//native
import * as wmill from "windmill-client"
/**
* New System Log Event
* Emits Okta System Log events published since the last poll, tracked via Windmill state. Pass an optional `filter` expression (e.g. eventType eq "user.session.start") to scope the events watched. The first run sets the watermark to now and emits nothing.
*/
export async function main(auth: RT.Okta, filter: string | undefined) {
const lastChecked: string | undefined = await wmill.getState()
// First run: set the watermark to now and don't emit a backlog.
if (!lastChecked) {
await wmill.setState(new Date().toISOString())
return []
}
const url = new URL(`${auth.org_url}/api/v1/logs`)
url.searchParams.append("since", lastChecked)
url.searchParams.append("sortOrder", "ASCENDING")
url.searchParams.append("limit", "1000")
if (filter !== undefined && filter !== "")
url.searchParams.append("filter", filter)
const response = await fetch(url, {
method: "GET",
headers: {
Authorization: `SSWS ${auth.token}`,
Accept: "application/json",
},
})
if (!response.ok) {
throw new Error(`${response.status} ${await response.text()}`)
}
const events: Array<{ uuid: string; published: string }> =
await response.json()
// `since` is inclusive, so drop events at or before the watermark already emitted.
const fresh = events.filter((e) => e.published > lastChecked)
if (fresh.length > 0) {
await wmill.setState(fresh[fresh.length - 1].published)
}
return fresh
}
Submitted by hugo989 5 days ago