MM-22273 New auditing system (phase 1) (#13967)

* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature

api4/post.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/mattermost-server/v5/model"
 )
@@ -43,6 +44,10 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	post.UserId = c.App.Session().UserId
 
+	auditRec := c.MakeAuditRecord("createPost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
+	auditRec.AddMeta("channel_id", post.ChannelId)
+
 	hasPermission := false
 	if c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_CREATE_POST) {
 		hasPermission = true
@@ -67,6 +72,8 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.Success()
+	auditRec.AddMeta("post_id", rp.Id)
 
 	setOnline := r.URL.Query().Get("set_online")
 	setOnlineBool := true // By default, always set online.
@@ -362,11 +369,17 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("deletePost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
+	auditRec.AddMeta("post_id", c.Params.PostId)
+
 	post, err := c.App.GetSinglePost(c.Params.PostId)
 	if err != nil {
 		c.SetPermissionError(model.PERMISSION_DELETE_POST)
 		return
 	}
+	auditRec.AddMeta("channel_id", post.ChannelId)
+	auditRec.AddMeta("creator_user_id", post.UserId)
 
 	if c.App.Session().UserId == post.UserId {
 		if !c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_DELETE_POST) {
@@ -385,6 +398,7 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
 	ReturnStatusOK(w)
 }
 
@@ -516,6 +530,12 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("updatePost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
+	auditRec.AddMeta("post_id", post.Id)
+	auditRec.AddMeta("channel_id", post.ChannelId)
+	auditRec.AddMeta("creator_user_id", post.UserId)
+
 	// The post being updated in the payload must be the same one as indicated in the URL.
 	if post.Id != c.Params.PostId {
 		c.SetInvalidParam("id")
@@ -551,6 +571,8 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
+
 	w.Write([]byte(rpost.ToJson()))
 }
 
@@ -567,6 +589,10 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("patchPost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
+	auditRec.AddMeta("post_id", c.Params.PostId)
+
 	// Updating the file_ids of a post is not a supported operation and will be ignored
 	post.FileIds = nil
 
@@ -580,6 +606,8 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PERMISSION_EDIT_POST)
 		return
 	}
+	auditRec.AddMeta("channel_id", originalPost.ChannelId)
+	auditRec.AddMeta("creator_user_id", originalPost.UserId)
 
 	if c.App.Session().UserId != originalPost.UserId {
 		if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
@@ -594,6 +622,8 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
+
 	w.Write([]byte(patchedPost.ToJson()))
 }
 
@@ -625,6 +655,10 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("saveIsPinnedPost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
+	auditRec.AddMeta("post_id", c.Params.PostId)
+
 	if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_READ_CHANNEL) {
 		c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
 		return
@@ -642,6 +676,8 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("channel_id", post.ChannelId)
+	auditRec.AddMeta("creator_user_id", post.UserId)
 
 	channel, err := c.App.GetChannel(post.ChannelId)
 	if err != nil {
@@ -666,6 +702,7 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 		return
 	}
 
+	auditRec.Success()
 	ReturnStatusOK(w)
 }