Audit Logs

Copyexport const getAuditLogs = async ({
  workspaceId,
  programId,
  start,
  end,
}: {
  start: Date;
  end: Date;
  workspaceId: string;
  programId: string;
}) => {
  const pipe = tb.buildPipe({
    pipe: "get_audit_logs",
    parameters: auditLogFilterSchemaTB,
    data: auditLogResponseSchemaTB,
  });
 
  const events = await pipe({
    workspaceId,
    programId,
    start: formatUTCDateTimeClickhouse(start),
    end: formatUTCDateTimeClickhouse(end),
  });
 
  return events.data;

Copyexport const auditLogFilterSchemaTB = z.object({
  workspaceId: z.string().transform(prefixWorkspaceId),
  programId: z.string(),
  start: z.string(),
  end: z.string(),
});
 
export const auditLogResponseSchemaTB = z.object({
  id: z.string(),
  timestamp: z.string(),
  action: z.string(),
  actor_id: z.string(),
  actor_type: z.string(),
  actor_name: z.string(),
  description: z.string(),
  ip_address: z.string(),
  user_agent: z.string(),
  targets: z.string(),
  metadata: z.string(),
});

Copyexport const POST = withWorkspace(
  async ({ req, workspace }) => {
    const { start, end } = auditLogExportQuerySchema.parse(
      await parseRequestBody(req),
    );
 
    if (!start || !end) {
      throw new DubApiError({
        code: "bad_request",
        message: "Must provide start and end dates.",
      });
    }
 
    const { canExportAuditLogs } = getPlanCapabilities(workspace.plan);
 
    if (!canExportAuditLogs) {
      throw new DubApiError({
        code: "forbidden",
        message: "You are not authorized to export audit logs.",
      });
    }
 
    const programId = getDefaultProgramIdOrThrow(workspace);
 
    const auditLogs = await getAuditLogs({
      workspaceId: workspace.id,
      programId,
      start: new Date(start),
      end: new Date(end),
    });
 
    const csvData = convertToCSV(auditLogs);
 
    return new Response(csvData, {
      headers: {
        "Content-Type": "application/csv",
        "Content-Disposition": `attachment;`,
      },
    });
  },
  {
    requiredRoles: ["owner", "member"],
    requiredPlan: ["enterprise"],
  },
);

Copyconst ACTIONS_WITHOUT_CHANGE_SET: ActivityLogAction[] = [
  "submittedLead.created",
  "reward.created",
  "reward.deleted",
];
 
export interface TrackActivityLogInput
  extends Pick<
    Prisma.ActivityLogUncheckedCreateInput,
    | "workspaceId"
    | "programId"
    | "resourceId"
    | "userId"
    | "description"
    | "parentResourceType"
    | "parentResourceId"
    | "batchId"
  > {
  resourceType: ActivityLogResourceType;
  action: ActivityLogAction;
  changeSet?: ChangeSet;
}
 
export const trackActivityLog = async (
  input: TrackActivityLogInput | TrackActivityLogInput[],
) => {
  let inputs = Array.isArray(input) ? input : [input];
 
  inputs = inputs.filter(
    (i) =>
      ACTIONS_WITHOUT_CHANGE_SET.includes(i.action) ||
      (i.changeSet && Object.keys(i.changeSet).length > 0),
  );
 
  if (inputs.length === 0) {
    return;
  }

Copyexport const trackActivityLogsTx = async ({
  tx,
  logs,
}: {
  tx: Prisma.TransactionClient;
  logs: TrackActivityLogInput | TrackActivityLogInput[];
}) => {
  let inputs = Array.isArray(logs) ? logs : [logs];
 
  inputs = inputs.filter(
    (i) =>
      ACTIONS_WITHOUT_CHANGE_SET.includes(i.action) ||
      (i.changeSet && Object.keys(i.changeSet).length > 0),
  );
 
  if (inputs.length === 0) {
    return;
  }

Copyconst rewardFields = [
  ["clickReward", previous.clickRewardId, next.clickRewardId],
  ["leadReward", previous.leadRewardId, next.leadRewardId],
  ["saleReward", previous.saleRewardId, next.saleRewardId],
] as const;
 
const changedRewardFields = rewardFields.filter(
  ([, oldId, newId]) => oldId !== newId,
);
const discountChanged = previous.discountId !== next.discountId;
 
if (changedRewardFields.length === 0 && !discountChanged) {
  return;
}

Copyconst COMMISSION_ACTIVITY_FIELDS = ["amount", "earnings", "status"];
 
export function toCommissionActivitySnapshot(
  commission: Pick<Commission, "id" | "amount" | "earnings" | "status">,
): CommissionActivitySnapshot {
  return {
    amount: commission.amount,
    earnings: commission.earnings,
    status: commission.status,
  };
}

Copyexport async function trackCommissionStatusUpdatesByProgram({
  commissions,
  payouts,
  newStatus = "paid",
}: {
  commissions: Pick<
    Commission,
    "id" | "amount" | "earnings" | "status" | "programId"
  >[];
  payouts: Array<{ program: { id: string; workspaceId: string } }>;
  newStatus?: CommissionStatus;
}) {
  if (commissions.length === 0) {
    return;
  }
 
  const workspaceByProgram = new Map(
    payouts.map((p) => [p.program.id, p.program.workspaceId]),
  );
 
  const commissionsByProgram = groupBy(commissions, (c) => c.programId);
 

Copyexport const GET = withWorkspace(async ({ workspace, searchParams }) => {
  const { resourceType, resourceId, parentResourceId, action } =
    getActivityLogsQuerySchema.parse(searchParams);
 
  const programId = getDefaultProgramIdOrThrow(workspace);
 
  const activityLogs = await prisma.activityLog.findMany({
    where: {
      programId,
      resourceType,
      resourceId,
      parentResourceId,
      action,
    },
    orderBy: {
      createdAt: "desc",
    },
    take: 100,
    include: {
      user: true,
    },
  });

Copyif (resourceType === "partner" && resourceId) {
  const programEnrollment = await prisma.programEnrollment.findUnique({
    where: {
      partnerId_programId: {
        partnerId: resourceId,
        programId,
      },
    },
    select: {
      createdAt: true,
      groupId: true,
      partnerGroup: {
        select: {
          name: true,
        },
      },
    },
  });
  if (programEnrollment) {
    parsedActivityLogs.push({
      id: uuid(),
      action: "partner.groupChanged",
      description: null,
      createdAt: programEnrollment.createdAt,
      user: null,
      changeSet: {
        group: {
          old: null,
          new: parsedActivityLogs[parsedActivityLogs.length - 1]?.changeSet
            ?.group?.old ?? {
            id: programEnrollment.groupId,
            name: programEnrollment.partnerGroup?.name,
          },
        },
      },
    });
  }

Copyexport const GET = withPartnerProfile(
  async ({ partner, params, searchParams }) => {
    const { resourceType, resourceId, action } =
      getActivityLogsQuerySchema.parse(searchParams);
 
    // Limit to submitted lead for now
    if (resourceType !== "submittedLead") {
      throw new DubApiError({
        code: "bad_request",
        message: "Resource type must be submitted lead.",
      });
    }
 
    const programEnrollment = await getProgramEnrollmentOrThrow({
      partnerId: partner.id,
      programId: params.programId,
      include: {},
    });
 
    // Check if the resource is a referral and belongs to the program and partner
    const lead = await prisma.submittedLead.findUnique({
      where: {
        id: resourceId,
        programId: programEnrollment.programId,
        partnerId: partner.id,
      },
      select: {
        id: true,
      },
    });
 
    if (!lead) {
      throw new DubApiError({
        code: "not_found",
        message: "Submitted lead not found.",
      });
    }
 
    const activityLogs = await prisma.activityLog.findMany({
      where: {
        programId: programEnrollment.programId,
        resourceType,
        resourceId,
        action,
      },
      orderBy: {
        createdAt: "desc",
      },
      take: 100,
    });
 
    // Hide the workspace user who made each change from the partner
    return NextResponse.json(
      z
        .array(activityLogSchema)
        .parse(activityLogs.map((log) => ({ ...log, user: null }))),
    );

Copyexport function useActivityLogs({
  query,
  enabled = true,
}: {
  query?: GetActivityLogsQuery;
  enabled?: boolean;
} = {}) {
  const { id: workspaceId } = useWorkspace();
 
  const searchParams = query
    ? new URLSearchParams({
        workspaceId: workspaceId!,
        ...query,
      }).toString()
    : "";
 
  const requestEnabled =
    enabled &&
    workspaceId &&
    query?.resourceType &&
    (query?.parentResourceId || query?.resourceId);
 
  const { data, error, isLoading, mutate } = useSWR<ActivityLog[]>(
    requestEnabled && `/api/activity-logs?${searchParams}`,
    fetcher,
    {
      keepPreviousData: true,
    },
  );
 
  return {
    activityLogs: data,
    error,
    loading: isLoading,
    mutate,
  };

Copyconst requestEnabled =
  enabled &&
  workspaceId &&
  query?.resourceType &&
  (query?.parentResourceId || query?.resourceId);
 

Copyexport type ActorType = "USER" | "SYSTEM";
 
type ActivityLogRenderer = (props: { log: ActivityLog }) => ReactNode;
 
export function getActorType(log: ActivityLog): ActorType {
  return log.user ? "USER" : "SYSTEM";
}

Copyconst PARTNER_STATUS_ACTIONS = [
  "partner_application.approved",
  "partner_application.rejected",
  "partner.banned",
  "partner.unbanned",
  "partner.deactivated",
  "partner.reactivated",
  "partner.archived",
  "partner.unarchived",
] as const satisfies readonly ActivityLogAction[];

Copyexport async function captureWebhookLog({
  workspaceId,
  method,
  path,
  statusCode,
  duration,
  requestBody,
  responseBody,
  userAgent,
}: {
  workspaceId: string;
  method: string;
  path: keyof typeof WEBHOOK_REQUEST_ACTORS_BY_PATH;
  statusCode: number;
  duration: number;
  requestBody: unknown;
  responseBody: unknown;
  userAgent: string | null;
}) {
  const actor = WEBHOOK_REQUEST_ACTORS_BY_PATH[path];
 
  return await recordApiLog({
    workspaceId,
    method,
    path,
    routePattern: path,
    statusCode,
    duration,
    userAgent,
    requestBody,
    responseBody: await parseResponseBody(responseBody),
    tokenId: null,
    userId: actor.id,
    requestType: "webhook",
  });
}