Add Audit Trail/Logging

cmd/admin_auth.go

@@ -4,12 +4,15 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"text/tabwriter"
 
 	auth_model "code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/services/audit"
 	auth_service "code.gitea.io/gitea/services/auth"
 
 	"github.com/urfave/cli/v2"
@@ -89,6 +92,26 @@ func runListAuth(c *cli.Context) error {
 	return nil
 }
 
+func createSource(ctx context.Context, source *auth_model.Source) error {
+	if err := auth_model.CreateSource(ctx, source); err != nil {
+		return err
+	}
+
+	audit.RecordSystemAuthenticationSourceAdd(ctx, user_model.NewCLIUser(), source)
+
+	return nil
+}
+
+func updateSource(ctx context.Context, source *auth_model.Source) error {
+	if err := auth_model.UpdateSource(ctx, source); err != nil {
+		return err
+	}
+
+	audit.RecordSystemAuthenticationSourceUpdate(ctx, user_model.NewCLIUser(), source)
+
+	return nil
+}
+
 func runDeleteAuth(c *cli.Context) error {
 	if !c.IsSet("id") {
 		return fmt.Errorf("--id flag is missing")
@@ -106,5 +129,5 @@ func runDeleteAuth(c *cli.Context) error {
 		return err
 	}
 
-	return auth_service.DeleteSource(ctx, source)
+	return auth_service.DeleteSource(ctx, user_model.NewCLIUser(), source)
 }

cmd/admin_auth_ldap.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models/auth"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/services/audit"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/urfave/cli/v2"
@@ -308,58 +310,26 @@ func (a *authService) getAuthSource(ctx context.Context, c *cli.Context, authTyp
 
 // addLdapBindDn adds a new LDAP via Bind DN authentication source.
 func (a *authService) addLdapBindDn(c *cli.Context) error {
-	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute"); err != nil {
-		return err
-	}
-
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := a.initDB(ctx); err != nil {
-		return err
-	}
-
-	authSource := &auth.Source{
-		Type:     auth.LDAP,
-		IsActive: true, // active by default
-		Cfg: &ldap.Source{
-			Enabled: true, // always true
-		},
-	}
-
-	parseAuthSource(c, authSource)
-	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
-		return err
-	}
-
-	return a.createAuthSource(ctx, authSource)
+	return a.addLdapSource(c, auth.LDAP, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute")
 }
 
 // updateLdapBindDn updates a new LDAP via Bind DN authentication source.
 func (a *authService) updateLdapBindDn(c *cli.Context) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-
-	if err := a.initDB(ctx); err != nil {
-		return err
-	}
-
-	authSource, err := a.getAuthSource(ctx, c, auth.LDAP)
-	if err != nil {
-		return err
-	}
-
-	parseAuthSource(c, authSource)
-	if err := parseLdapConfig(c, authSource.Cfg.(*ldap.Source)); err != nil {
-		return err
-	}
-
-	return a.updateAuthSource(ctx, authSource)
+	return a.updateLdapSource(c, auth.LDAP)
 }
 
 // addLdapSimpleAuth adds a new LDAP (simple auth) authentication source.
 func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
-	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-dn", "user-filter", "email-attribute"); err != nil {
+	return a.addLdapSource(c, auth.DLDAP, "name", "security-protocol", "host", "port", "user-dn", "user-filter", "email-attribute")
+}
+
+// updateLdapBindDn updates a new LDAP (simple auth) authentication source.
+func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
+	return a.updateLdapSource(c, auth.DLDAP)
+}
+
+func (a *authService) addLdapSource(c *cli.Context, authType auth.Type, args ...string) error {
+	if err := argsSet(c, args...); err != nil {
 		return err
 	}
 
@@ -369,9 +339,12 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
+	if err := audit.Init(); err != nil {
+		return err
+	}
 
 	authSource := &auth.Source{
-		Type:     auth.DLDAP,
+		Type:     authType,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -383,19 +356,27 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	return a.createAuthSource(ctx, authSource)
+	if err := a.createAuthSource(ctx, authSource); err != nil {
+		return err
+	}
+
+	audit.RecordSystemAuthenticationSourceAdd(ctx, user_model.NewCLIUser(), authSource)
+
+	return nil
 }
 
-// updateLdapBindDn updates a new LDAP (simple auth) authentication source.
-func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
+func (a *authService) updateLdapSource(c *cli.Context, authType auth.Type) error {
 	ctx, cancel := installSignals()
 	defer cancel()
 
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
+	if err := audit.Init(); err != nil {
+		return err
+	}
 
-	authSource, err := a.getAuthSource(ctx, c, auth.DLDAP)
+	authSource, err := a.getAuthSource(ctx, c, authType)
 	if err != nil {
 		return err
 	}
@@ -405,5 +386,11 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	return a.updateAuthSource(ctx, authSource)
+	if err := a.updateAuthSource(ctx, authSource); err != nil {
+		return err
+	}
+
+	audit.RecordSystemAuthenticationSourceUpdate(ctx, user_model.NewCLIUser(), authSource)
+
+	return nil
 }

cmd/admin_auth_oauth.go

@@ -183,7 +183,7 @@ func runAddOauth(c *cli.Context) error {
 		}
 	}
 
-	return auth_model.CreateSource(ctx, &auth_model.Source{
+	return createSource(ctx, &auth_model.Source{
 		Type:     auth_model.OAuth2,
 		Name:     c.String("name"),
 		IsActive: true,
@@ -294,5 +294,5 @@ func runUpdateOauth(c *cli.Context) error {
 	oAuth2Config.CustomURLMapping = customURLMapping
 	source.Cfg = oAuth2Config
 
-	return auth_model.UpdateSource(ctx, source)
+	return updateSource(ctx, source)
 }

cmd/admin_auth_stmp.go

@@ -156,7 +156,7 @@ func runAddSMTP(c *cli.Context) error {
 		smtpConfig.Auth = "PLAIN"
 	}
 
-	return auth_model.CreateSource(ctx, &auth_model.Source{
+	return createSource(ctx, &auth_model.Source{
 		Type:     auth_model.SMTP,
 		Name:     c.String("name"),
 		IsActive: active,
@@ -197,5 +197,5 @@ func runUpdateSMTP(c *cli.Context) error {
 
 	source.Cfg = smtpConfig
 
-	return auth_model.UpdateSource(ctx, source)
+	return updateSource(ctx, source)
 }

cmd/admin_user_change_password.go

@@ -66,7 +66,7 @@ func runChangePassword(c *cli.Context) error {
 		Password:           optional.Some(c.String("password")),
 		MustChangePassword: mustChangePassword,
 	}
-	if err := user_service.UpdateAuth(ctx, user, opts); err != nil {
+	if err := user_service.UpdateAuth(ctx, user_model.NewCLIUser(), user, opts); err != nil {
 		switch {
 		case errors.Is(err, password.ErrMinLength):
 			return fmt.Errorf("Password is not long enough. Needs to be at least %d", setting.MinPasswordLength)

cmd/admin_user_create.go

@@ -12,6 +12,7 @@ import (
 	pwd "code.gitea.io/gitea/modules/auth/password"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/services/audit"
 
 	"github.com/urfave/cli/v2"
 )
@@ -95,6 +96,9 @@ func runCreateUser(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	if err := audit.Init(); err != nil {
+		return err
+	}
 
 	var password string
 	if c.IsSet("password") {
@@ -150,6 +154,8 @@ func runCreateUser(c *cli.Context) error {
 		return fmt.Errorf("CreateUser: %w", err)
 	}
 
+	audit.RecordUserCreate(ctx, user_model.NewCLIUser(), u)
+
 	if c.Bool("access-token") {
 		t := &auth_model.AccessToken{
 			Name: "gitea-admin",
@@ -160,6 +166,8 @@ func runCreateUser(c *cli.Context) error {
 			return err
 		}
 
+		audit.RecordUserAccessTokenAdd(ctx, user_model.NewCLIUser(), u, t)
+
 		fmt.Printf("Access token was successfully created... %s\n", t.Token)
 	}
 

cmd/admin_user_delete.go

@@ -9,6 +9,7 @@ import (
 
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/storage"
+	"code.gitea.io/gitea/services/audit"
 	user_service "code.gitea.io/gitea/services/user"
 
 	"github.com/urfave/cli/v2"
@@ -51,7 +52,9 @@ func runDeleteUser(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
-
+	if err := audit.Init(); err != nil {
+		return err
+	}
 	if err := storage.Init(); err != nil {
 		return err
 	}
@@ -76,5 +79,5 @@ func runDeleteUser(c *cli.Context) error {
 		return fmt.Errorf("The user %s does not match the provided id %d", user.Name, c.Int64("id"))
 	}
 
-	return user_service.DeleteUser(ctx, user, c.Bool("purge"))
+	return user_service.DeleteUser(ctx, user_model.NewCLIUser(), user, c.Bool("purge"))
 }

cmd/admin_user_generate_access_token.go

@@ -8,6 +8,7 @@ import (
 
 	auth_model "code.gitea.io/gitea/models/auth"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/services/audit"
 
 	"github.com/urfave/cli/v2"
 )
@@ -51,6 +52,9 @@ func runGenerateAccessToken(c *cli.Context) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}
+	if err := audit.Init(); err != nil {
+		return err
+	}
 
 	user, err := user_model.GetUserByName(ctx, c.String("username"))
 	if err != nil {
@@ -83,6 +87,8 @@ func runGenerateAccessToken(c *cli.Context) error {
 		return err
 	}
 
+	audit.RecordUserAccessTokenAdd(ctx, user_model.NewCLIUser(), user, t)
+
 	if c.Bool("raw") {
 		fmt.Printf("%s\n", t.Token)
 	} else {

cmd/web.go

@@ -15,6 +15,8 @@ import (
 
 	_ "net/http/pprof" // Used for debugging if enabled and a web server is running
 
+	"code.gitea.io/gitea/models/db"
+	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
@@ -23,6 +25,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/install"
+	"code.gitea.io/gitea/services/audit"
 
 	"github.com/felixge/fgprof"
 	"github.com/urfave/cli/v2"
@@ -209,7 +212,13 @@ func serveInstalled(ctx *cli.Context) error {
 
 	// Set up Chi routes
 	webRoutes := routers.NormalRoutes()
+
+	audit.RecordSystemStartup(db.DefaultContext, user_model.NewCLIUser(), setting.AppVer)
+
 	err := listen(webRoutes, true)
+
+	audit.RecordSystemShutdown(db.DefaultContext, user_model.NewCLIUser())
+
 	<-graceful.GetManager().Done()
 	log.Info("PID: %d Gitea Web Finished", os.Getpid())
 	log.GetManager().Close()

custom/conf/app.example.ini

@@ -659,6 +659,32 @@ LEVEL = Info
 ;; Host address
 ;ADDR =
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[audit]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enable logging of audit events
+;ENABLED = false
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[audit.file]
+;; Set the file name for the logger. If this is a relative path this
+;; will be relative to log.ROOT_PATH
+;; Defaults to log.ROOT_PATH/audit.log
+;FILE_NAME =
+;; This enables automated audit log rotate, default is true
+;LOG_ROTATE = true
+;; Maximum file size in bytes before rotating takes place (format `1000`, `1 MB`, `1 GiB`)
+;MAXIMUM_SIZE = 256 MB
+;; Rotate audit log daily, default is true
+;DAILY_ROTATE = true
+;; Delete the audit log file after n days, default is 7
+;MAX_DAYS = 7
+;; Compress audit logs with gzip
+;COMPRESS = true
+;; Compression level see godoc for compress/gzip
+;COMPRESSION_LEVEL = -1
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [git]