Add Audit Trail/Logging

cmd/admin.go

@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/services/audit"
 	auth_service "code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 	"code.gitea.io/gitea/services/auth/source/smtp"
@@ -480,6 +481,7 @@ func runAddOauth(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	config := parseOAuth2Config(c)
 	if config.Provider == "openidConnect" {
@@ -489,7 +491,7 @@ func runAddOauth(c *cli.Context) error {
 		}
 	}
 
-	return auth_model.CreateSource(&auth_model.Source{
+	return createSource(ctx, &auth_model.Source{
 		Type:     auth_model.OAuth2,
 		Name:     c.String("name"),
 		IsActive: true,
@@ -508,6 +510,7 @@ func runUpdateOauth(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	source, err := auth_model.GetSourceByID(c.Int64("id"))
 	if err != nil {
@@ -600,7 +603,7 @@ func runUpdateOauth(c *cli.Context) error {
 	oAuth2Config.CustomURLMapping = customURLMapping
 	source.Cfg = oAuth2Config
 
-	return auth_model.UpdateSource(source)
+	return updateSource(ctx, source)
 }
 
 func parseSMTPConfig(c *cli.Context, conf *smtp.Source) error {
@@ -646,6 +649,7 @@ func runAddSMTP(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	if !c.IsSet("name") || len(c.String("name")) == 0 {
 		return errors.New("name must be set")
@@ -671,7 +675,7 @@ func runAddSMTP(c *cli.Context) error {
 		smtpConfig.Auth = "PLAIN"
 	}
 
-	return auth_model.CreateSource(&auth_model.Source{
+	return createSource(ctx, &auth_model.Source{
 		Type:     auth_model.SMTP,
 		Name:     c.String("name"),
 		IsActive: active,
@@ -690,6 +694,7 @@ func runUpdateSMTP(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	source, err := auth_model.GetSourceByID(c.Int64("id"))
 	if err != nil {
@@ -712,7 +717,27 @@ func runUpdateSMTP(c *cli.Context) error {
 
 	source.Cfg = smtpConfig
 
-	return auth_model.UpdateSource(source)
+	return updateSource(ctx, source)
+}
+
+func createSource(ctx context.Context, source *auth_model.Source) error {
+	if err := auth_model.CreateSource(source); err != nil {
+		return err
+	}
+
+	audit.Record(audit.SystemAuthenticationSourceAdd, audit.NewCLIUser(), nil, source, "Created authentication source %s [%s].", source.Name, source.Type.String())
+
+	return nil
+}
+
+func updateSource(ctx context.Context, source *auth_model.Source) error {
+	if err := auth_model.UpdateSource(source); err != nil {
+		return err
+	}
+
+	audit.Record(audit.SystemAuthenticationSourceUpdate, audit.NewCLIUser(), nil, source, "Updated authentication source %s.", source.Name)
+
+	return nil
 }
 
 func runListAuth(c *cli.Context) error {
@@ -760,11 +785,12 @@ func runDeleteAuth(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	source, err := auth_model.GetSourceByID(c.Int64("id"))
 	if err != nil {
 		return err
 	}
 
-	return auth_service.DeleteSource(source)
+	return auth_service.DeleteSource(audit.NewCLIUser(), source)
 }

cmd/admin_auth_ldap.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/services/audit"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/urfave/cli/v2"
@@ -308,58 +309,26 @@ func (a *authService) getAuthSource(c *cli.Context, authType auth.Type) (*auth.S
 
 // addLdapBindDn adds a new LDAP via Bind DN authentication source.
 func (a *authService) addLdapBindDn(c *cli.Context) error {
-	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute"); err != nil {
-		return err
-	}
-
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := a.initDB(ctx); err != nil {
-		return err
-	}
-
-	authSource := &auth.Source{
-		Type:     auth.LDAP,
-		IsActive: true, // active by default
-		Cfg: &ldap.Source{
-			Enabled: true, // always true
-		},
-	}
-
-	parseAuthSource(c, authSource)
-	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
-		return err
-	}
-
-	return a.createAuthSource(authSource)
+	return a.addLdapSource(c, auth.LDAP, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute")
 }
 
 // updateLdapBindDn updates a new LDAP via Bind DN authentication source.
 func (a *authService) updateLdapBindDn(c *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := a.initDB(ctx); err != nil {
-		return err
-	}
-
-	authSource, err := a.getAuthSource(c, auth.LDAP)
-	if err != nil {
-		return err
-	}
-
-	parseAuthSource(c, authSource)
-	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
-		return err
-	}
-
-	return a.updateAuthSource(authSource)
+	return a.updateLdapSource(c, auth.LDAP)
 }
 
 // addLdapSimpleAuth adds a new LDAP (simple auth) authentication source.
 func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
-	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-dn", "user-filter", "email-attribute"); err != nil {
+	return a.addLdapSource(c, auth.DLDAP, "name", "security-protocol", "host", "port", "user-dn", "user-filter", "email-attribute")
+}
+
+// updateLdapBindDn updates a new LDAP (simple auth) authentication source.
+func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
+	return a.updateLdapSource(c, auth.DLDAP)
+}
+
+func (a *authService) addLdapSource(c *cli.Context, authType auth.Type, args ...string) error {
+	if err := argsSet(c, args...); err != nil {
 		return err
 	}
 
@@ -369,9 +338,10 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	authSource := &auth.Source{
-		Type:     auth.DLDAP,
+		Type:     authType,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -383,19 +353,25 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	return a.createAuthSource(authSource)
+	if err := a.createAuthSource(authSource); err != nil {
+		return err
+	}
+
+	audit.Record(audit.SystemAuthenticationSourceAdd, audit.NewCLIUser(), nil, authSource, "Created authentication source %s [%s].", authSource.Name, authSource.Type.String())
+
+	return nil
 }
 
-// updateLdapBindDn updates a new LDAP (simple auth) authentication source.
-func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
+func (a *authService) updateLdapSource(c *cli.Context, authType auth.Type) error {
 	ctx, cancel := installSignals()
 	defer cancel()
 
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
-	authSource, err := a.getAuthSource(c, auth.DLDAP)
+	authSource, err := a.getAuthSource(c, authType)
 	if err != nil {
 		return err
 	}
@@ -405,5 +381,11 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	return a.updateAuthSource(authSource)
+	if err := a.updateAuthSource(authSource); err != nil {
+		return err
+	}
+
+	audit.Record(audit.SystemAuthenticationSourceUpdate, audit.NewCLIUser(), nil, authSource, "Updated authentication source %s.", authSource.Name)
+
+	return nil
 }

cmd/admin_user_create.go

@@ -12,6 +12,7 @@ import (
 	pwd "code.gitea.io/gitea/modules/auth/password"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/services/audit"
 
 	"github.com/urfave/cli/v2"
 )
@@ -95,6 +96,7 @@ func runCreateUser(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	var password string
 	if c.IsSet("password") {
@@ -150,6 +152,8 @@ func runCreateUser(c *cli.Context) error {
 		return fmt.Errorf("CreateUser: %w", err)
 	}
 
+	audit.Record(audit.UserCreate, audit.NewCLIUser(), u, u, "Created user %s.", u.Name)
+
 	if c.Bool("access-token") {
 		t := &auth_model.AccessToken{
 			Name: "gitea-admin",
@@ -160,6 +164,8 @@ func runCreateUser(c *cli.Context) error {
 			return err
 		}
 
+		audit.Record(audit.UserAccessTokenAdd, audit.NewCLIUser(), u, t, "Added access token %s for user %s with scope %s.", t.Name, u.Name, t.Scope)
+
 		fmt.Printf("Access token was successfully created... %s\n", t.Token)
 	}
 

cmd/admin_user_delete.go

@@ -9,6 +9,7 @@ import (
 
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/storage"
+	"code.gitea.io/gitea/services/audit"
 	user_service "code.gitea.io/gitea/services/user"
 
 	"github.com/urfave/cli/v2"
@@ -51,7 +52,7 @@ func runDeleteUser(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
-
+	audit.Init()
 	if err := storage.Init(); err != nil {
 		return err
 	}
@@ -76,5 +77,5 @@ func runDeleteUser(c *cli.Context) error {
 		return fmt.Errorf("The user %s does not match the provided id %d", user.Name, c.Int64("id"))
 	}
 
-	return user_service.DeleteUser(ctx, user, c.Bool("purge"))
+	return user_service.DeleteUser(ctx, audit.NewCLIUser(), user, c.Bool("purge"))
 }

cmd/admin_user_generate_access_token.go

@@ -8,6 +8,7 @@ import (
 
 	auth_model "code.gitea.io/gitea/models/auth"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/services/audit"
 
 	"github.com/urfave/cli/v2"
 )
@@ -51,6 +52,7 @@ func runGenerateAccessToken(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	audit.Init()
 
 	user, err := user_model.GetUserByName(ctx, c.String("username"))
 	if err != nil {
@@ -83,6 +85,8 @@ func runGenerateAccessToken(c *cli.Context) error {
 		return err
 	}
 
+	audit.Record(audit.UserAccessTokenAdd, audit.NewCLIUser(), user, t, "Added access token %s for user %s with scope %s.", t.Name, user.Name, t.Scope)
+
 	if c.Bool("raw") {
 		fmt.Printf("%s\n", t.Token)
 	} else {

custom/conf/app.example.ini

@@ -646,6 +646,38 @@ LEVEL = Info
 ;; Host address
 ;ADDR =
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[audit]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enable logging of audit events
+;ENABLED = false
+;; Comma seperated list of appenders to log to (possible values: log, file)
+;APPENDER = 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Creating specific log configuration
+;;
+;; You can set specific configuration for individual appenders. Currently only "file" uses additional configuration.
+;;
+;[audit.file]
+;; Set the file name for the logger. If this is a relative path this
+;; will be relative to log.ROOT_PATH
+;; Defaults to log.ROOT_PATH/audit.log
+;FILENAME =
+;; This enables automated audit log rotate, default is true
+;ROTATE = true
+;; Maximum file size in bytes before rotating takes place (format `1000`, `1 MB`, `1 GiB`)
+;MAXIMUM_SIZE = 256 MB
+;; Rotate audit log daily, default is true
+;ROTATE_DAILY = true
+;; Delete the audit log file after n days, default is 7
+;KEEP_DAYS = 7
+;; Compress audit logs with gzip
+;COMPRESS = true
+;; Compression level see godoc for compress/gzip
+;COMPRESSION_LEVEL = -1
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [git]