New audit log implementation

apps/op-app/.env.example

@@ -7,6 +7,7 @@ SESSION_MANAGER_BASE_URL=https://io-p-weu-session-manager-app-03.azurewebsites.n
 LOLLIPOP_BASE_URL=https://api.io.pagopa.it
 LOLLIPOP_API_KEY=api-key-here
 ACCESS_QUEUE_URL=https://lcavallaro.queue.core.windows.net/access-queue
+AUDIT_EVENT_QUEUE_URL=https://lcavallaro.queue.core.windows.net/audit-events-queue
 REDIS_URL=redis-url-here
 REDIS_PASSWORD=redis-password-here
 REDIS_PING_INTERVAL=540000

apps/op-app/src/adapters/config.ts

@@ -9,6 +9,7 @@ import { redisConfigSchema } from "./redis/config.js";
 
 export const storageQueueConfigSchema = z.object({
   accessQueueUrl: z.string().url(),
+  eventsQueueUrl: z.string().url(),
 });
 
 export const configSchema = z.object({
@@ -51,6 +52,7 @@ export const configFromEnvironment = envSchema.transform(
     },
     storageQueue: {
       accessQueueUrl: env.ACCESS_QUEUE_URL,
+      eventsQueueUrl: env.AUDIT_EVENT_QUEUE_URL,
     },
   }),
 );

apps/op-app/src/adapters/env.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 export const envSchema = nodeEnvSchema.and(cosmosEnvSchema).and(
   z.object({
     ACCESS_QUEUE_URL: z.string().min(1),
+    AUDIT_EVENT_QUEUE_URL: z.string().url(),
     KEY_VAULT_KEY_NAME: z.string().min(1),
     KEY_VAULT_URL: z.string().url(),
     LOLLIPOP_API_KEY: z.string().min(1),

apps/op-app/src/adapters/express/application.ts

@@ -3,6 +3,7 @@ import type Provider from "oidc-provider";
 
 import { HealthUseCase } from "@/use-cases/health.js";
 import { LogAccessUseCase } from "@/use-cases/log-access.js";
+import { SendEventMessageUseCase } from "@/use-cases/send-event-messge.js";
 import cookieParser from "cookie-parser";
 import express from "express";
 import helmet from "helmet";
@@ -17,6 +18,7 @@ import interactionRouter from "./routes/interaction.js";
 export const createApplication = (
   oidc: Provider,
   login: LoginUseCase,
+  event: SendEventMessageUseCase,
   logAccess: LogAccessUseCase,
   health: HealthUseCase,
   logger: Logger,
@@ -37,7 +39,7 @@ export const createApplication = (
     }),
   );
 
-  app.use(interactionRouter(oidc, login, logAccess));
+  app.use(interactionRouter(oidc, login, event, logAccess));
 
   app.use(healthRouter(health));
 

apps/op-app/src/adapters/express/routes/interaction.ts

@@ -3,7 +3,9 @@ import type Provider from "oidc-provider";
 
 import { metadataForConsentFromScopes } from "@/domain/user-metadata.js";
 import { LogAccessUseCase } from "@/use-cases/log-access.js";
+import { SendEventMessageUseCase } from "@/use-cases/send-event-messge.js";
 import * as express from "express";
+import { requestParamsSchema } from "io-fims-common/domain/audit-event";
 import * as assert from "node:assert/strict";
 import { z } from "zod";
 
@@ -54,9 +56,11 @@ export const parseRedirectDisplayName = (
   return redirectDisplayName.it;
 };
 
+/* eslint-disable max-lines-per-function */
 export default function createInteractionRouter(
   oidcProvider: Provider,
   login: LoginUseCase,
+  eventUseCase: SendEventMessageUseCase,
   logAccess: LogAccessUseCase,
 ) {
   const router = express.Router();
@@ -118,6 +122,9 @@ export default function createInteractionRouter(
 
       req.log.debug("using %s as baseUrl for links", baseUrl);
 
+      const userMetadata = metadataForConsentFromScopes(
+        consent.prompt.details.missingOIDCScope,
+      );
       const apiModel = schemas.Consent.safeParse({
         _links: {
           abort: {
@@ -132,9 +139,7 @@ export default function createInteractionRouter(
         },
         service_id: consent.params.client_id,
         type: interactionType,
-        user_metadata: metadataForConsentFromScopes(
-          consent.prompt.details.missingOIDCScope,
-        ).map((name) => ({
+        user_metadata: userMetadata.map((name) => ({
           // name can be "firstName", "lastName", ..
           display_name: req.__(name),
           // localize each metadata name using i18n-node
@@ -163,8 +168,9 @@ export default function createInteractionRouter(
       assert.equal(
         interaction.prompt.name,
         "login",
-        new Error("Interaction type mismatch, login expected"),
+        "Interaction type mismatch, login expected",
       );
+
       const cookiesSchema = z.object({
         _io_fims_token: z.string().min(1),
       });
@@ -174,10 +180,25 @@ export default function createInteractionRouter(
         new HttpBadRequestError(`Unable to parse the "_io_fims_token" cookie.`),
       );
       req.log.debug("_io_fims_token parsed from cookies");
+      const rpParams = requestParamsSchema.safeParse(interaction.params);
+      assert.ok(
+        rpParams.success,
+        new HttpBadRequestError(`Unable to parse the query params.`),
+      );
+      assert.ok(
+        req.ip,
+        new HttpBadRequestError(`Unable to retrieve ip address from request`),
+      );
       const accountId = await login.execute(
         cookies.data._io_fims_token,
         interaction.jti,
       );
+      await eventUseCase.execute({
+        ipAddress: req.ip,
+        requestParams: rpParams.data,
+        sessionId: accountId,
+        type: "rpStep",
+      });
       return oidcProvider.interactionFinished(req, res, {
         login: {
           accountId,
@@ -249,3 +270,4 @@ export default function createInteractionRouter(
 
   return router;
 }
+/* eslint-enable max-lines-per-function */

apps/op-app/src/adapters/io/user-metadata.ts

@@ -1,10 +1,7 @@
-import {
-  IdentityProvider,
-  UserMetadata,
-  userMetadataSchema,
-} from "@/domain/user-metadata.js";
+import { IdentityProvider } from "@/domain/user-metadata.js";
 import { NonEmptyString } from "@pagopa/ts-commons/lib/strings.js";
 import * as E from "fp-ts/lib/Either.js";
+import { userMetadataSchema } from "io-fims-common/domain/user-metadata";
 import * as assert from "node:assert/strict";
 import { ZodError, z } from "zod";
 

apps/op-app/src/adapters/oidc/middleware.ts

@@ -0,0 +1,26 @@
+import { SendEventMessageUseCase } from "@/use-cases/send-event-messge.js";
+import Provider from "oidc-provider";
+import { Logger } from "pino";
+
+export function createTokenMiddleware(
+  provider: Provider,
+  eventUseCase: SendEventMessageUseCase,
+  logger: Logger,
+) {
+  provider.use(async (ctx, next) => {
+    await next();
+    if (ctx.oidc && ctx.oidc.route === "token") {
+      logger.info(`started post middleware for the route 'token'`);
+      const tokenResponse = ctx.response;
+      if (tokenResponse.status === 200) {
+        const responseBody = tokenResponse.body;
+        if (responseBody["id_token"]) {
+          eventUseCase.execute({
+            idToken: responseBody["id_token"],
+            type: "idToken",
+          });
+        }
+      }
+    }
+  });
+}

apps/op-app/src/adapters/redis/event.ts

@@ -0,0 +1,44 @@
+import {
+  Event,
+  EventRepository,
+  auditEventSessionSchema,
+} from "@/domain/session.js";
+import * as assert from "node:assert/strict";
+import {
+  RedisClientType,
+  RedisDefaultModules,
+  RedisFunctions,
+  RedisScripts,
+} from "redis";
+
+export default class RedisEventRepository implements EventRepository {
+  #client: RedisClientType<RedisDefaultModules, RedisFunctions, RedisScripts>;
+
+  constructor(
+    client: RedisClientType<RedisDefaultModules, RedisFunctions, RedisScripts>,
+  ) {
+    this.#client = client;
+  }
+
+  #key(clientId: string, fiscalCode: string) {
+    return `audit:${clientId}:${fiscalCode}`;
+  }
+
+  async get(clientId: string, fiscalCode: string) {
+    const blobName = await this.#client.GET(this.#key(clientId, fiscalCode));
+    const event = auditEventSessionSchema.parse({
+      blobName,
+      clientId,
+      fiscalCode,
+    });
+    return event;
+  }
+
+  async upsert(event: Event) {
+    const result = await this.#client.SET(
+      this.#key(event.clientId, event.fiscalCode),
+      event.blobName,
+    );
+    assert.equal(result, "OK");
+  }
+}