MM-22785 audit server CLI (#14144)

Add auditing to server CLI.

Also:
- simplify auditing in API layer
- reduce number of AddMeta calls
- have models serialize themselves
- more consistent field naming

api4/bot.go

@@ -42,6 +42,7 @@ func createBot(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createBot", audit.Fail)
 	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("bot", bot)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_BOT) {
 		c.SetPermissionError(model.PERMISSION_CREATE_BOT)
@@ -67,9 +68,7 @@ func createBot(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	// Note that the primary key of a bot is the UserId, and matches the primary key of the
-	// corresponding user.
-	auditRec.AddMeta("bot_id", createdBot.UserId)
+	auditRec.AddMeta("bot", createdBot) // overwrite meta
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write(createdBot.ToJson())
@@ -104,6 +103,7 @@ func patchBot(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("bot", updatedBot)
 
 	w.Write(updatedBot.ToJson())
 }
@@ -214,6 +214,7 @@ func updateBotActive(c *Context, w http.ResponseWriter, r *http.Request, active
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("bot", bot)
 
 	w.Write(bot.ToJson())
 }
@@ -251,6 +252,7 @@ func assignBot(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("bot", bot)
 
 	w.Write(bot.ToJson())
 }

api4/channel.go

@@ -73,7 +73,7 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createChannel", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channel", channel)
 
 	if channel.Type == model.CHANNEL_OPEN && !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_CREATE_PUBLIC_CHANNEL) {
 		c.SetPermissionError(model.PERMISSION_CREATE_PUBLIC_CHANNEL)
@@ -92,7 +92,7 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("channel_id", sc.Id)
+	auditRec.AddMeta("channel", sc) // overwrite meta
 	c.LogAudit("name=" + channel.Name)
 
 	w.WriteHeader(http.StatusCreated)
@@ -120,7 +120,6 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateChannel", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
 
 	originalOldChannel, err := c.App.GetChannel(channel.Id)
 	if err != nil {
@@ -129,7 +128,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	oldChannel := originalOldChannel.DeepCopy()
 
-	auditRec.AddMeta("channel_name", oldChannel.Name)
+	auditRec.AddMeta("channel", oldChannel)
 
 	switch oldChannel.Type {
 	case model.CHANNEL_OPEN:
@@ -146,7 +145,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	case model.CHANNEL_GROUP, model.CHANNEL_DIRECT:
 		// Modifying the header is not linked to any specific permission for group/dm channels, so just check for membership.
-		if _, err := c.App.GetChannelMember(channel.Id, c.App.Session().UserId); err != nil {
+		if _, errGet := c.App.GetChannelMember(channel.Id, c.App.Session().UserId); errGet != nil {
 			c.Err = model.NewAppError("updateChannel", "api.channel.patch_update_channel.forbidden.app_error", nil, "", http.StatusForbidden)
 			return
 		}
@@ -191,10 +190,12 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 		oldChannel.GroupConstrained = channel.GroupConstrained
 	}
 
-	if _, err := c.App.UpdateChannel(oldChannel); err != nil {
+	updatedChannel, err := c.App.UpdateChannel(oldChannel)
+	if err != nil {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("update", updatedChannel)
 
 	if oldChannelDisplayName != channel.DisplayName {
 		if err := c.App.PostUpdateChannelDisplayNameMessage(c.App.Session().UserId, channel, oldChannelDisplayName, channel.DisplayName); err != nil {
@@ -222,8 +223,7 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
 
 	auditRec := c.MakeAuditRecord("convertChannelToPrivate", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", oldPublicChannel.Id)
-	auditRec.AddMeta("channel_name", oldPublicChannel.Name)
+	auditRec.AddMeta("channel", oldPublicChannel)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), oldPublicChannel.TeamId, model.PERMISSION_MANAGE_TEAM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -245,6 +245,7 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("user", user)
 
 	oldPublicChannel.Type = model.CHANNEL_PRIVATE
 
@@ -281,10 +282,8 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateChannelPrivacy", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
-	auditRec.AddMeta("channel_type", channel.Type)
-	auditRec.AddMeta("new_channel_type", privacy)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("new_type", privacy)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_TEAM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -301,6 +300,7 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("user", user)
 
 	channel.Type = privacy
 
@@ -337,8 +337,7 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchChannel", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", oldChannel.Id)
-	auditRec.AddMeta("channel_name", oldChannel.Name)
+	auditRec.AddMeta("channel", oldChannel)
 
 	switch oldChannel.Type {
 	case model.CHANNEL_OPEN:
@@ -379,6 +378,7 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec.Success()
 	c.LogAudit("")
+	auditRec.AddMeta("patch", rchannel)
 
 	w.Write([]byte(rchannel.ToJson()))
 }
@@ -398,8 +398,7 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("restoreChannel", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channel", channel)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), teamId, model.PERMISSION_MANAGE_TEAM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -475,8 +474,7 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("channel_id", sc.Id)
-	auditRec.AddMeta("channel_name", sc.Name)
+	auditRec.AddMeta("channel", sc)
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(sc.ToJson()))
@@ -555,8 +553,7 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("channel_id", groupChannel.Id)
-	auditRec.AddMeta("channel_name", groupChannel.Name)
+	auditRec.AddMeta("channel", groupChannel)
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(groupChannel.ToJson()))
@@ -1012,8 +1009,7 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("deleteChannel", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channeld", channel)
 
 	if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
 		c.Err = model.NewAppError("deleteChannel", "api.channel.delete_channel.type.invalid", nil, "", http.StatusBadRequest)
@@ -1404,8 +1400,7 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("addChannelMember", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channel", channel)
 
 	if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
 		c.Err = model.NewAppError("addUserToChannel", "api.channel.add_user_to_channel.type.app_error", nil, "", http.StatusBadRequest)
@@ -1506,8 +1501,7 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("removeChannelMember", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channel", channel)
 	auditRec.AddMeta("remove_user_id", user.Id)
 
 	if !(channel.Type == model.CHANNEL_OPEN || channel.Type == model.CHANNEL_PRIVATE) {
@@ -1586,8 +1580,7 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
+	auditRec.AddMeta("channel", channel)
 	auditRec.AddMeta("old_scheme_id", channel.SchemeId)
 
 	channel.SchemeId = &scheme.Id
@@ -1701,6 +1694,9 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("patchChannelModerations", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
 		return
@@ -1711,6 +1707,7 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("channel", channel)
 
 	channelModerationsPatch := model.ChannelModerationsPatchFromJson(r.Body)
 	channelModerations, err := c.App.PatchChannelModerationsForChannel(channel, channelModerationsPatch)
@@ -1718,6 +1715,7 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("patch", channelModerationsPatch)
 
 	b, marshalErr := json.Marshal(channelModerations)
 	if marshalErr != nil {
@@ -1725,5 +1723,6 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	auditRec.Success()
 	w.Write(b)
 }

api4/command.go

@@ -51,8 +51,8 @@ func createCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("command_id", rcmd.Id)
 	c.LogAudit("success")
+	auditRec.AddMeta("command", rcmd)
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(rcmd.ToJson()))
@@ -71,15 +71,16 @@ func updateCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec := c.MakeAuditRecord("updateCommand", audit.Fail)
-	auditRec.AddMeta("command_id", c.Params.CommandId)
 	defer c.LogAuditRec(auditRec)
 	c.LogAudit("attempt")
 
 	oldCmd, err := c.App.GetCommand(c.Params.CommandId)
 	if err != nil {
+		auditRec.AddMeta("command_id", c.Params.CommandId)
 		c.SetCommandNotFoundError()
 		return
 	}
+	auditRec.AddMeta("command", oldCmd)
 
 	if cmd.TeamId != oldCmd.TeamId {
 		c.Err = model.NewAppError("updateCommand", "api.command.team_mismatch.app_error", nil, "user_id="+c.App.Session().UserId, http.StatusBadRequest)
@@ -125,8 +126,6 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec := c.MakeAuditRecord("moveCommand", audit.Fail)
-	auditRec.AddMeta("command_id", c.Params.CommandId)
-	auditRec.AddMeta("to_team_id", cmr.TeamId)
 	defer c.LogAuditRec(auditRec)
 	c.LogAudit("attempt")
 
@@ -135,6 +134,7 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = appErr
 		return
 	}
+	auditRec.AddMeta("team", newTeam)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), newTeam.Id, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
 		c.LogAudit("fail - inappropriate permissions")
@@ -147,7 +147,7 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetCommandNotFoundError()
 		return
 	}
-	auditRec.AddMeta("from_team_id", cmd.TeamId)
+	auditRec.AddMeta("command", cmd)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), cmd.TeamId, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
 		c.LogAudit("fail - inappropriate permissions")
@@ -175,7 +175,6 @@ func deleteCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec := c.MakeAuditRecord("deleteCommand", audit.Fail)
-	auditRec.AddMeta("command_id", c.Params.CommandId)
 	defer c.LogAuditRec(auditRec)
 	c.LogAudit("attempt")
 
@@ -184,6 +183,7 @@ func deleteCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetCommandNotFoundError()
 		return
 	}
+	auditRec.AddMeta("command", cmd)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), cmd.TeamId, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
 		c.LogAudit("fail - inappropriate permissions")
@@ -301,6 +301,10 @@ func executeCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("executeCommand", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("commandargs", commandArgs)
+
 	// checks that user is a member of the specified channel, and that they have permission to use slash commands in it
 	if !c.App.SessionHasPermissionToChannel(*c.App.Session(), commandArgs.ChannelId, model.PERMISSION_USE_SLASH_COMMANDS) {
 		c.SetPermissionError(model.PERMISSION_USE_SLASH_COMMANDS)
@@ -333,12 +337,15 @@ func executeCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 	commandArgs.Session = *c.App.Session()
 	commandArgs.SiteURL = c.GetSiteURLHeader()
 
+	auditRec.AddMeta("commandargs", commandArgs) // overwrite in case teamid changed
+
 	response, err := c.App.ExecuteCommand(commandArgs)
 	if err != nil {
 		c.Err = err
 		return
 	}
 
+	auditRec.Success()
 	w.Write([]byte(response.ToJson()))
 }
 
@@ -369,15 +376,16 @@ func regenCommandToken(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec := c.MakeAuditRecord("regenCommandToken", audit.Fail)
-	auditRec.AddMeta("command_id", c.Params.CommandId)
 	defer c.LogAuditRec(auditRec)
 	c.LogAudit("attempt")
 
 	cmd, err := c.App.GetCommand(c.Params.CommandId)
 	if err != nil {
+		auditRec.AddMeta("command_id", c.Params.CommandId)
 		c.SetCommandNotFoundError()
 		return
 	}
+	auditRec.AddMeta("command", cmd)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), cmd.TeamId, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
 		c.LogAudit("fail - inappropriate permissions")

api4/compliance.go

@@ -57,12 +57,16 @@ func getComplianceReports(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("getComplianceReports", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	crs, err := c.App.GetComplianceReports(c.Params.Page, c.Params.PerPage)
 	if err != nil {
 		c.Err = err
 		return
 	}
 
+	auditRec.Success()
 	w.Write([]byte(crs.ToJson()))
 }
 
@@ -72,6 +76,9 @@ func getComplianceReport(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("getComplianceReport", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
 		return
@@ -83,6 +90,10 @@ func getComplianceReport(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
+	auditRec.AddMeta("compliance_id", job.Id)
+	auditRec.AddMeta("compliance_desc", job.Desc)
+
 	w.Write([]byte(job.ToJson()))
 }
 
@@ -106,14 +117,16 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("compliance_id", job.Id)
+	auditRec.AddMeta("compliance_desc", job.Desc)
 
 	reportBytes, err := c.App.GetComplianceFile(job)
 	if err != nil {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("length", len(reportBytes))
 
-	auditRec.AddMeta("compliance_desc", job.Desc)
 	c.LogAudit("downloaded " + job.Desc)
 
 	w.Header().Set("Cache-Control", "max-age=2592000, public")

api4/config.go

@@ -28,8 +28,13 @@ func getConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("getConfig", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	cfg := c.App.GetSanitizedConfig()
 
+	auditRec.Success()
+
 	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	w.Write([]byte(cfg.ToJson()))
 }

api4/emoji.go

@@ -87,8 +87,7 @@ func createEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	auditRec.AddMeta("emoji_id", emoji.Id)
-	auditRec.AddMeta("emoji_name", emoji.Name)
+	auditRec.AddMeta("emoji", emoji)
 
 	newEmoji, err := c.App.CreateEmoji(c.App.Session().UserId, emoji, m)
 	if err != nil {
@@ -129,14 +128,14 @@ func deleteEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("deleteEmoji", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("emoji_id", c.Params.EmojiId)
 
 	emoji, err := c.App.GetEmoji(c.Params.EmojiId)
 	if err != nil {
+		auditRec.AddMeta("emoji_id", c.Params.EmojiId)
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("emoji_name", emoji.Name)
+	auditRec.AddMeta("emoji", emoji)
 
 	// Allow any user with DELETE_EMOJIS permission at Team level to delete emojis at system level
 	memberships, err := c.App.GetTeamMembersForUser(c.App.Session().UserId)

api4/file.go

@@ -157,7 +157,6 @@ func uploadFileSimple(c *Context, r *http.Request, timestamp time.Time) *model.F
 	auditRec := c.MakeAuditRecord("uploadFileSimple", audit.Fail)
 	defer c.LogAuditRec(auditRec)
 	auditRec.AddMeta("channel_id", c.Params.ChannelId)
-	auditRec.AddMeta("filename", c.Params.Filename)
 
 	if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_UPLOAD_FILE) {
 		c.SetPermissionError(model.PERMISSION_UPLOAD_FILE)
@@ -166,7 +165,6 @@ func uploadFileSimple(c *Context, r *http.Request, timestamp time.Time) *model.F
 
 	clientId := r.Form.Get("client_id")
 	auditRec.AddMeta("client_id", clientId)
-	auditRec.AddMeta("content_length", r.ContentLength)
 
 	info, appErr := c.App.UploadFileX(c.Params.ChannelId, c.Params.Filename, r.Body,
 		app.UploadFileSetTeamId(FILE_TEAM_ID),
@@ -178,6 +176,7 @@ func uploadFileSimple(c *Context, r *http.Request, timestamp time.Time) *model.F
 		c.Err = appErr
 		return nil
 	}
+	auditRec.AddMeta("file", info)
 
 	fileUploadResponse := &model.FileUploadResponse{
 		FileInfos: []*model.FileInfo{info},
@@ -328,7 +327,6 @@ NEXT_PART:
 
 		auditRec := c.MakeAuditRecord("uploadFileMultipart", audit.Fail)
 		auditRec.AddMeta("channel_id", c.Params.ChannelId)
-		auditRec.AddMeta("filename", filename)
 		auditRec.AddMeta("client_id", clientId)
 
 		info, appErr := c.App.UploadFileX(c.Params.ChannelId, filename, part,
@@ -342,6 +340,8 @@ NEXT_PART:
 			c.LogAuditRec(auditRec)
 			return nil
 		}
+		auditRec.AddMeta("file", info)
+
 		auditRec.Success()
 		c.LogAuditRec(auditRec)
 
@@ -430,7 +430,6 @@ func uploadFileMultipartLegacy(c *Context, mr *multipart.Reader,
 		auditRec := c.MakeAuditRecord("uploadFileMultipartLegacy", audit.Fail)
 		defer c.LogAuditRec(auditRec)
 		auditRec.AddMeta("channel_id", channelId)
-		auditRec.AddMeta("filename", fileHeader.Filename)
 		auditRec.AddMeta("client_id", clientId)
 
 		info, appErr := c.App.UploadFileX(c.Params.ChannelId, fileHeader.Filename, f,
@@ -445,6 +444,7 @@ func uploadFileMultipartLegacy(c *Context, mr *multipart.Reader,
 			c.LogAuditRec(auditRec)
 			return nil
 		}
+		auditRec.AddMeta("file", info)
 
 		auditRec.Success()
 		c.LogAuditRec(auditRec)
@@ -469,11 +469,16 @@ func getFile(c *Context, w http.ResponseWriter, r *http.Request) {
 		forceDownload = false
 	}
 
+	auditRec := c.MakeAuditRecord("getFile", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("force_download", forceDownload)
+
 	info, err := c.App.GetFileInfo(c.Params.FileId)
 	if err != nil {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("file", info)
 
 	if info.CreatorId != c.App.Session().UserId && !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), info.PostId, model.PERMISSION_READ_CHANNEL) {
 		c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
@@ -488,6 +493,8 @@ func getFile(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	defer fileReader.Close()
 
+	auditRec.Success()
+
 	err = writeFileResponse(info.Name, info.MimeType, info.Size, time.Unix(0, info.UpdateAt*int64(1000*1000)), *c.App.Config().ServiceSettings.WebserverMode, fileReader, forceDownload, w, r)
 	if err != nil {
 		c.Err = err
@@ -548,11 +555,15 @@ func getFileLink(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("getFileLink", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	info, err := c.App.GetFileInfo(c.Params.FileId)
 	if err != nil {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("file", info)
 
 	if info.CreatorId != c.App.Session().UserId && !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), info.PostId, model.PERMISSION_READ_CHANNEL) {
 		c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
@@ -565,7 +576,11 @@ func getFileLink(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	resp := make(map[string]string)
-	resp["link"] = c.App.GeneratePublicLink(c.GetSiteURLHeader(), info)
+	link := c.App.GeneratePublicLink(c.GetSiteURLHeader(), info)
+	resp["link"] = link
+
+	auditRec.Success()
+	auditRec.AddMeta("link", link)
 
 	w.Write([]byte(model.MapToJson(resp)))
 }

api4/group.go

@@ -108,7 +108,6 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchGroup", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("group_id", c.Params.GroupId)
 
 	if c.App.License() == nil || !*c.App.License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.patchGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
@@ -125,9 +124,7 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("old_group_name", group.Name)
-	auditRec.AddMeta("old_group_display", group.DisplayName)
-	auditRec.AddMeta("old_group_desc", group.Description)
+	auditRec.AddMeta("group", group)
 
 	group.Patch(groupPatch)
 
@@ -136,10 +133,7 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-
-	auditRec.AddMeta("new_group_name", group.Name)
-	auditRec.AddMeta("new_group_display", group.DisplayName)
-	auditRec.AddMeta("new_group_desc", group.Description)
+	auditRec.AddMeta("patch", group)
 
 	b, marshalErr := json.Marshal(group)
 	if marshalErr != nil {
@@ -148,7 +142,6 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-
 	w.Write(b)
 }
 

api4/job.go

@@ -47,7 +47,7 @@ func createJob(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createJob", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("job_type", job.Type)
+	auditRec.AddMeta("job", job)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_JOBS) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_JOBS)
@@ -61,7 +61,7 @@ func createJob(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("job_id", job.Id)
+	auditRec.AddMeta("job", job) // overwrite meta
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(job.ToJson()))

api4/ldap.go

@@ -149,8 +149,7 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("ldap_group_id", ldapGroup.Id)
-	auditRec.AddMeta("ldap_group_desc", ldapGroup.Description)
+	auditRec.AddMeta("ldap_group", ldapGroup)
 
 	if ldapGroup == nil {
 		c.Err = model.NewAppError("Api4.linkLdapGroup", "api.ldap_group.not_found", nil, "", http.StatusNotFound)
@@ -163,8 +162,7 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if group != nil {
-		auditRec.AddMeta("group_id", group.Id)
-		auditRec.AddMeta("group_name", group.Name)
+		auditRec.AddMeta("group", group)
 	}
 
 	var status int
@@ -177,7 +175,6 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 	} else {
 		displayName = ldapGroup.DisplayName
 	}
-	auditRec.AddMeta("ldap_group_display", displayName)
 
 	// Group has been previously linked
 	if group != nil {
@@ -251,8 +248,7 @@ func unlinkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("group_id", group.Id)
-	auditRec.AddMeta("group_name", group.Name)
+	auditRec.AddMeta("group", group)
 
 	if group.DeleteAt == 0 {
 		_, err = c.App.DeleteGroup(group.Id)

api4/oauth.go

@@ -32,8 +32,6 @@ func createOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createOAuthApp", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("oauth_app_name", oauthApp.Name)
-	auditRec.AddMeta("oauth_app_desc", oauthApp.Description)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_OAUTH) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_OAUTH)
@@ -53,8 +51,7 @@ func createOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("oauth_app_id", rapp.Id)
-	auditRec.AddMeta("client_id", rapp.Id)
+	auditRec.AddMeta("oauth_app", rapp)
 	c.LogAudit("client_id=" + rapp.Id)
 
 	w.WriteHeader(http.StatusCreated)
@@ -82,7 +79,6 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetInvalidParam("oauth_app")
 		return
 	}
-	auditRec.AddMeta("oauth_app_name", oauthApp.Name)
 
 	// The app being updated in the payload must be the same one as indicated in the URL.
 	if oauthApp.Id != c.Params.AppId {
@@ -95,6 +91,7 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("oauth_app", oldOauthApp)
 
 	if c.App.Session().UserId != oldOauthApp.CreatorId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH)
@@ -112,6 +109,7 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("update", updatedOauthApp)
 	c.LogAudit("success")
 
 	w.Write([]byte(updatedOauthApp.ToJson()))
@@ -204,7 +202,7 @@ func deleteOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("oauth_app_name", oauthApp.Name)
+	auditRec.AddMeta("oauth_app", oauthApp)
 
 	if c.App.Session().UserId != oauthApp.CreatorId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH)
@@ -243,7 +241,7 @@ func regenerateOAuthAppSecret(c *Context, w http.ResponseWriter, r *http.Request
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("oauth_app_name", oauthApp.Name)
+	auditRec.AddMeta("oauth_app", oauthApp)
 
 	if oauthApp.CreatorId != c.App.Session().UserId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH)

api4/post.go

@@ -46,7 +46,7 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createPost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
-	auditRec.AddMeta("channel_id", post.ChannelId)
+	auditRec.AddMeta("post", post)
 
 	hasPermission := false
 	if c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_CREATE_POST) {
@@ -73,7 +73,7 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	auditRec.Success()
-	auditRec.AddMeta("post_id", rp.Id)
+	auditRec.AddMeta("post", rp) // overwrite meta
 
 	setOnline := r.URL.Query().Get("set_online")
 	setOnlineBool := true // By default, always set online.
@@ -378,8 +378,7 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PERMISSION_DELETE_POST)
 		return
 	}
-	auditRec.AddMeta("channel_id", post.ChannelId)
-	auditRec.AddMeta("creator_user_id", post.UserId)
+	auditRec.AddMeta("post", post)
 
 	if c.App.Session().UserId == post.UserId {
 		if !c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_DELETE_POST) {
@@ -532,9 +531,6 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updatePost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
-	auditRec.AddMeta("post_id", post.Id)
-	auditRec.AddMeta("channel_id", post.ChannelId)
-	auditRec.AddMeta("creator_user_id", post.UserId)
 
 	// The post being updated in the payload must be the same one as indicated in the URL.
 	if post.Id != c.Params.PostId {
@@ -552,6 +548,7 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PERMISSION_EDIT_POST)
 		return
 	}
+	auditRec.AddMeta("post", originalPost)
 
 	// Updating the file_ids of a post is not a supported operation and will be ignored
 	post.FileIds = originalPost.FileIds
@@ -572,6 +569,7 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("update", rpost)
 
 	w.Write([]byte(rpost.ToJson()))
 }
@@ -591,7 +589,6 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchPost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
-	auditRec.AddMeta("post_id", c.Params.PostId)
 
 	// Updating the file_ids of a post is not a supported operation and will be ignored
 	post.FileIds = nil
@@ -606,8 +603,7 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PERMISSION_EDIT_POST)
 		return
 	}
-	auditRec.AddMeta("channel_id", originalPost.ChannelId)
-	auditRec.AddMeta("creator_user_id", originalPost.UserId)
+	auditRec.AddMeta("post", originalPost)
 
 	if c.App.Session().UserId != originalPost.UserId {
 		if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
@@ -623,6 +619,7 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("patch", patchedPost)
 
 	w.Write([]byte(patchedPost.ToJson()))
 }
@@ -657,7 +654,6 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 
 	auditRec := c.MakeAuditRecord("saveIsPinnedPost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
-	auditRec.AddMeta("post_id", c.Params.PostId)
 
 	if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_READ_CHANNEL) {
 		c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
@@ -676,8 +672,7 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("channel_id", post.ChannelId)
-	auditRec.AddMeta("creator_user_id", post.UserId)
+	auditRec.AddMeta("post", post)
 
 	channel, err := c.App.GetChannel(post.ChannelId)
 	if err != nil {
@@ -696,11 +691,12 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
 	patch := &model.PostPatch{}
 	patch.IsPinned = model.NewBool(isPinned)
 
-	_, err = c.App.PatchPost(c.Params.PostId, patch)
+	patchedPost, err := c.App.PatchPost(c.Params.PostId, patch)
 	if err != nil {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("patch", patchedPost)
 
 	auditRec.Success()
 	ReturnStatusOK(w)

api4/role.go

@@ -93,16 +93,13 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchRole", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("role_id", c.Params.RoleId)
 
 	oldRole, err := c.App.GetRole(c.Params.RoleId)
 	if err != nil {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("role_id", oldRole.Name)
-	auditRec.AddMeta("role_desc", oldRole.Description)
-	auditRec.AddMeta("role_display", oldRole.DisplayName)
+	auditRec.AddMeta("role", oldRole)
 
 	if c.App.License() == nil && patch.Permissions != nil {
 		if oldRole.Name == "system_guest" || oldRole.Name == "team_guest" || oldRole.Name == "channel_guest" {
@@ -154,6 +151,7 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("patch", role)
 	c.LogAudit("")
 
 	w.Write([]byte(role.ToJson()))

api4/scheme.go

@@ -29,9 +29,7 @@ func createScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createScheme", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("scheme_name", scheme.Name)
-	auditRec.AddMeta("scheme_display", scheme.DisplayName)
-	auditRec.AddMeta("scheme_desc", scheme.Description)
+	auditRec.AddMeta("scheme", scheme)
 
 	if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
 		c.Err = model.NewAppError("Api4.CreateScheme", "api.scheme.create_scheme.license.error", nil, "", http.StatusNotImplemented)
@@ -50,7 +48,7 @@ func createScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("scheme_id", scheme.Id)
+	auditRec.AddMeta("scheme", scheme) // overwrite meta
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(scheme.ToJson()))
@@ -173,10 +171,6 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchScheme", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("scheme_id", c.Params.SchemeId)
-	auditRec.AddMeta("new_scheme_name", patch.Name)
-	auditRec.AddMeta("new_scheme_display", patch.DisplayName)
-	auditRec.AddMeta("new_scheme_desc", patch.Description)
 
 	if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
 		c.Err = model.NewAppError("Api4.PatchScheme", "api.scheme.patch_scheme.license.error", nil, "", http.StatusNotImplemented)
@@ -188,9 +182,7 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("old_scheme_name", scheme.Name)
-	auditRec.AddMeta("old_scheme_display", scheme.DisplayName)
-	auditRec.AddMeta("old_scheme_desc", scheme.Description)
+	auditRec.AddMeta("scheme", scheme)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
@@ -202,6 +194,7 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("patch", scheme)
 
 	auditRec.Success()
 	c.LogAudit("")
@@ -217,7 +210,6 @@ func deleteScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("deleteScheme", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("scheme_id", c.Params.SchemeId)
 
 	if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
 		c.Err = model.NewAppError("Api4.DeleteScheme", "api.scheme.delete_scheme.license.error", nil, "", http.StatusNotImplemented)
@@ -229,11 +221,14 @@ func deleteScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if _, err := c.App.DeleteScheme(c.Params.SchemeId); err != nil {
+	scheme, err := c.App.DeleteScheme(c.Params.SchemeId)
+	if err != nil {
 		c.Err = err
 		return
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("scheme", scheme)
+
 	ReturnStatusOK(w)
 }

api4/system.go

@@ -183,18 +183,24 @@ func testSiteURL(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getAudits(c *Context, w http.ResponseWriter, r *http.Request) {
+	auditRec := c.MakeAuditRecord("getAudits", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
 		return
 	}
 
 	audits, err := c.App.GetAuditsPage("", c.Params.Page, c.Params.PerPage)
-
 	if err != nil {
 		c.Err = err
 		return
 	}
 
+	auditRec.Success()
+	auditRec.AddMeta("page", c.Params.Page)
+	auditRec.AddMeta("audits_per_page", c.Params.LogsPerPage)
+
 	w.Write([]byte(audits.ToJson()))
 }
 
@@ -245,6 +251,9 @@ func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getLogs(c *Context, w http.ResponseWriter, r *http.Request) {
+	auditRec := c.MakeAuditRecord("getLogs", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
 		return
@@ -256,6 +265,9 @@ func getLogs(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.AddMeta("page", c.Params.Page)
+	auditRec.AddMeta("logs_per_page", c.Params.LogsPerPage)
+
 	w.Write([]byte(model.ArrayToJson(lines)))
 }
 

api4/team.go

@@ -84,8 +84,7 @@ func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createTeam", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_TEAM) {
 		c.Err = model.NewAppError("createTeam", "api.team.is_team_creation_allowed.disabled.app_error", nil, "", http.StatusForbidden)
@@ -101,7 +100,7 @@ func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 	// Don't sanitize the team here since the user will be a team admin and their session won't reflect that yet
 
 	auditRec.Success()
-	auditRec.AddMeta("team_id", rteam.Id)
+	auditRec.AddMeta("team", team) // overwrite meta
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(rteam.ToJson()))
@@ -171,9 +170,7 @@ func updateTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateTeam", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -187,6 +184,7 @@ func updateTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("update", updatedTeam)
 
 	c.App.SanitizeTeam(*c.App.Session(), updatedTeam)
 	w.Write([]byte(updatedTeam.ToJson()))
@@ -207,13 +205,16 @@ func patchTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchTeam", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
 		return
 	}
 
+	if oldTeam, err := c.App.GetTeam(c.Params.TeamId); err == nil {
+		auditRec.AddMeta("team", oldTeam)
+	}
+
 	patchedTeam, err := c.App.PatchTeam(c.Params.TeamId, team)
 
 	if err != nil {
@@ -224,8 +225,7 @@ func patchTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 	c.App.SanitizeTeam(*c.App.Session(), patchedTeam)
 
 	auditRec.Success()
-	auditRec.AddMeta("team_name", patchedTeam.Name)
-	auditRec.AddMeta("team_display", patchedTeam.DisplayName)
+	auditRec.AddMeta("patched", patchedTeam)
 	c.LogAudit("")
 
 	w.Write([]byte(patchedTeam.ToJson()))
@@ -244,7 +244,6 @@ func regenerateTeamInviteId(c *Context, w http.ResponseWriter, r *http.Request)
 
 	auditRec := c.MakeAuditRecord("regenerateTeamInviteId", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
 
 	patchedTeam, err := c.App.RegenerateTeamInviteId(c.Params.TeamId)
 	if err != nil {
@@ -255,8 +254,7 @@ func regenerateTeamInviteId(c *Context, w http.ResponseWriter, r *http.Request)
 	c.App.SanitizeTeam(*c.App.Session(), patchedTeam)
 
 	auditRec.Success()
-	auditRec.AddMeta("team_name", patchedTeam.Name)
-	auditRec.AddMeta("team_display", patchedTeam.DisplayName)
+	auditRec.AddMeta("team", patchedTeam)
 	c.LogAudit("")
 
 	w.Write([]byte(patchedTeam.ToJson()))
@@ -275,7 +273,10 @@ func deleteTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("deleteTeam", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
+
+	if team, err := c.App.GetTeam(c.Params.TeamId); err == nil {
+		auditRec.AddMeta("team", team)
+	}
 
 	var err *model.AppError
 	if c.Params.Permanent && *c.App.Config().ServiceSettings.EnableAPITeamDeletion {
@@ -488,8 +489,7 @@ func addTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("addTeamMember", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
-	auditRec.AddMeta("add_user_id", member.UserId)
+	auditRec.AddMeta("member", member)
 
 	if member.UserId == c.App.Session().UserId {
 		var team *model.Team
@@ -519,8 +519,7 @@ func addTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	if team.IsGroupConstrained() {
 		nonMembers, err := c.App.FilterNonGroupTeamMembers([]string{member.UserId}, team)
@@ -582,7 +581,7 @@ func addUserToTeamFromInvite(c *Context, w http.ResponseWriter, r *http.Request)
 
 	auditRec.Success()
 	if member != nil {
-		auditRec.AddMeta("add_user_id", member.UserId)
+		auditRec.AddMeta("member", member)
 	}
 
 	w.WriteHeader(http.StatusCreated)
@@ -612,7 +611,6 @@ func addTeamMembers(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("addTeamMembers", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
 	auditRec.AddMeta("count", len(members))
 
 	var memberIDs []string
@@ -626,8 +624,7 @@ func addTeamMembers(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	if team.IsGroupConstrained() {
 		nonMembers, err := c.App.FilterNonGroupTeamMembers(memberIDs, team)
@@ -702,7 +699,6 @@ func removeTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("removeTeamMember", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
 
 	if c.App.Session().UserId != c.Params.UserId {
 		if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_REMOVE_USER_FROM_TEAM) {
@@ -716,15 +712,14 @@ func removeTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	user, err := c.App.GetUser(c.Params.UserId)
 	if err != nil {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("remove_user_id", user.Id)
+	auditRec.AddMeta("user", user)
 
 	if team.IsGroupConstrained() && (c.Params.UserId != c.App.Session().UserId) && !user.IsBot {
 		c.Err = model.NewAppError("removeTeamMember", "api.team.remove_member.group_constrained.app_error", nil, "", http.StatusBadRequest)
@@ -807,20 +802,22 @@ func updateTeamMemberRoles(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateTeamMemberRoles", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
+	auditRec.AddMeta("roles", newRoles)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM_ROLES) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM_ROLES)
 		return
 	}
 
-	if _, err := c.App.UpdateTeamMemberRoles(c.Params.TeamId, c.Params.UserId, newRoles); err != nil {
+	teamMember, err := c.App.UpdateTeamMemberRoles(c.Params.TeamId, c.Params.UserId, newRoles)
+	if err != nil {
 		c.Err = err
 		return
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("member", teamMember)
+
 	ReturnStatusOK(w)
 }
 
@@ -838,23 +835,22 @@ func updateTeamMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.Requ
 
 	auditRec := c.MakeAuditRecord("updateTeamMemberSchemeRoles", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
-	auditRec.AddMeta("new_scheme_admin", schemeRoles.SchemeAdmin)
-	auditRec.AddMeta("new_scheme_user", schemeRoles.SchemeUser)
-	auditRec.AddMeta("new_scheme_guest", schemeRoles.SchemeGuest)
+	auditRec.AddMeta("roles", schemeRoles)
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM_ROLES) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_TEAM_ROLES)
 		return
 	}
 
-	if _, err := c.App.UpdateTeamMemberSchemeRoles(c.Params.TeamId, c.Params.UserId, schemeRoles.SchemeGuest, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin); err != nil {
+	teamMember, err := c.App.UpdateTeamMemberSchemeRoles(c.Params.TeamId, c.Params.UserId, schemeRoles.SchemeGuest, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin)
+	if err != nil {
 		c.Err = err
 		return
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("member", teamMember)
+
 	ReturnStatusOK(w)
 }
 
@@ -1370,7 +1366,6 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateTeamScheme", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("team_id", c.Params.TeamId)
 
 	if c.App.License() == nil {
 		c.Err = model.NewAppError("Api4.UpdateTeamScheme", "api.team.update_team_scheme.license.error", nil, "", http.StatusNotImplemented)
@@ -1388,9 +1383,7 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 			c.Err = err
 			return
 		}
-		auditRec.AddMeta("scheme_id", scheme.Id)
-		auditRec.AddMeta("scheme_name", scheme.Name)
-		auditRec.AddMeta("scheme_display", scheme.DisplayName)
+		auditRec.AddMeta("scheme", scheme)
 
 		if scheme.Scope != model.SCHEME_SCOPE_TEAM {
 			c.Err = model.NewAppError("Api4.UpdateTeamScheme", "api.team.update_team_scheme.scheme_scope.error", nil, "", http.StatusBadRequest)
@@ -1403,8 +1396,7 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("team_name", team.Name)
-	auditRec.AddMeta("team_display", team.DisplayName)
+	auditRec.AddMeta("team", team)
 
 	team.SchemeId = schemeID
 

api4/user.go

@@ -96,7 +96,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec := c.MakeAuditRecord("createUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
 	auditRec.AddMeta("invite_id", inviteId)
-	auditRec.AddMeta("create_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	// No permission check required
 
@@ -137,7 +137,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("create_user_id", ruser.Id)
+	auditRec.AddMeta("user", ruser) // overwrite meta
 
 	w.WriteHeader(http.StatusCreated)
 	w.Write([]byte(ruser.ToJson()))
@@ -425,11 +425,14 @@ func setProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("setProfileImage", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("set_user_id", c.Params.UserId)
 	if imageArray[0] != nil {
 		auditRec.AddMeta("filename", imageArray[0].Filename)
 	}
 
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	imageData := imageArray[0]
 	if err := c.App.SetProfileImage(c.Params.UserId, imageData); err != nil {
 		c.Err = err
@@ -460,14 +463,13 @@ func setDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
 
 	auditRec := c.MakeAuditRecord("setDefaultProfileImage", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("set_user_id", c.Params.UserId)
 
 	user, err := c.App.GetUser(c.Params.UserId)
 	if err != nil {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("set_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	if err := c.App.SetDefaultProfileImage(user); err != nil {
 		c.Err = err
@@ -888,7 +890,6 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", user.Id)
 
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), user.Id) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -900,6 +901,7 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("user", ouser)
 
 	if c.App.Session().IsOAuth {
 		if ouser.Email != user.Email {
@@ -925,8 +927,7 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("update_username", ruser.Username)
-	auditRec.AddMeta("update_email", ruser.Email)
+	auditRec.AddMeta("update", ruser)
 	c.LogAudit("")
 
 	w.Write([]byte(ruser.ToJson()))
@@ -946,7 +947,6 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("patchUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("patch_user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -958,6 +958,7 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetInvalidParam("user_id")
 		return
 	}
+	auditRec.AddMeta("user", ouser)
 
 	if c.App.Session().IsOAuth && patch.Email != nil {
 		if ouser.Email != *patch.Email {
@@ -989,8 +990,7 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
 	c.App.SetAutoResponderStatus(ruser, ouser.NotifyProps)
 
 	auditRec.Success()
-	auditRec.AddMeta("patch_username", ruser.Username)
-	auditRec.AddMeta("patch_email", ruser.Email)
+	auditRec.AddMeta("patch", ruser)
 	c.LogAudit("")
 
 	w.Write([]byte(ruser.ToJson()))
@@ -1006,7 +1006,6 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("deleteUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("delete_user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), userId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1024,7 +1023,7 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("delete_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	if _, err = c.App.UpdateActive(user, false); err != nil {
 		c.Err = err
@@ -1051,20 +1050,21 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateUserRoles", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
-	auditRec.AddMeta("new_roles", newRoles)
+	auditRec.AddMeta("roles", newRoles)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_ROLES) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_ROLES)
 		return
 	}
 
-	if _, err := c.App.UpdateUserRoles(c.Params.UserId, newRoles, true); err != nil {
+	user, err := c.App.UpdateUserRoles(c.Params.UserId, newRoles, true)
+	if err != nil {
 		c.Err = err
 		return
 	}
 
 	auditRec.Success()
+	auditRec.AddMeta("user", user)
 	c.LogAudit(fmt.Sprintf("user=%s roles=%s", c.Params.UserId, newRoles))
 
 	ReturnStatusOK(w)
@@ -1086,8 +1086,7 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateUserActive", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
-	auditRec.AddMeta("new_active", active)
+	auditRec.AddMeta("active", active)
 
 	// true when you're trying to de-activate yourself
 	isSelfDeactive := !active && c.Params.UserId == c.App.Session().UserId
@@ -1108,6 +1107,7 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
+	auditRec.AddMeta("user", user)
 
 	if active && user.IsGuest() && !*c.App.Config().GuestAccountsSettings.Enable {
 		c.Err = model.NewAppError("updateUserActive", "api.user.update_active.cannot_enable_guest_when_guest_feature_is_disabled.app_error", nil, "userId="+c.Params.UserId, http.StatusUnauthorized)
@@ -1144,7 +1144,6 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateUserAuth", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
 
 	userAuth := model.UserAuthFromJson(r.Body)
 	if userAuth == nil {
@@ -1152,6 +1151,10 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	user, err := c.App.UpdateUserAuth(c.Params.UserId, userAuth)
 	if err != nil {
 		c.Err = err
@@ -1207,7 +1210,6 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updateUserMfa", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
 
 	if c.App.Session().IsOAuth {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1220,6 +1222,10 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	props := model.StringInterfaceFromJson(r.Body)
 	activate, ok := props["activate"].(bool)
 	if !ok {
@@ -1290,9 +1296,12 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("updatePassword", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("update_user_id", c.Params.UserId)
 	c.LogAudit("attempted")
 
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	var err *model.AppError
 	if c.Params.UserId == c.App.Session().UserId {
 		currentPassword := props["current_password"]
@@ -1478,7 +1487,7 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta(audit.KeyUserID, user.Id)
+	auditRec.AddMeta("user", user)
 
 	if user.IsGuest() {
 		if c.App.License() == nil {
@@ -1575,7 +1584,6 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("revokeSession", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("revoke_user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1594,7 +1602,7 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("device_id", session.DeviceId)
+	auditRec.AddMeta("session", session)
 
 	if session.UserId != c.Params.UserId {
 		c.SetInvalidUrlParam("user_id")
@@ -1620,7 +1628,7 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
 
 	auditRec := c.MakeAuditRecord("revokeAllSessionsForUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("revoke_user_id", c.Params.UserId)
+	auditRec.AddMeta("user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1720,6 +1728,13 @@ func getUserAudits(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec := c.MakeAuditRecord("getUserAudits", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
 		return
@@ -1731,6 +1746,10 @@ func getUserAudits(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	auditRec.Success()
+	auditRec.AddMeta("page", c.Params.Page)
+	auditRec.AddMeta("audits_per_page", c.Params.LogsPerPage)
+
 	w.Write([]byte(audits.ToJson()))
 }
 
@@ -1777,8 +1796,7 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
 		ReturnStatusOK(w)
 		return
 	}
-	auditRec.AddMeta("send_user_id", user.Id)
-	auditRec.AddMeta("send_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	if err = c.App.SendEmailVerification(user, user.Email); err != nil {
 		// Don't want to leak whether the email is valid or not
@@ -1844,7 +1862,10 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createUserAccessToken", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("create_user_id", c.Params.UserId)
+
+	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
 
 	if c.App.Session().IsOAuth {
 		c.SetPermissionError(model.PERMISSION_CREATE_USER_ACCESS_TOKEN)
@@ -2004,7 +2025,10 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("revoke_user_id", accessToken.UserId)
+
+	if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
+		auditRec.AddMeta("user", user)
+	}
 
 	if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -2046,7 +2070,10 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("disable_user_id", accessToken.UserId)
+
+	if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
+		auditRec.AddMeta("user", user)
+	}
 
 	if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -2088,7 +2115,10 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("enabled_user_id", accessToken.UserId)
+
+	if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
+		auditRec.AddMeta("user", user)
+	}
 
 	if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
 		c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -2118,6 +2148,10 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
 	auditRec.AddMeta("terms_id", termsOfServiceId)
 	auditRec.AddMeta("accepted", accepted)
 
+	if user, err := c.App.GetUser(userId); err == nil {
+		auditRec.AddMeta("user", user)
+	}
+
 	if _, err := c.App.GetTermsOfService(termsOfServiceId); err != nil {
 		c.Err = err
 		return
@@ -2152,7 +2186,6 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("promoteGuestToUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("promote_user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_PROMOTE_GUEST) {
 		c.SetPermissionError(model.PERMISSION_PROMOTE_GUEST)
@@ -2164,7 +2197,7 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("promote_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	if !user.IsGuest() {
 		c.Err = model.NewAppError("Api4.promoteGuestToUser", "api.user.promote_guest_to_user.no_guest.app_error", nil, "", http.StatusNotImplemented)
@@ -2198,7 +2231,6 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("demoteUserToGuest", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("demote_user_id", c.Params.UserId)
 
 	if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_DEMOTE_TO_GUEST) {
 		c.SetPermissionError(model.PERMISSION_DEMOTE_TO_GUEST)
@@ -2210,7 +2242,7 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = err
 		return
 	}
-	auditRec.AddMeta("demote_username", user.Username)
+	auditRec.AddMeta("user", user)
 
 	if user.IsGuest() {
 		c.Err = model.NewAppError("Api4.demoteUserToGuest", "api.user.demote_user_to_guest.already_guest.app_error", nil, "", http.StatusNotImplemented)

api4/webhook.go

@@ -40,9 +40,7 @@ func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	auditRec := c.MakeAuditRecord("createIncomingHook", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-	auditRec.AddMeta("channel_id", channel.Id)
-	auditRec.AddMeta("channel_name", channel.Name)
-	auditRec.AddMeta("team_id", channel.TeamId)
+	auditRec.AddMeta("channel", channel)
 	c.LogAudit("attempt")
 
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_INCOMING_WEBHOOKS) {
@@ -63,8 +61,7 @@ func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	auditRec.Success()
-	auditRec.AddMeta("hook_id", incomingHook.Id)
-	auditRec.AddMeta("hook_display", incomingHook.DisplayName)
+	auditRec.AddMeta("hook", incomingHook)
 	c.LogAudit("success")
 
 	w.WriteHeader(http.StatusCreated)