feat: internal audit logging system

[oliverqx]

/claim #1461

What does this PR do?

This PR adds an internal audit logging system to cal.com. Its designed to log actions using the expected audit-logging app.

• Fixes [CAL-1710] Audit log #1461 (GitHub issue number)
• Fixes CAL-1710 (Linear issue number - should be visible at the bottom of the GitHub issue description)

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected)
• I have added a Docs issue here if this PR makes changes that would require a documentation change
• I have added or modified automated tests that prove my fix is effective or that my feature works (PRs might be rejected if logical changes are not properly tested)

How should this be tested?

• Are there environment variables that should be set?
• What are the minimal test data to have?
• What is expected (happy path) to have (input and output)?
• Any other important info that could help to test that PR

[vercel]

@oliverqx is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for following the naming conventions! 🙏 Feel free to join our discord and post your PR link.

[github-actions]

📦 Next.js Bundle Analysis for @calcom/web

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

[oliverqx]

I'm trying to compile a list of all possible actions that can be logged by the audit system. So far I've this:

Webhooks
	- Create
	- Modify
		Event Triggers
		Subscriber URL
		Secret
		Payload Template
	- Enable	
	- Disable
	- Delete
API Keys
	- Create
	- Modify
		- Name
Schedule
	- Modified
		Available Hours
		Date Overrides
		Timezone
		Metadata
	- Created
	- Deleted
Bookings
	- Modified
		Reschedule
		Edit Location
	- Created
	- Cancelled
	- Reschedule Requested
Event-Types
	- Modified
		Event Setup
		Availability
		Limits
		Advanced
		Recurring
		Apps
		Workflows
		Webhooks
		Visibility
	- Created
	- Duplicate
	- Delete
Teams
	- Modified
		Members
		Profile
		Apperance
		Availability
	- Created
	- Duplicate
	- Deleted
User Profile
	- Modified
		Profile
		General
		Calendar	
		Conferencing
		Appearance
		Out of Office
	- Created
	- Delete
Password
	- Modified
	- Created
	- Delete
Impersonation
	- On
	- Off

cc: @PeerRich

[oliverqx]

cc: @baileypumfleet

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[graphite-app]

Graphite Automations

"Add community label" took an action on this PR • (05/15/24)

1 label was added to this PR based on Keith Williams's automation.

"Add foundation team as reviewer" took an action on this PR • (05/15/24)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add consumer team as reviewer" took an action on this PR • (05/15/24)

1 reviewer was added to this PR based on Keith Williams's automation.

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source
Install scripts	npm/core-js@3.37.1	Install script: postinstall Source: node -e "try{require('./postinstall')}catch(e){}"	orphan: npm/core-js@3.37.1

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/core-js@3.37.1

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@types/node@16.9.1	None	0	1.63 MB	types
npm/@types/react@18.0.26	None	0	178 kB	types
npm/calcom-monorepo@0.0.0-use.local	None	0	0 B
npm/hyperlinker@1.0.0	None	0	5.58 kB	jamestalmage

🚮 Removed packages: npm/@aashutoshrathi/word-wrap@1.2.6, npm/@babel/helper-environment-visitor@7.22.20, npm/@babel/helper-replace-supers@7.24.1, npm/@babel/regjsgen@0.8.0, npm/@bcoe/v8-coverage@0.2.3, npm/@hapi/hoek@9.3.0, npm/@humanwhocodes/module-importer@1.0.1, npm/@istanbuljs/schema@0.1.3, npm/@jridgewell/sourcemap-codec@1.4.15, npm/@nodelib/fs.stat@2.0.5, npm/@protobufjs/aspromise@1.1.2, npm/@protobufjs/base64@1.1.2, npm/@protobufjs/codegen@2.0.4, npm/@protobufjs/eventemitter@1.1.0, npm/@protobufjs/float@1.0.2, npm/@protobufjs/inquire@1.1.0, npm/@protobufjs/path@1.1.2, npm/@protobufjs/pool@1.1.0, npm/@protobufjs/utf8@1.1.0, npm/@sideway/formula@3.0.1, npm/@sideway/pinpoint@2.0.0, npm/@sinclair/typebox@0.27.8, npm/@ungap/structured-clone@1.2.0, npm/@xtuc/ieee754@1.2.0, npm/@xtuc/long@4.2.2, npm/ansi-regex@6.0.1, npm/argparse@2.0.1, npm/array-union@2.1.0, npm/assert-plus@1.0.0, npm/asynckit@0.4.0, npm/aws-sign2@0.7.0, npm/balanced-match@1.0.2, npm/base64-js@1.5.1, npm/big.js@5.2.2, npm/bignumber.js@9.1.2, npm/binary-extensions@2.3.0, npm/bluebird@3.7.2, npm/bn.js@5.2.1, npm/bowser@2.11.0, npm/brorand@1.1.0, npm/buffer-crc32@0.2.13, npm/buffer-from@1.1.2, npm/buffer-xor@1.0.3, npm/builtin-status-codes@3.0.0, npm/callsites@3.1.0, npm/camelcase@5.3.1, npm/caseless@0.12.0, npm/char-regex@1.0.2, npm/chardet@0.7.0, npm/chownr@1.1.4, npm/chrome-trace-event@1.0.3, npm/cli-width@3.0.0, npm/clone@1.0.4, npm/co@4.6.0, npm/color-name@1.1.3, npm/colorette@2.0.20, npm/commondir@1.0.1, npm/component-emitter@1.3.1, npm/concat-map@0.0.1, npm/console-browserify@1.2.0, npm/constants-browserify@1.0.0, npm/convert-source-map@2.0.0, npm/core-util-is@1.0.2, npm/crc-32@1.2.2, npm/crypto-random-string@2.0.0, npm/decamelize@1.2.0, npm/deep-extend@0.6.0, npm/delayed-stream@1.0.0, npm/detect-indent@6.1.0, npm/detect-newline@3.1.0, npm/diff-sequences@29.6.3, npm/eastasianwidth@0.2.0, npm/emittery@0.13.1, npm/emoji-regex@9.2.2, npm/emojis-list@3.0.0, npm/es-errors@1.3.0, npm/escape-string-regexp@1.0.5, npm/eslint-visitor-keys@3.4.3, npm/esprima@4.0.1, npm/estraverse@5.3.0, npm/esutils@2.0.3, npm/eventemitter3@4.0.7, npm/events@3.3.0, npm/exit@0.1.2, npm/extend@3.0.2, npm/extsprintf@1.3.0, npm/fast-deep-equal@3.1.3, npm/fast-json-stable-stringify@2.1.0, npm/forever-agent@0.6.1, npm/fs-constants@1.0.0, npm/fs.realpath@1.0.0, npm/fsevents@2.3.3, npm/function-bind@1.1.2, npm/gensync@1.0.0-beta.2, npm/get-caller-file@2.0.5, npm/get-package-type@0.1.0, npm/graceful-fs@4.2.11, npm/graphemer@1.4.0, npm/har-schema@2.0.0, npm/has-flag@3.0.0, npm/has-proto@1.0.3, npm/has-symbols@1.0.3, npm/html-escaper@2.0.2, npm/https-browserify@1.0.0, npm/human-signals@2.1.0, npm/husky@8.0.3, npm/ieee754@1.2.1, npm/imurmurhash@0.1.4, npm/indent-string@4.0.0, npm/indexof@0.0.1, npm/infer-owner@1.0.4, npm/inherits@2.0.4, npm/ini@1.3.8, npm/interpret@1.4.0, npm/is-arrayish@0.2.1, npm/is-buffer@1.1.6, npm/is-callable@1.2.7, npm/is-extglob@2.1.1, npm/is-fullwidth-code-point@4.0.0, npm/is-generator-fn@2.1.0, npm/is-interactive@1.0.0, npm/is-number@7.0.0, npm/is-obj@2.0.0, npm/is-path-cwd@2.2.0, npm/is-path-inside@3.0.3, npm/is-typedarray@1.0.0, npm/is-unicode-supported@0.1.0, npm/is-windows@1.0.2, npm/isexe@2.0.0, npm/isobject@3.0.1, npm/isstream@0.1.2, npm/jest-get-type@29.6.3, npm/jest-regex-util@29.6.3, npm/js-tokens@4.0.0, npm/jsbn@0.1.1, npm/jsesc@2.5.2, npm/json-parse-better-errors@1.0.2, npm/json-parse-even-better-errors@2.3.1, npm/json-schema-traverse@1.0.0, npm/json-schema@0.4.0, npm/json-stable-stringify-without-jsonify@1.0.1, npm/json-stringify-safe@5.0.1, npm/json5@2.2.3, npm/kind-of@6.0.3, npm/kleur@3.0.3, npm/lodash.camelcase@4.3.0, npm/lodash.debounce@4.0.8, npm/lodash.defaults@4.2.0, npm/lodash.difference@4.5.0, npm/lodash.flatten@4.4.0, npm/lodash.get@4.4.2, npm/lodash.isplainobject@4.0.6, npm/lodash.merge@4.6.2, npm/lodash.union@4.6.0, npm/lodash@4.17.21, npm/lowercase-keys@2.0.0, npm/makeerror@1.0.12, npm/map-cache@0.2.2, npm/merge-stream@2.0.0, npm/merge2@1.4.1, npm/mime-db@1.52.0, npm/mimic-response@1.0.1, npm/minimalistic-assert@1.0.1, npm/minimalistic-crypto-utils@1.0.1, npm/minimist@1.2.8, npm/ms@2.1.2, npm/mute-stream@0.0.8, npm/natural-compare-lite@1.4.0, npm/natural-compare@1.4.0, npm/neo-async@2.6.2, npm/nice-try@1.0.5, npm/node-int64@0.4.0, npm/normalize-path@3.0.0, npm/oauth-sign@0.9.0, npm/object-inspect@1.13.1, npm/object-keys@1.1.1, npm/obuf@1.1.2, npm/os-browserify@0.3.0, npm/os-tmpdir@1.0.2, npm/p-finally@1.0.0, npm/p-try@2.2.0, npm/pako@1.0.11, npm/path-exists@4.0.0, npm/path-is-absolute@1.0.1, npm/path-key@3.1.1, npm/path-parse@1.0.7, npm/path-root-regex@0.1.2, npm/path-type@4.0.0, npm/performance-now@2.1.0, npm/pg-int8@1.0.1, npm/pg-numeric@1.0.2, npm/picomatch@2.3.1, npm/pify@4.0.1, npm/pirates@4.0.6, npm/postgres-array@2.0.0, npm/postgres-bytea@1.0.0, npm/postgres-date@1.0.7, npm/prelude-ls@1.2.1, npm/process-nextick-args@2.0.1, npm/process@0.11.10, npm/prr@1.0.1, npm/punycode@2.3.1, npm/querystring-es3@0.2.1, npm/querystringify@2.2.0, npm/queue-microtask@1.2.3, npm/regenerate@1.4.2, npm/remove-trailing-separator@1.1.0, npm/repeat-string@1.6.1, npm/require-directory@2.1.1, npm/require-from-string@2.0.2, npm/require-main-filename@2.0.0, npm/requires-port@1.0.0, npm/resolve-from@4.0.0, npm/resolve.exports@2.0.2, npm/reusify@1.0.4, npm/run-async@2.4.1, npm/safe-buffer@5.2.1, npm/safer-buffer@2.1.2, npm/set-blocking@2.0.0, npm/setimmediate@1.0.5, npm/shebang-regex@1.0.0, npm/sisteransi@1.0.5, npm/slash@3.0.0, npm/source-map@0.6.1, npm/sprintf-js@1.0.3, npm/stream-shift@1.0.3, npm/string-argv@0.3.2, npm/strip-final-newline@2.0.0, npm/strip-json-comments@3.1.1, npm/strnum@1.0.5, npm/supports-preserve-symlinks-flag@1.0.0, npm/text-table@0.2.0, npm/through@2.3.8, npm/tmpl@1.0.5, npm/to-fast-properties@2.0.0, npm/tr46@0.0.3, npm/tslib@2.6.2, npm/tunnel@0.0.6, npm/tweetnacl@0.14.5, npm/type-detect@4.0.8, npm/type-fest@0.21.3, npm/typedarray@0.0.6, npm/uglify-js@3.17.4, npm/unc-path-regex@0.1.2, npm/unicode-canonical-property-names-ecmascript@2.0.0, npm/unicode-match-property-value-ecmascript@2.1.0, npm/util-deprecate@1.0.2, npm/uuid@8.3.2, npm/vm-browserify@1.1.2, npm/which-module@2.0.1, npm/wordwrap@1.0.0, npm/wrappy@1.0.2, npm/xtend@4.0.2, npm/y18n@5.0.8, npm/yallist@4.0.0, npm/yaml@1.10.2, npm/yocto-queue@0.1.0

View full report↗︎