MM-22785 audit server CLI (#14144)

Add auditing to server CLI.

Also:
- simplify auditing in API layer
- reduce number of AddMeta calls
- have models serialize themselves
- more consistent field naming

cmd/mattermost/commands/channel.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -215,6 +216,11 @@ func createChannelCmdF(command *cobra.Command, args []string) error {
 		return errCreatedChannel
 	}
 
+	auditRec := a.MakeAuditRecord("createChannel", audit.Success)
+	auditRec.AddMeta("channel", createdChannel)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
+
 	CommandPrettyPrintln("Id: " + createdChannel.Id)
 	CommandPrettyPrintln("Name: " + createdChannel.Name)
 	CommandPrettyPrintln("Display Name: " + createdChannel.DisplayName)
@@ -251,7 +257,6 @@ func removeChannelUsersCmdF(command *cobra.Command, args []string) error {
 			removeUserFromChannel(a, channel, user, args[i+1])
 		}
 	}
-
 	return nil
 }
 
@@ -262,13 +267,24 @@ func removeUserFromChannel(a *app.App, channel *model.Channel, user *model.User,
 	}
 	if err := a.RemoveUserFromChannel(user.Id, "", channel); err != nil {
 		CommandPrintErrorln("Unable to remove '" + userArg + "' from " + channel.Name + ". Error: " + err.Error())
+		return
 	}
+
+	auditRec := a.MakeAuditRecord("removeUserFromChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("user", user)
+	a.LogAuditRec(auditRec, nil)
 }
 
 func removeAllUsersFromChannel(a *app.App, channel *model.Channel) {
 	if err := a.Srv().Store.Channel().PermanentDeleteMembersByChannel(channel.Id); err != nil {
 		CommandPrintErrorln("Unable to remove all users from " + channel.Name + ". Error: " + err.Error())
+		return
 	}
+
+	auditRec := a.MakeAuditRecord("removeAllUsersFromChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	a.LogAuditRec(auditRec, nil)
 }
 
 func addChannelUsersCmdF(command *cobra.Command, args []string) error {
@@ -287,7 +303,6 @@ func addChannelUsersCmdF(command *cobra.Command, args []string) error {
 	for i, user := range users {
 		addUserToChannel(a, channel, user, args[i+1])
 	}
-
 	return nil
 }
 
@@ -298,7 +313,13 @@ func addUserToChannel(a *app.App, channel *model.Channel, user *model.User, user
 	}
 	if _, err := a.AddUserToChannel(user, channel); err != nil {
 		CommandPrintErrorln("Unable to add '" + userArg + "' from " + channel.Name + ". Error: " + err.Error())
+		return
 	}
+
+	auditRec := a.MakeAuditRecord("addUserToChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("user", user)
+	a.LogAuditRec(auditRec, nil)
 }
 
 func archiveChannelsCmdF(command *cobra.Command, args []string) error {
@@ -316,9 +337,12 @@ func archiveChannelsCmdF(command *cobra.Command, args []string) error {
 		}
 		if err := a.Srv().Store.Channel().Delete(channel.Id, model.GetMillis()); err != nil {
 			CommandPrintErrorln("Unable to archive channel '" + channel.Name + "' error: " + err.Error())
+			continue
 		}
+		auditRec := a.MakeAuditRecord("archiveChannel", audit.Success)
+		auditRec.AddMeta("channel", channel)
+		a.LogAuditRec(auditRec, nil)
 	}
-
 	return nil
 }
 
@@ -349,9 +373,12 @@ func deleteChannelsCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to delete channel '" + channel.Name + "' error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Deleted channel '" + channel.Name + "'")
+
+			auditRec := a.MakeAuditRecord("deleteChannel", audit.Success)
+			auditRec.AddMeta("channel", channel)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -392,7 +419,6 @@ func moveChannelsCmdF(command *cobra.Command, args []string) error {
 			CommandPrettyPrintln("Moved channel '" + channel.Name + "' to " + team.Name + "(" + team.Id + ") from " + originTeamID + ".")
 		}
 	}
-
 	return nil
 }
 
@@ -403,6 +429,11 @@ func moveChannel(a *app.App, team *model.Team, channel *model.Channel, user *mod
 		return err
 	}
 
+	auditRec := a.MakeAuditRecord("moveChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
+
 	if incomingWebhooks, err := a.GetIncomingWebhooksForTeamPage(oldTeamId, 0, 10000000); err != nil {
 		return err
 	} else {
@@ -479,7 +510,11 @@ func restoreChannelsCmdF(command *cobra.Command, args []string) error {
 		}
 		if err := a.Srv().Store.Channel().SetDeleteAt(channel.Id, 0, model.GetMillis()); err != nil {
 			CommandPrintErrorln("Unable to restore channel '" + args[i] + "'")
+			continue
 		}
+		auditRec := a.MakeAuditRecord("restoreChannel", audit.Success)
+		auditRec.AddMeta("channel", channel)
+		a.LogAuditRec(auditRec, nil)
 	}
 
 	suffix := ""
@@ -528,10 +563,17 @@ func modifyChannelCmdF(command *cobra.Command, args []string) error {
 		return fmt.Errorf("Unable to find user: '%v'", username)
 	}
 
-	if _, err := a.UpdateChannelPrivacy(channel, user); err != nil {
+	updatedChannel, errUpdate := a.UpdateChannelPrivacy(channel, user)
+	if errUpdate != nil {
 		return errors.Wrapf(err, "Failed to update channel ('%s') privacy", args[0])
 	}
 
+	auditRec := a.MakeAuditRecord("modifyChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("update", updatedChannel)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -554,11 +596,16 @@ func renameChannelCmdF(command *cobra.Command, args []string) error {
 		return errdn
 	}
 
-	_, errch := a.RenameChannel(channel, newChannelName, newDisplayName)
+	updatedChannel, errch := a.RenameChannel(channel, newChannelName, newDisplayName)
 	if errch != nil {
 		return errors.Wrapf(errch, "Error in updating channel from %s to %s", channel.Name, newChannelName)
 	}
 
+	auditRec := a.MakeAuditRecord("renameChannel", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("update", updatedChannel)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 

cmd/mattermost/commands/command.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/spf13/cobra"
 )
@@ -172,11 +173,16 @@ func createCommandCmdF(command *cobra.Command, args []string) error {
 		URL:              url,
 	}
 
-	if _, err := a.CreateCommand(newCommand); err != nil {
-		return errors.New("unable to create command '" + newCommand.DisplayName + "'. " + err.Error())
+	createdCommand, errCreate := a.CreateCommand(newCommand)
+	if errCreate != nil {
+		return errors.New("unable to create command '" + newCommand.DisplayName + "'. " + errCreate.Error())
 	}
 	CommandPrettyPrintln("created command '" + newCommand.DisplayName + "'")
 
+	auditRec := a.MakeAuditRecord("createCommand", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("command", createdCommand)
+	a.LogAuditRec(auditRec, nil)
 	return nil
 }
 
@@ -224,9 +230,13 @@ func moveCommandCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to move command '" + command.DisplayName + "' error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Moved command '" + command.DisplayName + "'")
+
+			auditRec := a.MakeAuditRecord("moveCommand", audit.Success)
+			auditRec.AddMeta("team", team)
+			auditRec.AddMeta("command", command)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -282,15 +292,20 @@ func deleteCommandCmdF(command *cobra.Command, args []string) error {
 		command.SilenceUsage = true
 		return errors.New("Unable to find command '" + args[0] + "'")
 	}
+
 	if err := a.DeleteCommand(slashCommand.Id); err != nil {
 		command.SilenceUsage = true
 		return errors.New("Unable to delete command '" + slashCommand.Id + "' error: " + err.Error())
 	}
 	CommandPrettyPrintln("Deleted command '" + slashCommand.Id + "' (" + slashCommand.DisplayName + ")")
+
+	auditRec := a.MakeAuditRecord("deleteCommand", audit.Success)
+	auditRec.AddMeta("command", slashCommand)
+	a.LogAuditRec(auditRec, nil)
 	return nil
 }
 
-func modifyCommandCmdF(command *cobra.Command, args []string) error {
+func modifyCommandCmdF(command *cobra.Command, args []string) (cmdError error) {
 	a, err := InitDBCommandContextCobra(command)
 	if err != nil {
 		return err
@@ -304,6 +319,10 @@ func modifyCommandCmdF(command *cobra.Command, args []string) error {
 	}
 	modifiedCommand := oldCommand
 
+	auditRec := a.MakeAuditRecord("modifyCommand", audit.Fail)
+	defer func() { a.LogAuditRec(auditRec, cmdError) }()
+	auditRec.AddMeta("command", oldCommand)
+
 	// get creator user
 	creator, _ := command.Flags().GetString("creator")
 	if creator != "" {
@@ -376,10 +395,14 @@ func modifyCommandCmdF(command *cobra.Command, args []string) error {
 	}
 	modifiedCommand.Method = method
 
-	if _, err := a.UpdateCommand(oldCommand, modifiedCommand); err != nil {
-		return errors.New("unable to modify command '" + modifiedCommand.DisplayName + "'. " + err.Error())
+	updatedCommand, errUpdated := a.UpdateCommand(oldCommand, modifiedCommand)
+	if errUpdated != nil {
+		return errors.New("unable to modify command '" + modifiedCommand.DisplayName + "'. " + errUpdated.Error())
 	}
 	CommandPrettyPrintln("modified command '" + modifiedCommand.DisplayName + "'")
 
+	auditRec.Success()
+	auditRec.AddMeta("update", updatedCommand)
+
 	return nil
 }

cmd/mattermost/commands/config.go

@@ -251,10 +251,23 @@ func configSetCmdF(command *cobra.Command, args []string) error {
 		return errors.New("Invalid locale configuration")
 	}
 
-	if _, err := configStore.Set(newConfig); err != nil {
-		return errors.Wrap(err, "failed to set config")
+	if _, errSet := configStore.Set(newConfig); errSet != nil {
+		return errors.Wrap(errSet, "failed to set config")
 	}
 
+	/*
+		Uncomment when CI unit test fail resolved.
+
+		a, errInit := InitDBCommandContextCobra(command)
+		if errInit == nil {
+			auditRec := a.MakeAuditRecord("configSet", audit.Success)
+			auditRec.AddMeta("setting", configSetting)
+			auditRec.AddMeta("new_value", newVal)
+			a.LogAuditRec(auditRec, nil)
+			a.Shutdown()
+		}
+	*/
+
 	return nil
 }
 
@@ -456,10 +469,21 @@ func configResetCmdF(command *cobra.Command, args []string) error {
 		return errors.New("Invalid locale configuration")
 	}
 
-	if _, err := configStore.Set(tempConfig); err != nil {
-		return errors.Wrap(err, "failed to set config")
+	if _, errSet := configStore.Set(tempConfig); errSet != nil {
+		return errors.Wrap(errSet, "failed to set config")
 	}
 
+	/*
+		Uncomment when CI unit test fail resolved.
+
+		a, errInit := InitDBCommandContextCobra(command)
+		if errInit == nil {
+			auditRec := a.MakeAuditRecord("configReset", audit.Success)
+			a.LogAuditRec(auditRec, nil)
+			a.Shutdown()
+		}
+	*/
+
 	return nil
 }
 

cmd/mattermost/commands/export.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"time"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -130,9 +131,13 @@ func scheduleExportCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("ERROR: Message export job failed. Please check the server logs")
 		} else {
 			CommandPrettyPrintln("SUCCESS: Message export job complete")
+
+			auditRec := a.MakeAuditRecord("scheduleExport", audit.Success)
+			auditRec.AddMeta("format", format)
+			auditRec.AddMeta("start", startTime)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -162,6 +167,11 @@ func buildExportCmdF(format string) func(command *cobra.Command, args []string)
 		}
 		CommandPrettyPrintln("SUCCESS: Your data was exported.")
 
+		auditRec := a.MakeAuditRecord("buildExport", audit.Success)
+		auditRec.AddMeta("format", format)
+		auditRec.AddMeta("start", startTime)
+		a.LogAuditRec(auditRec, nil)
+
 		return nil
 	}
 }
@@ -199,5 +209,10 @@ func bulkExportCmdF(command *cobra.Command, args []string) error {
 		return err
 	}
 
+	auditRec := a.MakeAuditRecord("bulkExport", audit.Success)
+	auditRec.AddMeta("all_teams", allTeams)
+	auditRec.AddMeta("file", args[0])
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }

cmd/mattermost/commands/group.go

@@ -6,6 +6,7 @@ package commands
 import (
 	"fmt"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 
 	"github.com/pkg/errors"
@@ -146,6 +147,10 @@ func channelGroupEnableCmdF(command *cobra.Command, args []string) error {
 		return appErr
 	}
 
+	auditRec := a.MakeAuditRecord("channelGroupEnable", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -166,6 +171,10 @@ func channelGroupDisableCmdF(command *cobra.Command, args []string) error {
 		return appErr
 	}
 
+	auditRec := a.MakeAuditRecord("channelGroupDisable", audit.Success)
+	auditRec.AddMeta("channel", channel)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -240,6 +249,10 @@ func teamGroupEnableCmdF(command *cobra.Command, args []string) error {
 		return appErr
 	}
 
+	auditRec := a.MakeAuditRecord("teamGroupEnable", audit.Success)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -260,6 +273,10 @@ func teamGroupDisableCmdF(command *cobra.Command, args []string) error {
 		return appErr
 	}
 
+	auditRec := a.MakeAuditRecord("teamGroupDisable", audit.Success)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 

cmd/mattermost/commands/import.go

@@ -9,6 +9,7 @@ import (
 
 	"fmt"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/spf13/cobra"
 )
 
@@ -87,6 +88,11 @@ func slackImportCmdF(command *cobra.Command, args []string) error {
 	CommandPrettyPrintln("Finished Slack Import.")
 	CommandPrettyPrintln("")
 
+	auditRec := a.MakeAuditRecord("slackImport", audit.Success)
+	auditRec.AddMeta("team", team)
+	auditRec.AddMeta("file", args[1])
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -147,6 +153,9 @@ func bulkImportCmdF(command *cobra.Command, args []string) error {
 
 	if apply {
 		CommandPrettyPrintln("Finished Bulk Import.")
+		auditRec := a.MakeAuditRecord("bulkImport", audit.Success)
+		auditRec.AddMeta("file", args[0])
+		a.LogAuditRec(auditRec, nil)
 	} else {
 		CommandPrettyPrintln("Validation complete. You can now perform the import by rerunning this command with the --apply flag.")
 	}

cmd/mattermost/commands/jobserver.go

@@ -8,6 +8,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/viper"
 	"github.com/spf13/cobra"
@@ -55,6 +56,11 @@ func jobserverCmdF(command *cobra.Command, args []string) error {
 		defer a.Srv().Jobs.StopSchedulers()
 	}
 
+	if !noJobs || !noSchedule {
+		auditRec := a.MakeAuditRecord("jobServer", audit.Success)
+		a.LogAuditRec(auditRec, nil)
+	}
+
 	signalChan := make(chan os.Signal, 1)
 	signal.Notify(signalChan, os.Interrupt, syscall.SIGINT, syscall.SIGTERM)
 	<-signalChan

cmd/mattermost/commands/ldap.go

@@ -4,6 +4,7 @@
 package commands
 
 import (
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/spf13/cobra"
 )
@@ -51,6 +52,8 @@ func ldapSyncCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("ERROR: AD/LDAP Synchronization please check the server logs")
 		} else {
 			CommandPrettyPrintln("SUCCESS: AD/LDAP Synchronization Complete")
+			auditRec := a.MakeAuditRecord("ldapSync", audit.Success)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
 
@@ -70,6 +73,8 @@ func ldapIdMigrateCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("ERROR: AD/LDAP IdAttribute migration failed! Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("SUCCESS: AD/LDAP IdAttribute migration complete. You can now change your IdAttribute to: " + toAttribute)
+			auditRec := a.MakeAuditRecord("ldapMigrate", audit.Success)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
 

cmd/mattermost/commands/license.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"io/ioutil"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/spf13/cobra"
 )
 
@@ -50,5 +51,9 @@ func uploadLicenseCmdF(command *cobra.Command, args []string) error {
 
 	CommandPrettyPrintln("Uploaded license file")
 
+	auditRec := a.MakeAuditRecord("uploadLicense", audit.Success)
+	auditRec.AddMeta("file", args[0])
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }

cmd/mattermost/commands/permissions.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/utils"
 )
 
@@ -86,6 +87,9 @@ func resetPermissionsCmdF(command *cobra.Command, args []string) error {
 	CommandPrettyPrintln("Changes will take effect gradually as the server caches expire.")
 	CommandPrettyPrintln("For the changes to take effect immediately, go to the Mattermost System Console > General > Configuration and click \"Purge All Caches\".")
 
+	auditRec := a.MakeAuditRecord("resetPermissions", audit.Success)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -104,6 +108,9 @@ func exportPermissionsCmdF(command *cobra.Command, args []string) error {
 		return errors.New(err.Error())
 	}
 
+	auditRec := a.MakeAuditRecord("exportPermissions", audit.Success)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -124,5 +131,9 @@ func importPermissionsCmdF(command *cobra.Command, args []string) error {
 	}
 	defer file.Close()
 
+	auditRec := a.MakeAuditRecord("importPermissions", audit.Success)
+	auditRec.AddMeta("file", args[0])
+	a.LogAuditRec(auditRec, nil)
+
 	return a.ImportPermissions(file)
 }

cmd/mattermost/commands/plugin.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -122,10 +123,12 @@ func pluginAddCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to add plugin: " + args[i] + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Added plugin: " + plugin)
+			auditRec := a.MakeAuditRecord("pluginAdd", audit.Success)
+			auditRec.AddMeta("plugin", plugin)
+			a.LogAuditRec(auditRec, nil)
 		}
 		fileReader.Close()
 	}
-
 	return nil
 }
 
@@ -145,9 +148,11 @@ func pluginDeleteCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to delete plugin: " + plugin + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Deleted plugin: " + plugin)
+			auditRec := a.MakeAuditRecord("pluginDelete", audit.Success)
+			auditRec.AddMeta("plugin", plugin)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -167,9 +172,11 @@ func pluginEnableCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to enable plugin: " + plugin + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Enabled plugin: " + plugin)
+			auditRec := a.MakeAuditRecord("pluginEnable", audit.Success)
+			auditRec.AddMeta("plugin", plugin)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -189,9 +196,11 @@ func pluginDisableCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to disable plugin: " + plugin + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Disabled plugin: " + plugin)
+			auditRec := a.MakeAuditRecord("pluginDisable", audit.Success)
+			auditRec.AddMeta("plugin", plugin)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -277,9 +286,11 @@ func pluginAddPublicKeyCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to add public key: " + pkFile + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Added public key: " + pkFile)
+			auditRec := a.MakeAuditRecord("pluginAddPublicKey", audit.Success)
+			auditRec.AddMeta("file", pkFile)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -299,8 +310,10 @@ func pluginDeletePublicKeyCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to delete public key: " + pkFile + ". Error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Deleted public key: " + pkFile)
+			auditRec := a.MakeAuditRecord("pluginDeletePublicKey", audit.Success)
+			auditRec.AddMeta("file", pkFile)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }

cmd/mattermost/commands/reset.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/spf13/cobra"
 )
 
@@ -49,5 +50,8 @@ func resetCmdF(command *cobra.Command, args []string) error {
 	a.Srv().Store.DropAllTables()
 	CommandPrettyPrintln("Database successfully reset")
 
+	auditRec := a.MakeAuditRecord("reset", audit.Success)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }

cmd/mattermost/commands/roles.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 )
 
@@ -78,11 +79,16 @@ func makeSystemAdminCmdF(command *cobra.Command, args []string) error {
 			roles = append(roles, model.SYSTEM_ADMIN_ROLE_ID)
 		}
 
-		if _, err := a.UpdateUserRoles(user.Id, strings.Join(roles, " "), true); err != nil {
-			return err
+		updatedUser, errUpdate := a.UpdateUserRoles(user.Id, strings.Join(roles, " "), true)
+		if errUpdate != nil {
+			return errUpdate
 		}
-	}
 
+		auditRec := a.MakeAuditRecord("makeSystemAdmin", audit.Success)
+		auditRec.AddMeta("user", user)
+		auditRec.AddMeta("update", updatedUser)
+		a.LogAuditRec(auditRec, nil)
+	}
 	return nil
 }
 
@@ -122,10 +128,15 @@ func makeMemberCmdF(command *cobra.Command, args []string) error {
 			newRoles = append(roles, model.SYSTEM_USER_ROLE_ID)
 		}
 
-		if _, err := a.UpdateUserRoles(user.Id, strings.Join(newRoles, " "), true); err != nil {
-			return err
+		updatedUser, errUpdate := a.UpdateUserRoles(user.Id, strings.Join(newRoles, " "), true)
+		if errUpdate != nil {
+			return errUpdate
 		}
-	}
 
+		auditRec := a.MakeAuditRecord("makeMember", audit.Success)
+		auditRec.AddMeta("user", user)
+		auditRec.AddMeta("update", updatedUser)
+		a.LogAuditRec(auditRec, nil)
+	}
 	return nil
 }

cmd/mattermost/commands/sampledata.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/icrowley/fake"
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/utils"
 	"github.com/spf13/cobra"
@@ -365,10 +366,15 @@ func sampleDataCmdF(command *cobra.Command, args []string) error {
 		if err != nil {
 			return errors.New("Unable to read correctly the temporary file.")
 		}
+
+		var importErr *model.AppError
 		importErr, lineNumber := a.BulkImport(bulkFile, false, workers)
 		if importErr != nil {
 			return fmt.Errorf("%s: %s, %s (line: %d)", importErr.Where, importErr.Message, importErr.DetailedError, lineNumber)
 		}
+		auditRec := a.MakeAuditRecord("sampleData", audit.Success)
+		auditRec.AddMeta("file", bulkFile.Name())
+		a.LogAuditRec(auditRec, nil)
 	} else if bulk != "-" {
 		err := bulkFile.Close()
 		if err != nil {

cmd/mattermost/commands/team.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/spf13/cobra"
 )
@@ -169,10 +170,15 @@ func createTeamCmdF(command *cobra.Command, args []string) error {
 		Type:        teamType,
 	}
 
-	if _, err := a.CreateTeam(team); err != nil {
-		return errors.New("Team creation failed: " + err.Error())
+	createdTeam, errCreate := a.CreateTeam(team)
+	if errCreate != nil {
+		return errors.New("Team creation failed: " + errCreate.Error())
 	}
 
+	auditRec := a.MakeAuditRecord("createTeam", audit.Success)
+	auditRec.AddMeta("team", createdTeam)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -203,7 +209,13 @@ func removeUserFromTeam(a *app.App, team *model.Team, user *model.User, userArg
 	}
 	if err := a.LeaveTeam(team, user, ""); err != nil {
 		CommandPrintErrorln("Unable to remove '" + userArg + "' from " + team.Name + ". Error: " + err.Error())
+		return
 	}
+
+	auditRec := a.MakeAuditRecord("removeUserFromTeam", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
 }
 
 func addUsersCmdF(command *cobra.Command, args []string) error {
@@ -222,7 +234,6 @@ func addUsersCmdF(command *cobra.Command, args []string) error {
 	for i, user := range users {
 		addUserToTeam(a, team, user, args[i+1])
 	}
-
 	return nil
 }
 
@@ -233,7 +244,13 @@ func addUserToTeam(a *app.App, team *model.Team, user *model.User, userArg strin
 	}
 	if err := a.JoinUserToTeam(team, user, ""); err != nil {
 		CommandPrintErrorln("Unable to add '" + userArg + "' to " + team.Name)
+		return
 	}
+
+	auditRec := a.MakeAuditRecord("addUserToTeam", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
 }
 
 func deleteTeamsCmdF(command *cobra.Command, args []string) error {
@@ -269,9 +286,12 @@ func deleteTeamsCmdF(command *cobra.Command, args []string) error {
 			CommandPrintErrorln("Unable to delete team '" + team.Name + "' error: " + err.Error())
 		} else {
 			CommandPrettyPrintln("Deleted team '" + team.Name + "'")
+
+			auditRec := a.MakeAuditRecord("deleteTeams", audit.Success)
+			auditRec.AddMeta("team", team)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -349,6 +369,10 @@ func restoreTeamsCmdF(command *cobra.Command, args []string) error {
 		err := a.RestoreTeam(team.Id)
 		if err != nil {
 			CommandPrintErrorln("Unable to restore team '" + team.Name + "' error: " + err.Error())
+		} else {
+			auditRec := a.MakeAuditRecord("restoreTeams", audit.Success)
+			auditRec.AddMeta("team", team)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
 	return nil
@@ -385,9 +409,12 @@ func archiveTeamCmdF(command *cobra.Command, args []string) error {
 		}
 		if err := a.SoftDeleteTeam(team.Id); err != nil {
 			CommandPrintErrorln("Unable to archive team '"+team.Name+"' error: ", err)
+		} else {
+			auditRec := a.MakeAuditRecord("archiveTeam", audit.Success)
+			auditRec.AddMeta("team", team)
+			a.LogAuditRec(auditRec, nil)
 		}
 	}
-
 	return nil
 }
 
@@ -418,11 +445,16 @@ func renameTeamCmdF(command *cobra.Command, args []string) error {
 		return errdn
 	}
 
-	_, errrt := a.RenameTeam(team, newTeamName, newDisplayName)
+	updatedTeam, errrt := a.RenameTeam(team, newTeamName, newDisplayName)
 	if errrt != nil {
 		CommandPrintErrorln("Unable to rename team to '"+newTeamName+"' error: ", errrt)
 	}
 
+	auditRec := a.MakeAuditRecord("renameTeam", audit.Success)
+	auditRec.AddMeta("team", team)
+	auditRec.AddMeta("update", updatedTeam)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -457,5 +489,11 @@ func modifyTeamCmdF(command *cobra.Command, args []string) error {
 		return errors.New("Failed to update privacy for team" + args[0])
 	}
 
+	auditRec := a.MakeAuditRecord("modifyTeam", audit.Success)
+	auditRec.AddMeta("team", team)
+	auditRec.AddMeta("type", team.Type)
+	auditRec.AddMeta("allow_open_invite", team.AllowOpenInvite)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }

cmd/mattermost/commands/user.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/spf13/cobra"
 )
@@ -303,10 +304,16 @@ func changeUserActiveStatus(a *app.App, user *model.User, userArg string, activa
 	if user.IsSSOUser() {
 		fmt.Println("You must also deactivate this user in the SSO provider or they will be reactivated on next login or sync.")
 	}
-	if _, err := a.UpdateActive(user, activate); err != nil {
+	updatedUser, err := a.UpdateActive(user, activate)
+	if err != nil {
 		return fmt.Errorf("Unable to change activation status of user: %v", userArg)
 	}
 
+	auditRec := a.MakeAuditRecord("changeActiveUserStatus", audit.Success)
+	auditRec.AddMeta("user", updatedUser)
+	auditRec.AddMeta("activate", activate)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -388,6 +395,11 @@ func userCreateCmdF(command *cobra.Command, args []string) error {
 	CommandPrettyPrintln("email: " + ruser.Email)
 	CommandPrettyPrintln("auth_service: " + ruser.AuthService)
 
+	auditRec := a.MakeAuditRecord("userCreate", audit.Success)
+	auditRec.AddMeta("user", ruser)
+	auditRec.AddMeta("system_admin", systemAdmin)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -406,6 +418,10 @@ func usersToBots(args []string, a *app.App) {
 		}
 
 		CommandPrettyPrintln(fmt.Sprintf("User %s is converted to bot successfully", bot.UserId))
+
+		auditRec := a.MakeAuditRecord("userToBot", audit.Success)
+		auditRec.AddMeta("user", user)
+		a.LogAuditRec(auditRec, nil)
 	}
 }
 
@@ -526,6 +542,12 @@ func botToUser(command *cobra.Command, args []string, a *app.App) error {
 	CommandPrettyPrintln("last_name: " + user.LastName)
 	CommandPrettyPrintln("roles: " + user.Roles)
 	CommandPrettyPrintln("locale: " + user.Locale)
+
+	auditRec := a.MakeAuditRecord("botToUser", audit.Success)
+	auditRec.AddMeta("bot", user)
+	auditRec.AddMeta("user", user)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -604,6 +626,11 @@ func inviteUser(a *app.App, email string, team *model.Team, teamArg string) erro
 	a.SendInviteEmails(team, "Administrator", "Mattermost CLI "+model.NewId(), invites, *a.Config().ServiceSettings.SiteURL)
 	CommandPrettyPrintln("Invites may or may not have been sent.")
 
+	auditRec := a.MakeAuditRecord("inviteUser", audit.Success)
+	auditRec.AddMeta("email", email)
+	auditRec.AddMeta("team", team)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -628,6 +655,10 @@ func resetUserPasswordCmdF(command *cobra.Command, args []string) error {
 		return err
 	}
 
+	auditRec := a.MakeAuditRecord("resetUserPassword", audit.Success)
+	auditRec.AddMeta("user", user)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -663,6 +694,11 @@ func updateUserEmailCmdF(command *cobra.Command, args []string) error {
 		return errors.New(errUpdate.Message)
 	}
 
+	auditRec := a.MakeAuditRecord("updateUserEmail", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("email", newEmail)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -678,7 +714,6 @@ func resetUserMfaCmdF(command *cobra.Command, args []string) error {
 	}
 
 	users := getUsersFromUserArgs(a, args)
-
 	for i, user := range users {
 		if user == nil {
 			return errors.New("Unable to find user '" + args[i] + "'")
@@ -687,6 +722,10 @@ func resetUserMfaCmdF(command *cobra.Command, args []string) error {
 		if err := a.DeactivateMfa(user.Id); err != nil {
 			return err
 		}
+
+		auditRec := a.MakeAuditRecord("resetUserMfa", audit.Success)
+		auditRec.AddMeta("user", user)
+		a.LogAuditRec(auditRec, nil)
 	}
 
 	return nil
@@ -735,6 +774,11 @@ func deleteUserCmdF(command *cobra.Command, args []string) error {
 				return err
 			}
 		}
+
+		auditRec := a.MakeAuditRecord("deleteUser", audit.Success)
+		auditRec.AddMeta("user", user)
+		auditRec.AddMeta("isBot", user.IsBot)
+		a.LogAuditRec(auditRec, nil)
 	}
 
 	return nil
@@ -770,9 +814,11 @@ func deleteAllUsersCommandF(command *cobra.Command, args []string) error {
 	if err := a.PermanentDeleteAllUsers(); err != nil {
 		return err
 	}
-
 	CommandPrettyPrintln("All user accounts successfully deleted.")
 
+	auditRec := a.MakeAuditRecord("deleteAllUsers", audit.Success)
+	a.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -815,8 +861,15 @@ func migrateAuthToLdapCmdF(command *cobra.Command, args []string) error {
 		}
 
 		CommandPrettyPrintln("Successfully migrated accounts.")
-	}
 
+		if !dryRunFlag {
+			auditRec := a.MakeAuditRecord("migrateAuthToLdap", audit.Success)
+			auditRec.AddMeta("fromAuth", fromAuth)
+			auditRec.AddMeta("matchField", matchField)
+			auditRec.AddMeta("force", forceFlag)
+			a.LogAuditRec(auditRec, nil)
+		}
+	}
 	return nil
 }
 
@@ -871,8 +924,13 @@ func migrateAuthToSamlCmdF(command *cobra.Command, args []string) error {
 		}
 
 		CommandPrettyPrintln("Successfully migrated accounts.")
-	}
 
+		if !dryRunFlag {
+			auditRec := a.MakeAuditRecord("migrateAuthToSaml", audit.Success)
+			auditRec.AddMeta("auto", autoFlag)
+			a.LogAuditRec(auditRec, nil)
+		}
+	}
 	return nil
 }
 

cmd/mattermost/commands/webhook.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
 	"github.com/pkg/errors"
@@ -194,10 +195,16 @@ func createIncomingWebhookCmdF(command *cobra.Command, args []string) error {
 	CommandPrettyPrintln("Id: " + createdIncoming.Id)
 	CommandPrettyPrintln("Display Name: " + createdIncoming.DisplayName)
 
+	auditRec := app.MakeAuditRecord("createIncomingWebhook", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("channel", channel)
+	auditRec.AddMeta("hook", createdIncoming)
+	app.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
-func modifyIncomingWebhookCmdF(command *cobra.Command, args []string) error {
+func modifyIncomingWebhookCmdF(command *cobra.Command, args []string) (cmdError error) {
 	app, err := InitDBCommandContextCobra(command)
 	if err != nil {
 		return err
@@ -216,6 +223,10 @@ func modifyIncomingWebhookCmdF(command *cobra.Command, args []string) error {
 
 	updatedHook := oldHook
 
+	auditRec := app.MakeAuditRecord("createIncomingWebhook", audit.Fail)
+	defer func() { app.LogAuditRec(auditRec, cmdError) }()
+	auditRec.AddMeta("hook", oldHook)
+
 	channelArg, _ := command.Flags().GetString("channel")
 	if channelArg != "" {
 		channel := getChannelFromChannelArg(app, channelArg)
@@ -240,10 +251,14 @@ func modifyIncomingWebhookCmdF(command *cobra.Command, args []string) error {
 	channelLocked, _ := command.Flags().GetBool("lock-to-channel")
 	updatedHook.ChannelLocked = channelLocked
 
-	if _, err := app.UpdateIncomingWebhook(oldHook, updatedHook); err != nil {
-		return err
+	updatedIncomingHook, errUpdated := app.UpdateIncomingWebhook(oldHook, updatedHook)
+	if errUpdated != nil {
+		return errUpdated
 	}
 
+	auditRec.Success()
+	auditRec.AddMeta("update", updatedIncomingHook)
+
 	return nil
 }
 
@@ -313,9 +328,10 @@ func createOutgoingWebhookCmdF(command *cobra.Command, args []string) error {
 		IconURL:      iconURL,
 	}
 
+	var channel *model.Channel
 	channelArg, _ := command.Flags().GetString("channel")
 	if channelArg != "" {
-		channel := getChannelFromChannelArg(app, channelArg)
+		channel = getChannelFromChannelArg(app, channelArg)
 		if channel != nil {
 			outgoingWebhook.ChannelId = channel.Id
 		}
@@ -329,6 +345,14 @@ func createOutgoingWebhookCmdF(command *cobra.Command, args []string) error {
 	CommandPrettyPrintln("Id: " + createdOutgoing.Id)
 	CommandPrettyPrintln("Display Name: " + createdOutgoing.DisplayName)
 
+	auditRec := app.MakeAuditRecord("createOutgoingWebhook", audit.Success)
+	auditRec.AddMeta("user", user)
+	auditRec.AddMeta("hook", createdOutgoing)
+	if channel != nil {
+		auditRec.AddMeta("channel", channel)
+	}
+	app.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -409,10 +433,16 @@ func modifyOutgoingWebhookCmdF(command *cobra.Command, args []string) error {
 		updatedHook.CallbackURLs = callbackURLs
 	}
 
-	if _, appErr := app.UpdateOutgoingWebhook(oldHook, updatedHook); appErr != nil {
+	updatedWebhook, appErr := app.UpdateOutgoingWebhook(oldHook, updatedHook)
+	if appErr != nil {
 		return appErr
 	}
 
+	auditRec := app.MakeAuditRecord("modifyOutgoingWebhook", audit.Success)
+	auditRec.AddMeta("hook", oldHook)
+	auditRec.AddMeta("update", updatedWebhook)
+	app.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -435,6 +465,10 @@ func deleteWebhookCmdF(command *cobra.Command, args []string) error {
 		return errors.New("Unable to delete webhook '" + webhookId + "'")
 	}
 
+	auditRec := app.MakeAuditRecord("deleteWebhook", audit.Success)
+	auditRec.AddMeta("hook_id", webhookId)
+	app.LogAuditRec(auditRec, nil)
+
 	return nil
 }
 
@@ -458,7 +492,7 @@ func showWebhookCmdF(command *cobra.Command, args []string) error {
 	return errors.New("Webhook with id " + webhookId + " not found")
 }
 
-func moveOutgoingWebhookCmd(command *cobra.Command, args []string) error {
+func moveOutgoingWebhookCmd(command *cobra.Command, args []string) (cmdError error) {
 	app, err := InitDBCommandContextCobra(command)
 	if err != nil {
 		return err
@@ -484,6 +518,10 @@ func moveOutgoingWebhookCmd(command *cobra.Command, args []string) error {
 		return appError
 	}
 
+	auditRec := app.MakeAuditRecord("moveOutgoingWebhook", audit.Fail)
+	defer func() { app.LogAuditRec(auditRec, cmdError) }()
+	auditRec.AddMeta("hook", webhook)
+
 	channelName, channelErr := command.Flags().GetString("channel")
 	if channelErr != nil {
 		return channelErr
@@ -507,10 +545,14 @@ func moveOutgoingWebhookCmd(command *cobra.Command, args []string) error {
 	webhook.Id = ""
 	webhook.TeamId = newTeamId
 
-	_, createErr := app.CreateOutgoingWebhook(webhook)
+	updatedWebHook, createErr := app.CreateOutgoingWebhook(webhook)
 	if createErr != nil {
 		return model.NewAppError("moveOutgoingWebhookCmd", "cli.outgoing_webhook.inconsistent_state.app_error", nil, "", http.StatusInternalServerError)
 	}
+
+	auditRec.Success()
+	auditRec.AddMeta("update", updatedWebHook)
+
 	return nil
 }