+      )
+    }
+
+    router.post(
+      "/audit-logs",
+      attachFormSGHandler(SITE_AUDIT_LOGS_FORM_KEY),
+      this.getAuditLogsHandler
+    )
+
+    return router
+  }
+}

src/server.js

@@ -74,10 +74,12 @@ import { mailer } from "@services/utilServices/MailClient"
 import { database } from "./database/config"
 import { apiLogger } from "./middleware/apiLogger"
 import { NotificationOnEditHandler } from "./middleware/notificationOnEditHandler"
+import { FormsgSiteAuditLogsRouter } from "./routes/formsg/formsgSiteAuditLogs"
 import getAuthenticatedSubrouter from "./routes/v2/authenticated"
 import { ReviewsRouter } from "./routes/v2/authenticated/review"
 import getAuthenticatedSitesSubrouter from "./routes/v2/authenticatedSites"
 import { SgidAuthRouter } from "./routes/v2/sgidAuth"
+import AuditLogsService from "./services/admin/AuditLogsService"
 import RepoManagementService from "./services/admin/RepoManagementService"
 import GitFileCommitService from "./services/db/GitFileCommitService"
 import GitFileSystemService from "./services/db/GitFileSystemService"
@@ -88,8 +90,8 @@ import CollaboratorsService from "./services/identity/CollaboratorsService"
 import LaunchClient from "./services/identity/LaunchClient"
 import LaunchesService from "./services/identity/LaunchesService"
 import DynamoDBDocClient from "./services/infra/DynamoDBClient"
-import ReviewCommentService from "./services/review/ReviewCommentService"
 import RepoCheckerService from "./services/review/RepoCheckerService"
+import ReviewCommentService from "./services/review/ReviewCommentService"
 import { rateLimiter } from "./services/utilServices/RateLimiter"
 import SgidAuthService from "./services/utilServices/SgidAuthService"
 import { isSecure } from "./utils/auth-utils"
@@ -315,6 +317,15 @@ const repoCheckerService = new RepoCheckerService({
   git: simpleGitInstance,
 })
 
+const auditLogsService = new AuditLogsService({
+  collaboratorsService,
+  isomerAdminsService,
+  notificationsService,
+  reviewRequestService,
+  sitesService,
+  usersService,
+})
+
 // poller site launch updates
 infraService.pollMessages()
 
@@ -399,6 +410,10 @@ const formsgSiteCheckerRouter = new FormsgSiteCheckerRouter({
   repoCheckerService,
 })
 
+const formsgSiteAuditLogsRouter = new FormsgSiteAuditLogsRouter({
+  auditLogsService,
+})
+
 const app = express()
 
 if (isSecure) {
@@ -440,6 +455,7 @@ app.use("/formsg", formsgSiteCreateRouter.getRouter())
 app.use("/formsg", formsgSiteLaunchRouter.getRouter())
 app.use("/formsg", formsgGGsRepairRouter.getRouter())
 app.use("/formsg", formsgSiteCheckerRouter.getRouter())
+app.use("/formsg", formsgSiteAuditLogsRouter.getRouter())
 
 // catch unknown routes
 app.use((req, res, next) => {