[MM-56339] Audit logs: on login add UserId and SessionId to audit's Actor field (#27446)

* on login add UserId and SessionId to audit's Actor field to match logout

* lint

* simplify to add only userId and sessionId

* AddToEventActor -> AddUser/SessionToEventActor

* fill in missing session data when logging the audit record

* why did it bump that? reverting.

* make modules-tidy

* trigger build

* add more context to the comment

server/channels/api4/user_test.go

@@ -184,6 +184,47 @@ func TestCreateUserAudit(t *testing.T) {
 	require.NotContains(t, string(data), password)
 }
 
+func TestUserLoginAudit(t *testing.T) {
+	logFile, err := os.CreateTemp("", "adv.log")
+	require.NoError(t, err)
+	defer os.Remove(logFile.Name())
+
+	os.Setenv("MM_EXPERIMENTALAUDITSETTINGS_FILEENABLED", "true")
+	os.Setenv("MM_EXPERIMENTALAUDITSETTINGS_FILENAME", logFile.Name())
+	defer os.Unsetenv("MM_EXPERIMENTALAUDITSETTINGS_FILEENABLED")
+	defer os.Unsetenv("MM_EXPERIMENTALAUDITSETTINGS_FILENAME")
+
+	options := []app.Option{app.WithLicense(model.NewTestLicense("advanced_logging"))}
+	th := SetupWithServerOptions(t, options)
+	defer th.TearDown()
+	_, err = th.Client.Logout(context.Background())
+	require.NoError(t, err)
+
+	user, resp, err := th.Client.Login(context.Background(), th.BasicUser.Email, th.BasicUser.Password)
+	require.NoError(t, err)
+	CheckOKStatus(t, resp)
+	assert.Equal(t, th.BasicUser.Id, user.Id)
+
+	sess, resp, err := th.Client.GetSessions(context.Background(), user.Id, "")
+	require.NoError(t, err)
+	CheckOKStatus(t, resp)
+	assert.Len(t, sess, 1)
+	assert.Equal(t, th.BasicUser.Id, sess[0].UserId)
+
+	// Forcing a flush before attempting to read log's content.
+	err = th.Server.Audit.Flush()
+	require.NoError(t, err)
+
+	require.NoError(t, logFile.Sync())
+
+	data, err := io.ReadAll(logFile)
+	require.NoError(t, err)
+	require.NotEmpty(t, data)
+
+	// ensure we are auditing the user_id and session_id
+	require.Contains(t, string(data), fmt.Sprintf("\"event_name\":\"login\",\"status\":\"success\",\"actor\":{\"user_id\":\"%s\",\"session_id\":\"%s\"", user.Id, sess[0].Id))
+}
+
 func TestCreateUserInputFilter(t *testing.T) {
 	th := Setup(t)
 	defer th.TearDown()

server/channels/utils/merge_test.go

@@ -1104,6 +1104,18 @@ func TestMergeWithVeryComplexStruct(t *testing.T) {
 		assert.Equal(t, patch, *merged)
 	})
 
+	t.Run("blank string in patch overwrites base string b/c empty string is not nil", func(t *testing.T) {
+		setupStructs(t)
+
+		patch.S = ""
+
+		merged, err := mergeTestStructs(base, patch)
+		require.NoError(t, err)
+
+		assert.NotEqual(t, base, *merged)
+		assert.Equal(t, patch, *merged)
+	})
+
 	t.Run("nil values in patch are ignored", func(t *testing.T) {
 		setupStructs(t)
 

server/channels/web/context.go

@@ -29,6 +29,15 @@ type Context struct {
 
 // LogAuditRec logs an audit record using default LevelAPI.
 func (c *Context) LogAuditRec(rec *audit.Record) {
+	// finish populating the context data, in case the session wasn't available during MakeAuditRecord
+	// (e.g., api4/user.go login)
+	if rec.Actor.UserId == "" {
+		rec.Actor.UserId = c.AppContext.Session().UserId
+	}
+	if rec.Actor.SessionId == "" {
+		rec.Actor.SessionId = c.AppContext.Session().Id
+	}
+
 	c.LogAuditRecWithLevel(rec, app.LevelAPI)
 }