chore: release v2.4.1

Fixes #1144

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -9,10 +9,3 @@ body:
     attributes:
       label: Additional information
       description: Add any other information related to the change here. If your idea is related to any issues or discussions, link them here.
-  - type: checkboxes
-    id: contribute
-    attributes:
-      label: Contribute
-      description: Are you willing to contribute to the implementation of this idea?
-      options:
-        - label: Yes, I can implement this and raise a PR

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "langfuse-core",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "langfuse-core",
-      "version": "2.4.0",
+      "version": "2.4.1",
       "hasInstallScript": true,
       "dependencies": {
         "@anthropic-ai/tokenizer": "^0.0.4",
@@ -51,7 +51,6 @@
         "@trpc/next": "^10.45.0",
         "@trpc/react-query": "^10.45.0",
         "@trpc/server": "^10.45.0",
-        "@vercel/edge-config": "^0.4.1",
         "bcryptjs": "^2.4.3",
         "class-variance-authority": "^0.7.0",
         "clsx": "^2.1.0",
@@ -63,7 +62,7 @@
         "exponential-backoff": "^3.1.1",
         "js-tiktoken": "^1.0.10",
         "lodash": "^4.17.21",
-        "lucide-react": "^0.323.0",
+        "lucide-react": "^0.330.0",
         "next": "^14.1.0",
         "next-auth": "^4.24.5",
         "next-query-params": "^5.0.0",
@@ -6871,22 +6870,6 @@
       "integrity": "sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==",
       "dev": true
     },
-    "node_modules/@vercel/edge-config": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@vercel/edge-config/-/edge-config-0.4.1.tgz",
-      "integrity": "sha512-4Mc3H7lE+x4RrL17nY8CWeEorvJHbkNbQTy9p8H1tO7y11WeKj5xeZSr07wNgfWInKXDUwj5FZ3qd/jIzjPxug==",
-      "dependencies": {
-        "@vercel/edge-config-fs": "0.1.0"
-      },
-      "engines": {
-        "node": ">=14.6"
-      }
-    },
-    "node_modules/@vercel/edge-config-fs": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/@vercel/edge-config-fs/-/edge-config-fs-0.1.0.tgz",
-      "integrity": "sha512-NRIBwfcS0bUoUbRWlNGetqjvLSwgYH/BqKqDN7vK1g32p7dN96k0712COgaz6VFizAm9b0g6IG6hR6+hc0KCPg=="
-    },
     "node_modules/abab": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
@@ -13487,9 +13470,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "0.323.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.323.0.tgz",
-      "integrity": "sha512-rTXZFILl2Y4d1SG9p1Mdcf17AcPvPvpc/egFIzUrp7IUy60MUQo3Oi1mu8LGYXUVwuRZYsSMt3csHRW5mAovJg==",
+      "version": "0.330.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.330.0.tgz",
+      "integrity": "sha512-CQwY+Fpbt2kxCoVhuN0RCZDCYlbYnqB870Bl/vIQf3ER/cnDDQ6moLmEkguRyruAUGd4j3Lc4mtnJosXnqHheA==",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0"
       }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "langfuse-core",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "private": true,
   "scripts": {
     "prebuild": "cp generated/openapi-client/openapi.yml public/openapi-client.yml && cp generated/openapi-server/openapi.yml public/openapi-server.yml",
@@ -71,7 +71,6 @@
     "@trpc/next": "^10.45.0",
     "@trpc/react-query": "^10.45.0",
     "@trpc/server": "^10.45.0",
-    "@vercel/edge-config": "^0.4.1",
     "bcryptjs": "^2.4.3",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.0",
@@ -83,7 +82,7 @@
     "exponential-backoff": "^3.1.1",
     "js-tiktoken": "^1.0.10",
     "lodash": "^4.17.21",
-    "lucide-react": "^0.323.0",
+    "lucide-react": "^0.330.0",
     "next": "^14.1.0",
     "next-auth": "^4.24.5",
     "next-query-params": "^5.0.0",

prisma/migrations/20240212175433_add_audit_log_table/migration.sql

@@ -0,0 +1,28 @@
+-- CreateTable
+CREATE TABLE "audit_logs" (
+    "id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "user_id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "user_project_role" "MembershipRole" NOT NULL,
+    "resource_type" TEXT NOT NULL,
+    "resource_id" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "before" TEXT,
+    "after" TEXT,
+
+    CONSTRAINT "audit_logs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "audit_logs_project_id_idx" ON "audit_logs"("project_id");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_created_at_idx" ON "audit_logs"("created_at");
+
+-- AddForeignKey
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20240213124148_update_openai_pricing/migration.sql

@@ -0,0 +1,25 @@
+-- This is an empty migration.
+
+DELETE FROM models
+WHERE id in ('clruwnahl00040al78f1lb0at');
+
+
+
+INSERT INTO models (
+  id,
+  project_id,
+  model_name,
+  match_pattern,
+  start_date,
+  input_price,
+  output_price,
+  total_price,
+  unit,
+  tokenizer_id,
+  tokenizer_config
+)
+VALUES
+  -- according to email, gpt-3.5-turbo and gpt-3.5-turbo-16k will point to 0125 models as of 2024-02-16
+  -- gpt-3.5-turbo-0125 now supports 16k token length. 16k model will point to regular 3.5 turbo model according to mail.
+  ('clruwnahl00040al78f1lb0at', NULL, 'gpt-3.5-turbo', '(?i)^(gpt-)(35|3.5)(-turbo)$', '2024-02-16', 0.0000005, 0.0000015, NULL, 'TOKENS', 'openai', '{ "tokensPerMessage": 3, "tokensPerName": 1, "tokenizerModel": "gpt-3.5-turbo" }'),
+  ('clsk9lntu000008jwfc51bbqv', NULL, 'gpt-3.5-turbo-16k', '(?i)^(gpt-)(35|3.5)(-turbo-16k)$', '2024-02-16', 0.0000005, 0.0000015, NULL, 'TOKENS', 'openai', '{ "tokensPerMessage": 3, "tokensPerName": 1, "tokenizerModel": "gpt-3.5-turbo-16k" }')

prisma/schema.prisma

@@ -72,6 +72,7 @@ model User {
     createdAt     DateTime               @default(now()) @map("created_at")
     updatedAt     DateTime               @default(now()) @updatedAt @map("updated_at")
     featureFlags  String[]               @default([]) @map("feature_flags")
+    AuditLog      AuditLog[]
 
     @@map("users")
 }
@@ -101,6 +102,7 @@ model Project {
     sessions     TraceSession[]
     Prompt       Prompt[]
     Model        Model[]
+    AuditLog     AuditLog[]
 
     @@map("projects")
 }
@@ -492,3 +494,23 @@ view ObservationView {
 
     @@map("observations_view")
 }
+
+model AuditLog {
+    id              String         @id @default(cuid())
+    createdAt       DateTime       @default(now()) @map("created_at")
+    updatedAt       DateTime       @default(now()) @updatedAt @map("updated_at")
+    userId          String         @map("user_id")
+    user            User           @relation(fields: [userId], references: [id], onDelete: Cascade)
+    projectId       String         @map("project_id")
+    project         Project        @relation(fields: [projectId], references: [id], onDelete: Cascade)
+    userProjectRole MembershipRole @map("user_project_role")
+    resourceType    String         @map("resource_type")
+    resourceId      String         @map("resource_id")
+    action          String
+    before          String? //stringified JSON
+    after           String? // stringified JSON
+
+    @@index([projectId])
+    @@index([createdAt])
+    @@map("audit_logs")
+}

src/constants/VERSION.ts

@@ -1 +1 @@
-export const VERSION = "v2.4.0";
+export const VERSION = "v2.4.1";

src/features/audit-logs/auditLog.ts

@@ -0,0 +1,57 @@
+import { prisma as _prisma } from "@/src/server/db";
+import { type MembershipRole } from "@prisma/client";
+
+export type AuditableResource =
+  | "membership"
+  | "membershipInvitation"
+  | "datasetItem"
+  | "dataset"
+  | "trace"
+  | "project"
+  | "observation"
+  | "score"
+  | "model"
+  | "prompt"
+  | "session"
+  | "apiKey";
+
+type AuditLog = {
+  resourceType: AuditableResource;
+  resourceId: string;
+  action: string;
+  before?: unknown;
+  after?: unknown;
+} & (
+  | {
+      projectId: string;
+      userId: string;
+      userProjectRole: MembershipRole;
+    }
+  | {
+      session: {
+        user: {
+          id: string;
+        };
+        projectRole: MembershipRole;
+        projectId: string;
+      };
+    }
+);
+
+export async function auditLog(log: AuditLog, prisma?: typeof _prisma) {
+  await (prisma ?? _prisma).auditLog.create({
+    data: {
+      projectId: "projectId" in log ? log.projectId : log.session.projectId,
+      userId: "userId" in log ? log.userId : log.session.user.id,
+      userProjectRole:
+        "userProjectRole" in log
+          ? log.userProjectRole
+          : log.session.projectRole,
+      resourceType: log.resourceType,
+      resourceId: log.resourceId,
+      action: log.action,
+      before: log.before ? JSON.stringify(log.before) : undefined,
+      after: log.after ? JSON.stringify(log.after) : undefined,
+    },
+  });
+}

src/features/datasets/server/dataset-router.ts

@@ -6,6 +6,7 @@ import {
 } from "@/src/server/api/trpc";
 import { type DatasetRuns, Prisma, type Dataset } from "@prisma/client";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 export const datasetRouter = createTRPCRouter({
   allDatasets: protectedProjectProcedure
@@ -203,7 +204,7 @@ export const datasetRouter = createTRPCRouter({
         projectId: input.projectId,
         scope: "datasets:CUD",
       });
-      return ctx.prisma.datasetItem.update({
+      const datasetItem = await ctx.prisma.datasetItem.update({
         where: {
           id: input.datasetItemId,
           datasetId: input.datasetId,
@@ -226,6 +227,15 @@ export const datasetRouter = createTRPCRouter({
           status: input.status,
         },
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "datasetItem",
+        resourceId: input.datasetItemId,
+        projectId: input.projectId,
+        action: "update",
+        after: datasetItem,
+      });
+      return datasetItem;
     }),
   createDataset: protectedProjectProcedure
     .input(z.object({ projectId: z.string(), name: z.string() }))
@@ -235,12 +245,23 @@ export const datasetRouter = createTRPCRouter({
         projectId: input.projectId,
         scope: "datasets:CUD",
       });
-      return ctx.prisma.dataset.create({
+      const dataset = await ctx.prisma.dataset.create({
         data: {
           name: input.name,
           projectId: input.projectId,
         },
       });
+
+      await auditLog({
+        session: ctx.session,
+        resourceType: "dataset",
+        resourceId: dataset.id,
+        projectId: input.projectId,
+        action: "create",
+        after: dataset,
+      });
+
+      return dataset;
     }),
   deleteDataset: protectedProjectProcedure
     .input(z.object({ projectId: z.string(), datasetId: z.string() }))
@@ -250,12 +271,21 @@ export const datasetRouter = createTRPCRouter({
         projectId: input.projectId,
         scope: "datasets:CUD",
       });
-      return ctx.prisma.dataset.delete({
+      const deletedDataset = await ctx.prisma.dataset.delete({
         where: {
           id: input.datasetId,
           projectId: input.projectId,
         },
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "dataset",
+        resourceId: deletedDataset.id,
+        projectId: input.projectId,
+        action: "delete",
+        before: deletedDataset,
+      });
+      return deletedDataset;
     }),
   createDatasetItem: protectedProjectProcedure
     .input(
@@ -283,7 +313,7 @@ export const datasetRouter = createTRPCRouter({
         throw new Error("Dataset not found");
       }
 
-      return ctx.prisma.datasetItem.create({
+      const datasetItem = await ctx.prisma.datasetItem.create({
         data: {
           input: JSON.parse(input.input) as Prisma.InputJsonObject,
           expectedOutput:
@@ -296,6 +326,15 @@ export const datasetRouter = createTRPCRouter({
           sourceObservationId: input.sourceObservationId,
         },
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "datasetItem",
+        resourceId: datasetItem.id,
+        projectId: input.projectId,
+        action: "create",
+        after: datasetItem,
+      });
+      return datasetItem;
     }),
   runitemsByRunIdOrItemId: protectedProjectProcedure
     .input(

src/features/feedback/server/feedbackHandler.ts

@@ -10,7 +10,7 @@ export default async function feedbackApiHandler(
   await runFeedbackCorsMiddleware(req, res);
 
   try {
-    const slackResponse = await sendToSlack(req);
+    const slackResponse = await sendToSlack(req.body);
     if (slackResponse.status === 200) {
       res.status(200).json({ status: "OK" });
     } else {

src/features/projects/server/projectsRouter.ts

@@ -1,8 +1,13 @@
-import { createTRPCRouter, protectedProcedure } from "@/src/server/api/trpc";
+import {
+  createTRPCRouter,
+  protectedProcedure,
+  protectedProjectProcedure,
+} from "@/src/server/api/trpc";
 import * as z from "zod";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
 import { TRPCError } from "@trpc/server";
 import { projectNameSchema } from "@/src/features/auth/lib/projectNameSchema";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 export const projectsRouter = createTRPCRouter({
   all: protectedProcedure.query(async ({ ctx }) => {
@@ -66,6 +71,15 @@ export const projectsRouter = createTRPCRouter({
           },
         },
       });
+      await auditLog({
+        resourceType: "project",
+        resourceId: project.id,
+        action: "create",
+        userId: ctx.session.user.id,
+        projectId: project.id,
+        userProjectRole: "OWNER",
+        after: project,
+      });
 
       return {
         id: project.id,
@@ -74,7 +88,7 @@ export const projectsRouter = createTRPCRouter({
       };
     }),
 
-  update: protectedProcedure
+  update: protectedProjectProcedure
     .input(
       z.object({
         projectId: z.string(),
@@ -88,7 +102,7 @@ export const projectsRouter = createTRPCRouter({
         scope: "project:update",
       });
 
-      await ctx.prisma.project.update({
+      const project = await ctx.prisma.project.update({
         where: {
           id: input.projectId,
         },
@@ -96,10 +110,17 @@ export const projectsRouter = createTRPCRouter({
           name: input.newName,
         },
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "project",
+        resourceId: input.projectId,
+        action: "update",
+        after: project,
+      });
       return true;
     }),
 
-  delete: protectedProcedure
+  delete: protectedProjectProcedure
     .input(
       z.object({
         projectId: z.string(),
@@ -111,6 +132,12 @@ export const projectsRouter = createTRPCRouter({
         projectId: input.projectId,
         scope: "project:delete",
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "project",
+        resourceId: input.projectId,
+        action: "delete",
+      });
 
       await ctx.prisma.project.delete({
         where: {
@@ -121,7 +148,7 @@ export const projectsRouter = createTRPCRouter({
       return true;
     }),
 
-  transfer: protectedProcedure
+  transfer: protectedProjectProcedure
     .input(
       z.object({
         projectId: z.string(),
@@ -145,6 +172,14 @@ export const projectsRouter = createTRPCRouter({
       if (newOwner.id === ctx.session.user.id)
         throw new Error("You cannot transfer project to yourself");
 
+      await auditLog({
+        session: ctx.session,
+        resourceType: "project",
+        resourceId: input.projectId,
+        action: "transfer",
+        after: { ownerId: newOwner.id },
+      });
+
       return ctx.prisma.$transaction([
         // Add new owner, upsert to update role if already exists
         ctx.prisma.membership.upsert({

src/features/prompts/components/new-prompt-button.tsx

@@ -153,11 +153,9 @@ export const NewPromptForm = (props: {
         props.onFormSuccess?.();
         form.reset();
         // go to the following page after creating the prompt
-        if (newPrompt) {
-          void router.push(
-            `/project/${props.projectId}/prompts/${newPrompt.name}`,
-          );
-        }
+        void router.push(
+          `/project/${props.projectId}/prompts/${newPrompt.name}`,
+        );
       })
       .catch((error) => {
         console.error(error);

src/features/prompts/server/prompt-router.ts

@@ -6,6 +6,7 @@ import {
 } from "@/src/server/api/trpc";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
 import { type Prompt, type PrismaClient } from "@prisma/client";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 export const CreatePrompt = z.object({
   projectId: z.string(),
@@ -70,7 +71,7 @@ export const promptRouter = createTRPCRouter({
           scope: "prompts:CUD",
         });
 
-        return await createPrompt({
+        const prompt = await createPrompt({
           projectId: input.projectId,
           name: input.name,
           prompt: input.prompt,
@@ -78,6 +79,23 @@ export const promptRouter = createTRPCRouter({
           createdBy: ctx.session.user.id,
           prisma: ctx.prisma,
         });
+
+        if (!prompt) {
+          throw new Error("Failed to create prompt");
+        }
+
+        await auditLog(
+          {
+            session: ctx.session,
+            resourceType: "prompt",
+            resourceId: prompt.id,
+            action: "create",
+            after: prompt,
+          },
+          ctx.prisma,
+        );
+
+        return prompt;
       } catch (e) {
         console.log(e);
         throw e;
@@ -98,12 +116,35 @@ export const promptRouter = createTRPCRouter({
           scope: "prompts:CUD",
         });
 
-        await ctx.prisma.prompt.deleteMany({
+        // fetch prompts before deletion to enable audit logging
+        const prompts = await ctx.prisma.prompt.findMany({
           where: {
             projectId: input.projectId,
             name: input.promptName,
           },
         });
+
+        for (const prompt of prompts) {
+          await auditLog(
+            {
+              session: ctx.session,
+              resourceType: "prompt",
+              resourceId: prompt.id,
+              action: "delete",
+              before: prompt,
+            },
+            ctx.prisma,
+          );
+        }
+
+        await ctx.prisma.prompt.deleteMany({
+          where: {
+            projectId: input.projectId,
+            id: {
+              in: prompts.map((p) => p.id),
+            },
+          },
+        });
       } catch (e) {
         console.log(e);
         throw e;
@@ -124,6 +165,24 @@ export const promptRouter = createTRPCRouter({
           scope: "prompts:CUD",
         });
 
+        const promptVersion = await ctx.prisma.prompt.findFirstOrThrow({
+          where: {
+            id: input.promptVersionId,
+            projectId: input.projectId,
+          },
+        });
+
+        await auditLog(
+          {
+            session: ctx.session,
+            resourceType: "prompt",
+            resourceId: input.promptVersionId,
+            action: "delete",
+            before: promptVersion,
+          },
+          ctx.prisma,
+        );
+
         await ctx.prisma.prompt.delete({
           where: {
             id: input.promptVersionId,
@@ -151,6 +210,20 @@ export const promptRouter = createTRPCRouter({
           },
         });
 
+        await auditLog(
+          {
+            session: ctx.session,
+            resourceType: "prompt",
+            resourceId: toBePromotedPrompt.id,
+            action: "promote",
+            after: {
+              ...toBePromotedPrompt,
+              isActive: true,
+            },
+          },
+          ctx.prisma,
+        );
+
         const latestActivePrompt = await ctx.prisma.prompt.findFirst({
           where: {
             projectId: input.projectId,

src/features/public-api/server/apiKeyRouter.ts

@@ -1,3 +1,4 @@
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 import { generateKeySet } from "@/src/features/public-api/lib/apiKeys";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
 import {
@@ -64,6 +65,13 @@ export const apiKeysRouter = createTRPCRouter({
         },
       });
 
+      await auditLog({
+        session: ctx.session,
+        resourceType: "apiKey",
+        resourceId: apiKey.id,
+        action: "create",
+      });
+
       return {
         id: apiKey.id,
         createdAt: apiKey.createdAt,
@@ -86,6 +94,12 @@ export const apiKeysRouter = createTRPCRouter({
         projectId: input.projectId,
         scope: "apiKeys:delete",
       });
+      await auditLog({
+        session: ctx.session,
+        resourceType: "apiKey",
+        resourceId: input.id,
+        action: "delete",
+      });
 
       // Make sure the API key exists and belongs to the project the user has access to
       const apiKey = await ctx.prisma.apiKey.findFirstOrThrow({

src/features/rbac/server/projectMembersRouter.ts

@@ -1,3 +1,4 @@
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 import { sendProjectInvitation } from "@/src/features/email/lib/project-invitation";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
 import {
@@ -5,6 +6,7 @@ import {
   protectedProjectProcedure,
 } from "@/src/server/api/trpc";
 import { MembershipRole } from "@prisma/client";
+import { TRPCError } from "@trpc/server";
 import * as z from "zod";
 
 export const projectMembersRouter = createTRPCRouter({
@@ -75,8 +77,7 @@ export const projectMembersRouter = createTRPCRouter({
       if (input.userId === ctx.session.user.id)
         throw new Error("You cannot remove yourself from a project");
 
-      // use deleteMany to protect against deleting owner with where clause
-      return ctx.prisma.membership.deleteMany({
+      const membership = await ctx.prisma.membership.findFirst({
         where: {
           projectId: input.projectId,
           userId: input.userId,
@@ -85,6 +86,26 @@ export const projectMembersRouter = createTRPCRouter({
           },
         },
       });
+
+      if (!membership) throw new TRPCError({ code: "NOT_FOUND" });
+
+      await auditLog({
+        session: ctx.session,
+        resourceType: "membership",
+        resourceId: membership.projectId + "--" + membership.userId,
+        action: "delete",
+        before: membership,
+      });
+
+      // use ids from membership to make sure owners cannot delete themselves
+      return await ctx.prisma.membership.delete({
+        where: {
+          projectId_userId: {
+            projectId: membership.projectId,
+            userId: membership.userId,
+          },
+        },
+      });
     }),
   deleteInvitation: protectedProjectProcedure
     .input(
@@ -100,6 +121,13 @@ export const projectMembersRouter = createTRPCRouter({
         scope: "members:delete",
       });
 
+      await auditLog({
+        session: ctx.session,
+        resourceType: "membershipInvitation",
+        resourceId: input.id,
+        action: "delete",
+      });
+
       return await ctx.prisma.membershipInvitation.delete({
         where: {
           id: input.id,
@@ -132,13 +160,21 @@ export const projectMembersRouter = createTRPCRouter({
         },
       });
       if (user) {
-        return await ctx.prisma.membership.create({
+        const membership = await ctx.prisma.membership.create({
           data: {
             userId: user.id,
             projectId: input.projectId,
             role: input.role,
           },
         });
+        await auditLog({
+          session: ctx.session,
+          resourceType: "membership",
+          resourceId: input.projectId + "--" + user.id,
+          action: "create",
+          after: membership,
+        });
+        return membership;
       } else {
         const invitation = await ctx.prisma.membershipInvitation.create({
           data: {
@@ -148,6 +184,13 @@ export const projectMembersRouter = createTRPCRouter({
             senderId: ctx.session.user.id,
           },
         });
+        await auditLog({
+          session: ctx.session,
+          resourceType: "membershipInvitation",
+          resourceId: invitation.id,
+          action: "create",
+          after: invitation,
+        });
 
         const project = await ctx.prisma.project.findFirst({
           where: {

src/middleware/middleware.ts

@@ -1,35 +0,0 @@
-// Middleware to block requests from certain IPs on Langfuse Cloud
-// Not included in the self-host build, removed in Dockerfile
-
-// import { type NextApiRequest } from "next";
-// import { type NextRequest } from "next/server";
-// import { get } from "@vercel/edge-config";
-
-// export async function middleware(req: NextRequest) {
-//   try {
-//     if (process.env.NEXT_PUBLIC_LANGFUSE_CLOUD_REGION !== undefined) {
-//       const config = await get("blockedIps");
-//       const blockedIps = Array.isArray(config) ? config : [config];
-
-//       const ip = getIP(req);
-//       if (ip && blockedIps.includes(ip)) {
-//         console.log("Blocked request by ip: ", ip);
-//         return new Response("Access denied", { status: 403 });
-//       }
-//     }
-
-//     return;
-//   } catch (e) {
-//     console.error("Server side error in middleware: ", e);
-//     return new Response("Internal server error", { status: 500 });
-//   }
-// }
-
-// export default function getIP(request: Request | NextApiRequest) {
-//   const xff =
-//     request instanceof Request
-//       ? request.headers.get("x-forwarded-for")
-//       : request.headers["x-forwarded-for"];
-
-//   return xff ? (Array.isArray(xff) ? xff[0] : xff.split(",")[0]) : "127.0.0.1";
-// }

src/server/api/routers/models.ts

@@ -9,6 +9,7 @@ import {
 import { paginationZod } from "@/src/utils/zod";
 import { Prisma } from "@prisma/client";
 import { TRPCError } from "@trpc/server";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 const ModelAllOptions = z.object({
   projectId: z.string(),
@@ -77,12 +78,23 @@ export const modelRouter = createTRPCRouter({
         scope: "models:CUD",
       });
 
-      return ctx.prisma.model.delete({
+      const deletedModel = await ctx.prisma.model.delete({
         where: {
           id: input.modelId,
           projectId: input.projectId,
         },
       });
+
+      await auditLog({
+        session: ctx.session,
+        resourceType: "model",
+        resourceId: input.modelId,
+        projectId: input.projectId,
+        action: "delete",
+        before: deletedModel,
+      });
+
+      return deletedModel;
     }),
   create: protectedProjectProcedure
     .input(
@@ -119,7 +131,7 @@ export const modelRouter = createTRPCRouter({
         });
       }
 
-      return ctx.prisma.model.create({
+      const createdModel = await ctx.prisma.model.create({
         data: {
           projectId: input.projectId,
           modelName: input.modelName,
@@ -133,5 +145,16 @@ export const modelRouter = createTRPCRouter({
           tokenizerConfig: input.tokenizerConfig,
         },
       });
+
+      await auditLog({
+        session: ctx.session,
+        resourceType: "model",
+        resourceId: createdModel.id,
+        projectId: input.projectId,
+        action: "create",
+        after: createdModel,
+      });
+
+      return createdModel;
     }),
 });

src/server/api/routers/scores.ts

@@ -6,7 +6,7 @@ import {
   protectedProjectProcedure,
 } from "@/src/server/api/trpc";
 import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
-import { Prisma, type Score } from "@prisma/client";
+import { type MembershipRole, Prisma, type Score } from "@prisma/client";
 import { paginationZod } from "@/src/utils/zod";
 import { singleFilter } from "@/src/server/api/interfaces/filters";
 import { filterToPrismaSql } from "@/src/features/filters/server/filterToPrisma";
@@ -14,6 +14,7 @@ import {
   type ScoreOptions,
   scoresTableCols,
 } from "@/src/server/api/definitions/scoresTable";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 const ScoreFilterOptions = z.object({
   projectId: z.string(), // Required for protectedProjectProcedure
@@ -128,7 +129,7 @@ export const scoresRouter = createTRPCRouter({
         scope: "scores:CUD",
       });
 
-      return ctx.prisma.score.create({
+      const score = await ctx.prisma.score.create({
         data: {
           trace: {
             connect: {
@@ -149,6 +150,18 @@ export const scoresRouter = createTRPCRouter({
           comment: input.comment,
         },
       });
+      await auditLog({
+        projectId: trace.projectId,
+        userId: ctx.session.user.id,
+        userProjectRole: ctx.session.user.projects.find(
+          (p) => p.id === trace.projectId,
+        )?.role as MembershipRole, // throwIfNoAccess ensures this is defined
+        resourceType: "score",
+        resourceId: score.id,
+        action: "create",
+        after: score,
+      });
+      return score;
     }),
   update: protectedProcedure
     .input(
@@ -186,6 +199,21 @@ export const scoresRouter = createTRPCRouter({
         scope: "scores:CUD",
       });
 
+      // exclude trace object from audit log
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { trace, ...pureScore } = score;
+      await auditLog({
+        projectId: trace.projectId,
+        userId: ctx.session.user.id,
+        userProjectRole: ctx.session.user.projects.find(
+          (p) => p.id === trace.projectId,
+        )?.role as MembershipRole, // throwIfNoAccess ensures this is defined
+        resourceType: "score",
+        resourceId: score.id,
+        action: "update",
+        after: pureScore,
+      });
+
       return ctx.prisma.score.update({
         where: {
           id: score.id,
@@ -225,6 +253,18 @@ export const scoresRouter = createTRPCRouter({
         projectId: score.trace.projectId,
         scope: "scores:CUD",
       });
+      const { trace, ...pureScore } = score;
+      await auditLog({
+        projectId: trace.projectId,
+        userId: ctx.session.user.id,
+        userProjectRole: ctx.session.user.projects.find(
+          (p) => p.id === trace.projectId,
+        )?.role as MembershipRole, // throwIfNoAccess ensures this is defined
+        resourceType: "score",
+        resourceId: score.id,
+        action: "delete",
+        before: pureScore,
+      });
 
       return ctx.prisma.score.delete({
         where: {

src/server/api/routers/sessions.ts

@@ -14,6 +14,7 @@ import { throwIfNoAccess } from "@/src/features/rbac/utils/checkAccess";
 import { TRPCError } from "@trpc/server";
 import { orderBy } from "@/src/server/api/interfaces/orderBy";
 import { orderByToPrismaSql } from "@/src/features/orderBy/server/orderByToPrisma";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 const SessionFilterOptions = z.object({
   projectId: z.string(), // Required for protectedProjectProcedure
@@ -161,6 +162,14 @@ export const sessionRouter = createTRPCRouter({
           scope: "objects:bookmark",
         });
 
+        await auditLog({
+          session: ctx.session,
+          resourceType: "session",
+          resourceId: input.sessionId,
+          action: "bookmark",
+          after: input.bookmarked,
+        });
+
         const session = await ctx.prisma.traceSession.update({
           where: {
             id_projectId: {
@@ -205,6 +214,13 @@ export const sessionRouter = createTRPCRouter({
           projectId: input.projectId,
           scope: "objects:publish",
         });
+        await auditLog({
+          session: ctx.session,
+          resourceType: "session",
+          resourceId: input.sessionId,
+          action: "publish",
+          after: input.public,
+        });
         return ctx.prisma.traceSession.update({
           where: {
             id_projectId: {

src/server/api/routers/traces.ts

@@ -23,6 +23,7 @@ import { orderByToPrismaSql } from "@/src/features/orderBy/server/orderByToPrism
 import { type Sql } from "@prisma/client/runtime/library";
 import { instrumentAsync } from "@/src/utils/instrumentation";
 import type Decimal from "decimal.js";
+import { auditLog } from "@/src/features/audit-logs/auditLog";
 
 const TraceFilterOptions = z.object({
   projectId: z.string(), // Required for protectedProjectProcedure
@@ -284,6 +285,15 @@ export const traceRouter = createTRPCRouter({
         scope: "traces:delete",
       });
 
+      for (const traceId of input.traceIds) {
+        await auditLog({
+          resourceType: "trace",
+          resourceId: traceId,
+          action: "delete",
+          session: ctx.session,
+        });
+      }
+
       return ctx.prisma.$transaction([
         ctx.prisma.trace.deleteMany({
           where: {
@@ -318,6 +328,13 @@ export const traceRouter = createTRPCRouter({
         scope: "objects:bookmark",
       });
       try {
+        await auditLog({
+          session: ctx.session,
+          resourceType: "trace",
+          resourceId: input.traceId,
+          action: "bookmark",
+          after: input.bookmarked,
+        });
         const trace = await ctx.prisma.trace.update({
           where: {
             id: input.traceId,
@@ -360,6 +377,13 @@ export const traceRouter = createTRPCRouter({
         scope: "objects:publish",
       });
       try {
+        await auditLog({
+          session: ctx.session,
+          resourceType: "trace",
+          resourceId: input.traceId,
+          action: "publish",
+          after: input.public,
+        });
         const trace = await ctx.prisma.trace.update({
           where: {
             id: input.traceId,
@@ -413,6 +437,13 @@ export const traceRouter = createTRPCRouter({
             },
           },
         });
+        await auditLog({
+          session: ctx.session,
+          resourceType: "trace",
+          resourceId: input.traceId,
+          action: "updateTags",
+          after: input.tags,
+        });
         return trace;
       } catch (error) {
         console.error(error);

src/server/api/trpc.ts

@@ -175,6 +175,7 @@ const enforceUserIsAuthedAndProjectMember = t.middleware(
           user: ctx.session.user,
           projectRole:
             ctx.session.user.admin === true ? "ADMIN" : sessionProject!.role,
+          projectId: projectId,
         },
       },
     });