@boarteam/boar-pack-users-backend 6.4.0 → 6.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boarteam/boar-pack-users-backend",
-  "version": "6.4.0",
+  "version": "6.6.0",
   "description": "NestJS Users module including permissions system, authentication strategies etc",
   "main": "src/index",
   "files": [
@@ -64,5 +64,5 @@
     "yalc:push": "yalc push",
     "gen-types": "SWAGGER=true JWT_SECRET=swagger nest start"
   },
-  "gitHead": "66b19ceeaa6a378ff0b3d18ff44a9bb1bd272fba"
+  "gitHead": "0c74a3f6b2b7e986124cac71a55467b9b8c25b63"
 }

package/src/audit-logs/audit-log-base-service.ts

@@ -1,5 +1,5 @@
 import { CreateManyDto, CrudRequest, } from '@dataui/crud';
-import { DeepPartial, ObjectLiteral, Repository, } from 'typeorm';
+import { DeepPartial, EntityManager, ObjectLiteral, Repository, } from 'typeorm';
 import { TypeOrmCrudService } from "@dataui/crud-typeorm";
 import { Injectable } from "@nestjs/common";
 import { AuditAction, AuditLog } from "./entities/audit-log.entity";
@@ -162,8 +162,8 @@ export class AuditLogBaseService<T extends ObjectLiteral> extends TypeOrmCrudSer
     return toReturn;
   }
 
-  public createAuditLog(log: Partial<AuditLog> | Partial<AuditLog>[]): Promise<AuditLog | AuditLog[]> {
-    return this.repo.manager.getRepository(AuditLog).save(log as Partial<AuditLog>);
+  public createAuditLog(log: Partial<AuditLog> | Partial<AuditLog>[], manager?: EntityManager): Promise<AuditLog | AuditLog[]> {
+    return (manager || this.repo.manager).getRepository(AuditLog).save(log as Partial<AuditLog>);
   }
 }
 

package/src/auth/local-auth/local-auth.controller.ts

@@ -6,6 +6,7 @@ import { AuthService } from '../auth.service';
 import { SkipJWTGuard } from '../../jwt-auth/jwt-auth.guard';
 import { SkipPoliciesGuard } from '../../casl/policies.guard';
 import { LocalAuthLoginDto, LocalAuthTokenDto } from "./local-auth.dto";
+import { SkipEventsLog } from "../../event-logs";
 
 @SkipPoliciesGuard()
 @ApiTags('Authentication')
@@ -18,6 +19,9 @@ export default class LocalAuthController {
   @SkipJWTGuard()
   @UseGuards(LocalAuthGuard)
   @Post('login')
+  @SkipEventsLog({
+    body: ['password'],
+  })
   async login(
     @Req() req: Request,
     @Res({ passthrough: true }) res: Response,

package/src/casl/casl-ability.factory.ts

@@ -84,7 +84,7 @@ export class CaslAbilityFactory {
         user.permissions.forEach((permission) => {
           const actionAndSubject = CaslAbilityFactory.permissionsToActionsMap[permission];
           if (!actionAndSubject) {
-            this.logger.error(`Unknown permission: ${permission}`);
+            this.logger.warn(`Unknown permission: ${permission}`);
             return;
           }
 

package/src/event-logs/event-logs.interceptor.ts

@@ -17,8 +17,12 @@ import { SERVICE_CONFIG_TOKEN } from "./event-logs.constants";
 import type { TEventLogServiceConfig } from "./event-logs.types";
 import { Reflector } from "@nestjs/core";
 
+export type TSkipEventsLogOptions = true | {
+  body?: string[];
+}
+
 export const SKIP_EVENTS_LOG = 'SKIP_EVENTS_LOG';
-export const SkipEventsLog = () => SetMetadata(SKIP_EVENTS_LOG, true);
+export const SkipEventsLog = (skipOptions: TSkipEventsLogOptions = true) => SetMetadata(SKIP_EVENTS_LOG, skipOptions);
 
 @Injectable()
 export class EventLogInterceptor implements NestInterceptor {
@@ -36,8 +40,8 @@ export class EventLogInterceptor implements NestInterceptor {
     const handler = context.getHandler();
     const controller = context.getClass();
 
-    const skipLog = this.reflector.getAllAndOverride<boolean>(SKIP_EVENTS_LOG, [handler, controller]);
-    if (skipLog) {
+    const skipOptions = this.reflector.getAllAndOverride<TSkipEventsLogOptions | undefined>(SKIP_EVENTS_LOG, [handler, controller]);
+    if (skipOptions === true) {
       return next.handle();
     }
 
@@ -57,13 +61,13 @@ export class EventLogInterceptor implements NestInterceptor {
         logEntry.duration = Date.now() - now;
         logEntry.statusCode = response.statusCode;
         logEntry.logLevel = response.statusCode >= 500 ? LogLevel.ERROR : (response.statusCode >= 400 ? LogLevel.WARNING : LogLevel.INFO);
-        this.eventLogService.audit(logEntry, request);
+        this.eventLogService.audit(logEntry, request, skipOptions);
       }),
       catchError((error: HttpException) => {
         logEntry.duration = Date.now() - now;
         logEntry.statusCode = error?.getStatus?.() || 500;
         logEntry.logLevel = logEntry.statusCode >= 500 ? LogLevel.ERROR : LogLevel.WARNING;
-        this.eventLogService.audit(logEntry, request);
+        this.eventLogService.audit(logEntry, request, skipOptions);
         return throwError(() => error);
       }),
     );

package/src/event-logs/event-logs.service.ts

@@ -8,6 +8,7 @@ import { EventLogTimelineDto } from "./dto/event-log-timeline.dto";
 import { Cron, CronExpression } from "@nestjs/schedule";
 import moment from "moment";
 import 'moment-timezone';
+import { TSkipEventsLogOptions } from "./event-logs.interceptor";
 
 type TInterval = 'second' | 'minute' | 'hour' | 'day' | 'week';
 
@@ -60,7 +61,7 @@ export class EventLogsService extends TypeOrmCrudService<EventLog> {
     this.logger.debug(`Removed ${result.affected} expired records from event_logs table.`);
   }
 
-  audit(eventLog: Partial<EventLog>, request?: Request): void {
+  audit(eventLog: Partial<EventLog>, request?: Request, skipOptions?: TSkipEventsLogOptions): void {
     // @ts-ignore
     if (request?.[EventLogsService.requestHandled]) {
       this.logger.debug('Request already handled');
@@ -72,10 +73,20 @@ export class EventLogsService extends TypeOrmCrudService<EventLog> {
       const { user } = request;
       const userRole = user?.role ? EventLogsService.rolesMap[user.role] : UserRole.GUEST;
 
+      const payload = request.body ? { ...request.body } : null;
+      if (skipOptions && typeof skipOptions === 'object' && Array.isArray(skipOptions.body) && payload) {
+        for (const field of skipOptions.body) {
+          if (field in payload) {
+            // @ts-ignore
+            payload[field] = '*****';
+          }
+        }
+      }
+
       logPartial.userId = user?.id || null;
       logPartial.userName = user?.name || null;
       logPartial.userRole = userRole || UserRole.GUEST;
-      logPartial.payload = request.body || null;
+      logPartial.payload = payload;
       logPartial.method = request.method || null;
       logPartial.url = request.url || null;
       logPartial.entityId = request.params.id || null;