New System Log Event

//native

import * as wmill from "windmill-client"

/**

 * New System Log Event

 * Emits Okta System Log events published since the last poll, tracked via Windmill state. Pass an optional `filter` expression (e.g. eventType eq "user.session.start") to scope the events watched. The first run sets the watermark to now and emits nothing.

 */

export async function main(auth: RT.Okta, filter: string | undefined) {

  const lastChecked: string | undefined = await wmill.getState()

  // First run: set the watermark to now and don't emit a backlog.

  if (!lastChecked) {

    await wmill.setState(new Date().toISOString())

    return []

  }

  const url = new URL(`${auth.org_url}/api/v1/logs`)

  url.searchParams.append("since", lastChecked)

  url.searchParams.append("sortOrder", "ASCENDING")

  url.searchParams.append("limit", "1000")

  if (filter !== undefined && filter !== "")

    url.searchParams.append("filter", filter)

  const response = await fetch(url, {

    method: "GET",

    headers: {

      Authorization: `SSWS ${auth.token}`,

      Accept: "application/json",

    },

  })

  if (!response.ok) {

    throw new Error(`${response.status} ${await response.text()}`)

  }

  const events: Array<{ uuid: string; published: string }> =

    await response.json()

  // `since` is inclusive, so drop events at or before the watermark already emitted.

  const fresh = events.filter((e) => e.published > lastChecked)

  if (fresh.length > 0) {

    await wmill.setState(fresh[fresh.length - 1].published)

  }

  return fresh

}