Feature/audit certificate upload (#30223)

* feat: Add certificate upload option for audit logging settings

* Commit current changes

* Additions

* MM-62944 Fix fileupload settings not being clickable

* Support for uploading a cert for experimental audit logging cert. Pre cloud implementation in the backend

* Forgot to add new hook

* Add support for setting custom audit log certifcates in Cloud

* Permissions

* I18n

* Change order

* Linter fixes

* Linter fixes, add openapi spec

* additions for openapi

* More openapi fixes because it won't run locally

* Undo, cursor went rogue

* newline fix

* Align types properly

* Fix i18n

* Fix i18n AGAIN

* Fix error

* Update api/v4/source/audit_logging.yaml

---------

Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/api.go

@@ -156,6 +156,8 @@ type Routes struct {
 	CustomProfileAttributesFields *mux.Router // 'api/v4/custom_profile_attributes/fields'
 	CustomProfileAttributesField  *mux.Router // 'api/v4/custom_profile_attributes/fields/{field_id:[A-Za-z0-9]+}'
 	CustomProfileAttributesValues *mux.Router // 'api/v4/custom_profile_attributes/values'
+
+	AuditLogs *mux.Router // 'api/v4/audit_logs'
 }
 
 type API struct {
@@ -298,6 +300,8 @@ func Init(srv *app.Server) (*API, error) {
 	api.BaseRoutes.CustomProfileAttributesField = api.BaseRoutes.CustomProfileAttributesFields.PathPrefix("/{field_id:[A-Za-z0-9]+}").Subrouter()
 	api.BaseRoutes.CustomProfileAttributesValues = api.BaseRoutes.CustomProfileAttributes.PathPrefix("/values").Subrouter()
 
+	api.BaseRoutes.AuditLogs = api.BaseRoutes.APIRoot.PathPrefix("/audit_logs").Subrouter()
+
 	api.InitUser()
 	api.InitBot()
 	api.InitTeam()
@@ -349,6 +353,7 @@ func Init(srv *app.Server) (*API, error) {
 	api.InitClientPerformanceMetrics()
 	api.InitScheduledPost()
 	api.InitCustomProfileAttributes()
+	api.InitAuditLogging()
 
 	// If we allow testing then listen for manual testing URL hits
 	if *srv.Config().ServiceSettings.EnableTesting {

server/channels/api4/audit_logging.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package api4
+
+import (
+	"mime/multipart"
+	"net/http"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/v8/channels/audit"
+)
+
+func (api *API) InitAuditLogging() {
+	api.BaseRoutes.AuditLogs.Handle("/certificate", api.APISessionRequired(addAuditLogCertificate)).Methods(http.MethodPost)
+	api.BaseRoutes.AuditLogs.Handle("/certificate", api.APISessionRequired(removeAuditLogCertificate)).Methods(http.MethodDelete)
+}
+
+func parseAuditLogCertificateRequest(r *http.Request, maxFileSize int64) (*multipart.FileHeader, *model.AppError) {
+	err := r.ParseMultipartForm(maxFileSize)
+	if err != nil {
+		return nil, model.NewAppError("addAuditLogCertificate", "api.admin.add_certificate.no_file.app_error", nil, "", http.StatusBadRequest).Wrap(err)
+	}
+
+	m := r.MultipartForm
+
+	fileArray, ok := m.File["certificate"]
+	if !ok || len(fileArray) == 0 {
+		return nil, model.NewAppError("addAuditLogCertificate", "api.admin.add_certificate.no_file.app_error", nil, "", http.StatusBadRequest)
+	}
+
+	if len(fileArray) > 1 {
+		return nil, model.NewAppError("addAuditLogCertificate", "api.admin.add_certificate.multiple_files.app_error", nil, "", http.StatusBadRequest)
+	}
+
+	return fileArray[0], nil
+}
+
+func addAuditLogCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.Logger.Debug("addAuditLogCertificate")
+
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteExperimentalFeatures) {
+		c.SetPermissionError(model.PermissionSysconsoleWriteExperimentalFeatures)
+		return
+	}
+
+	fileData, err := parseAuditLogCertificateRequest(r, *c.App.Config().FileSettings.MaxFileSize)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("addAuditLogCertificate", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	audit.AddEventParameter(auditRec, "filename", fileData.Filename)
+
+	if err := c.App.AddAuditLogCertificate(c.AppContext, fileData); err != nil {
+		c.Err = err
+		return
+	}
+
+	auditRec.Success()
+	ReturnStatusOK(w)
+}
+
+func removeAuditLogCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.Logger.Debug("removeAuditLogCertificate")
+
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteExperimentalFeatures) {
+		c.SetPermissionError(model.PermissionSysconsoleWriteExperimentalFeatures)
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("removeAuditLogCertificate", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
+	if err := c.App.RemoveAuditLogCertificate(c.AppContext); err != nil {
+		c.Err = err
+		return
+	}
+
+	auditRec.Success()
+	ReturnStatusOK(w)
+}

server/channels/app/audit.go

@@ -7,6 +7,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"mime/multipart"
 	"net/http"
 	"os"
 	"os/user"
@@ -28,6 +30,10 @@ var (
 	LevelCLI     = mlog.LvlAuditCLI
 )
 
+const (
+	AuditCertificateFilename = "audit_certificate.pem"
+)
+
 func (a *App) GetAudits(rctx request.CTX, userID string, limit int) (model.Audits, *model.AppError) {
 	audits, err := a.Srv().Store().Audit().Get(userID, 0, limit)
 	if err != nil {
@@ -156,3 +162,66 @@ func (s *Server) onAuditTargetQueueFull(qname string, maxQSize int) bool {
 func (s *Server) onAuditError(err error) {
 	s.Log().Error("Audit Error", mlog.Err(err))
 }
+
+func (a *App) AddAuditLogCertificate(rctx request.CTX, fileData *multipart.FileHeader) *model.AppError {
+	file, err := fileData.Open()
+	if err != nil {
+		return model.NewAppError("AddAuditLogCertificate", "api.admin.add_certificate.open.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+	defer file.Close()
+
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return model.NewAppError("AddAuditLogCertificate", "api.admin.add_certificate.saving.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	err = a.Srv().platform.SetConfigFile(AuditCertificateFilename, data)
+	if err != nil {
+		return model.NewAppError("AddAuditLogCertificate", "api.admin.add_certificate.saving.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	cfg := a.Config().Clone()
+
+	*cfg.ExperimentalAuditSettings.Certificate = AuditCertificateFilename
+
+	if err := cfg.IsValid(); err != nil {
+		return err
+	}
+
+	a.UpdateConfig(func(dest *model.Config) { *dest = *cfg })
+
+	if a.License().IsCloud() {
+		err = a.Cloud().CreateAuditLoggingCert(rctx.Session().UserId, fileData)
+		if err != nil {
+			return model.NewAppError("AddAuditLogCertificate", "api.admin.add_certificate.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+func (a *App) RemoveAuditLogCertificate(rctx request.CTX) *model.AppError {
+	err := a.Srv().platform.RemoveConfigFile(AuditCertificateFilename)
+	if err != nil {
+		return model.NewAppError("RemoveAuditLogCertificate", "api.admin.remove_certificate.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	cfg := a.Config().Clone()
+
+	*cfg.ExperimentalAuditSettings.Certificate = ""
+
+	if err := cfg.IsValid(); err != nil {
+		return model.NewAppError("RemoveAuditLogCertificate", "api.admin.remove_certificate.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	a.UpdateConfig(func(dest *model.Config) { *dest = *cfg })
+
+	if a.License().IsCloud() {
+		err = a.Cloud().RemoveAuditLoggingCert(rctx.Session().UserId)
+		if err != nil {
+			return model.NewAppError("RemoveAuditLogCertificate", "api.admin.remove_certificate.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+
+	return nil
+}

server/einterfaces/cloud.go

@@ -4,6 +4,8 @@
 package einterfaces
 
 import (
+	"mime/multipart"
+
 	"github.com/mattermost/mattermost/server/public/model"
 )
 
@@ -37,4 +39,7 @@ type CloudInterface interface {
 	ApplyIPFilters(userID string, ranges *model.AllowedIPRanges) (*model.AllowedIPRanges, error)
 	GetIPFilters(userID string) (*model.AllowedIPRanges, error)
 	GetInstallation(userID string) (*model.Installation, error)
+
+	RemoveAuditLoggingCert(userID string) error
+	CreateAuditLoggingCert(userID string, fileData *multipart.FileHeader) error
 }

server/einterfaces/mocks/CloudInterface.go

@@ -5,6 +5,8 @@
 package mocks
 
 import (
+	multipart "mime/multipart"
+
 	model "github.com/mattermost/mattermost/server/public/model"
 	mock "github.com/stretchr/testify/mock"
 )
@@ -92,6 +94,24 @@ func (_m *CloudInterface) CheckCWSConnection(userId string) error {
 	return r0
 }
 
+// CreateAuditLoggingCert provides a mock function with given fields: userID, fileData
+func (_m *CloudInterface) CreateAuditLoggingCert(userID string, fileData *multipart.FileHeader) error {
+	ret := _m.Called(userID, fileData)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateAuditLoggingCert")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, *multipart.FileHeader) error); ok {
+		r0 = rf(userID, fileData)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
 // CreateOrUpdateSubscriptionHistoryEvent provides a mock function with given fields: userID, userCount
 func (_m *CloudInterface) CreateOrUpdateSubscriptionHistoryEvent(userID string, userCount int) (*model.SubscriptionHistory, error) {
 	ret := _m.Called(userID, userCount)
@@ -465,6 +485,24 @@ func (_m *CloudInterface) InvalidateCaches() error {
 	return r0
 }
 
+// RemoveAuditLoggingCert provides a mock function with given fields: userID
+func (_m *CloudInterface) RemoveAuditLoggingCert(userID string) error {
+	ret := _m.Called(userID)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RemoveAuditLoggingCert")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(userID)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
 // SubscribeToNewsletter provides a mock function with given fields: userID, req
 func (_m *CloudInterface) SubscribeToNewsletter(userID string, req *model.SubscribeNewsletterRequest) error {
 	ret := _m.Called(userID, req)

server/i18n/en.json

@@ -59,10 +59,18 @@
     "id": "api.acknowledgement.save.archived_channel.app_error",
     "translation": "You cannot save an acknowledgment in an archived channel."
   },
+  {
+    "id": "api.admin.add_certificate.app_error",
+    "translation": "Failed to add certificate."
+  },
   {
     "id": "api.admin.add_certificate.array.app_error",
     "translation": "No file under 'certificate' in request."
   },
+  {
+    "id": "api.admin.add_certificate.multiple_files.app_error",
+    "translation": "Too many files under 'certificate' in request."
+  },
   {
     "id": "api.admin.add_certificate.no_file.app_error",
     "translation": "No file under 'certificate' in request."
@@ -95,6 +103,10 @@
     "id": "api.admin.ldap.not_available.app_error",
     "translation": "LDAP is not available."
   },
+  {
+    "id": "api.admin.remove_certificate.app_error",
+    "translation": "Failed to remove certificate."
+  },
   {
     "id": "api.admin.remove_certificate.delete.app_error",
     "translation": "An error occurred while deleting the certificate."

server/public/model/config.go

@@ -1538,6 +1538,7 @@ type ExperimentalAuditSettings struct {
 	FileCompress        *bool           `access:"experimental_features,write_restrictable,cloud_restrictable"`
 	FileMaxQueueSize    *int            `access:"experimental_features,write_restrictable,cloud_restrictable"`
 	AdvancedLoggingJSON json.RawMessage `access:"experimental_features"`
+	Certificate         *string         `access:"experimental_features"` // telemetry: none
 }
 
 func (s *ExperimentalAuditSettings) SetDefaults() {
@@ -1572,6 +1573,10 @@ func (s *ExperimentalAuditSettings) SetDefaults() {
 	if utils.IsEmptyJSON(s.AdvancedLoggingJSON) {
 		s.AdvancedLoggingJSON = []byte("{}")
 	}
+
+	if s.Certificate == nil {
+		s.Certificate = NewPointer("")
+	}
 }
 
 // GetAdvancedLoggingConfig returns the advanced logging config as a []byte.