groups: add events to eventlog

src/groups.js

@@ -13,13 +13,12 @@ exports = module.exports = {
     list,
     listWithMembers,
 
-    getMembers,
+    getMemberIds,
     setMembers,
-    removeMember,
     isMember,
 
     setLocalMembership,
-    resetSource,
+    resetSources,
 
     // exported for testing
     _getMembership: getMembership
@@ -29,6 +28,7 @@ const assert = require('assert'),
     BoxError = require('./boxerror.js'),
     constants = require('./constants.js'),
     database = require('./database.js'),
+    eventlog = require('./eventlog.js'),
     safe = require('safetydance'),
     uuid = require('uuid');
 
@@ -57,8 +57,9 @@ function validateSource(source) {
     return null;
 }
 
-async function add(group) {
+async function add(group, auditSource) {
     assert.strictEqual(typeof group, 'object');
+    assert(auditSource && typeof auditSource === 'object');
 
     let { name, source } = group;
 
@@ -77,19 +78,24 @@ async function add(group) {
     if (error && error.code === 'ER_DUP_ENTRY') throw new BoxError(BoxError.ALREADY_EXISTS, error);
     if (error) throw error;
 
+    await eventlog.add(eventlog.ACTION_GROUP_ADD, auditSource, { id, name, source });
+
     return { id, name, source };
 }
 
-async function del(id) {
-    assert.strictEqual(typeof id, 'string');
+async function del(group, auditSource) {
+    assert.strictEqual(typeof group, 'object');
+    assert(auditSource && typeof auditSource === 'object');
 
-    // also cleanup the groupMembers table
-    const queries = [];
-    queries.push({ query: 'DELETE FROM groupMembers WHERE groupId = ?', args: [ id ] });
-    queries.push({ query: 'DELETE FROM userGroups WHERE id = ?', args: [ id ] });
+    const queries = [
+        { query: 'DELETE FROM groupMembers WHERE groupId = ?', args: [ group.id ] },
+        { query: 'DELETE FROM userGroups WHERE id = ?', args: [ group.id ] }
+    ];
 
     const result = await database.transaction(queries);
     if (result[1].affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Group not found');
+
+    await eventlog.add(eventlog.ACTION_GROUP_REMOVE, auditSource, { group });
 }
 
 async function get(id) {
@@ -140,7 +146,7 @@ async function listWithMembers() {
     return results;
 }
 
-async function getMembers(groupId) {
+async function getMemberIds(groupId) {
     assert.strictEqual(typeof groupId, 'string');
 
     const result = await database.query('SELECT userId FROM groupMembers WHERE groupId=?', [ groupId ]);
@@ -180,10 +186,11 @@ async function setLocalMembership(user, localGroupIds) {
     if (error) throw error;
 }
 
-async function setMembers(group, userIds, options) {
+async function setMembers(group, userIds, options, auditSource) {
     assert.strictEqual(typeof group, 'object');
     assert(Array.isArray(userIds));
     assert.strictEqual(typeof options, 'object');
+    assert(auditSource && typeof auditSource === 'object');
 
     if (!options.skipSourceCheck && group.source === 'ldap') throw new BoxError(BoxError.BAD_STATE, 'Cannot set members of external group');
 
@@ -197,14 +204,8 @@ async function setMembers(group, userIds, options) {
     if (error && error.code === 'ER_NO_REFERENCED_ROW_2') throw new BoxError(BoxError.NOT_FOUND, 'Group not found');
     if (error && error.code === 'ER_DUP_ENTRY') throw new BoxError(BoxError.CONFLICT, 'Duplicate member in list');
     if (error) throw error;
-}
 
-async function removeMember(groupId, userId) {
-    assert.strictEqual(typeof groupId, 'string');
-    assert.strictEqual(typeof userId, 'string');
-
-    const result = await database.query('DELETE FROM groupMembers WHERE groupId = ? AND userId = ?', [ groupId, userId ]);
-    if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Group not found');
+    await eventlog.add(eventlog.ACTION_GROUP_MEMBERSHIP, auditSource, { group, userIds });
 }
 
 async function isMember(groupId, userId) {
@@ -248,15 +249,18 @@ async function update(id, data) {
     if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Group not found');
 }
 
-async function setName(group, name) {
+async function setName(group, name, auditSource) {
     assert.strictEqual(typeof group, 'object');
     assert.strictEqual(typeof name, 'string');
+    assert(auditSource && typeof auditSource === 'object');
 
     if (group.source === 'ldap') throw new BoxError(BoxError.BAD_STATE, 'Cannot set name of external group');
 
     await update(group.id, { name });
+
+    await eventlog.add(eventlog.ACTION_GROUP_UPDATE, auditSource, { oldName: group.name, group });
 }
 
-async function resetSource() {
+async function resetSources() {
     await database.query('UPDATE userGroups SET source = ?', [ '' ]);
 }