mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

[MM-64686] Expose audit logging functionality via plugin API (#31204)

Просмотр исходного кода 
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
Этот коммит содержится в:
David Krauser
2025-06-25 20:37:32 -04:00
коммит произвёл GitHub
родитель efb960a160
Коммит aaa62a40ae
68 изменённых файлов: 878 добавлений и 750 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

17
server/channels/web/context.go
Просмотреть файл

@@ -13,7 +13,6 @@ import (
"github.com/mattermost/mattermost/server/public/shared/mlog"
"github.com/mattermost/mattermost/server/public/shared/request"
"github.com/mattermost/mattermost/server/v8/channels/app"
"github.com/mattermost/mattermost/server/v8/channels/audit"
"github.com/mattermost/mattermost/server/v8/channels/utils"
)
@@ -27,7 +26,7 @@ type Context struct {
}
// LogAuditRec logs an audit record using default LevelAPI.
func (c *Context) LogAuditRec(rec *audit.Record) {
func (c *Context) LogAuditRec(rec *model.AuditRecord) {
// finish populating the context data, in case the session wasn't available during MakeAuditRecord
// (e.g., api4/user.go login)
if rec.Actor.UserId == "" {
@@ -43,7 +42,7 @@ func (c *Context) LogAuditRec(rec *audit.Record) {
// LogAuditRecWithLevel logs an audit record using specified Level.
// If the context is flagged with a permissions error then `level`
// is ignored and the audit record is emitted with `LevelPerms`.
func (c *Context) LogAuditRecWithLevel(rec *audit.Record, level mlog.Level) {
func (c *Context) LogAuditRecWithLevel(rec *model.AuditRecord, level mlog.Level) {
if rec == nil {
return
}
@@ -59,11 +58,11 @@ func (c *Context) LogAuditRecWithLevel(rec *audit.Record, level mlog.Level) {
}
// MakeAuditRecord creates an audit record pre-populated with data from this context.
func (c *Context) MakeAuditRecord(event string, initialStatus string) *audit.Record {
rec := &audit.Record{
func (c *Context) MakeAuditRecord(event string, initialStatus string) *model.AuditRecord {
rec := &model.AuditRecord{
EventName: event,
Status: initialStatus,
Actor: audit.EventActor{
Actor: model.AuditEventActor{
UserId: c.AppContext.Session().UserId,
SessionId: c.AppContext.Session().Id,
Client: c.AppContext.UserAgent(),
@@ -71,10 +70,10 @@ func (c *Context) MakeAuditRecord(event string, initialStatus string) *audit.Rec
XForwardedFor: c.AppContext.XForwardedFor(),
},
Meta: map[string]any{
audit.KeyAPIPath: c.AppContext.Path(),
audit.KeyClusterID: c.App.GetClusterId(),
model.AuditKeyAPIPath: c.AppContext.Path(),
model.AuditKeyClusterID: c.App.GetClusterId(),
},
EventData: audit.EventData{
EventData: model.AuditEventData{
Parameters: map[string]any{},
PriorState: map[string]any{},
ResultState: map[string]any{},

19
server/channels/web/oauth.go
Просмотреть файл

@@ -17,7 +17,6 @@ import (
"github.com/mattermost/mattermost/server/public/shared/i18n"
"github.com/mattermost/mattermost/server/public/shared/mlog"
"github.com/mattermost/mattermost/server/v8/channels/app"
"github.com/mattermost/mattermost/server/v8/channels/audit"
"github.com/mattermost/mattermost/server/v8/channels/utils"
"github.com/mattermost/mattermost/server/v8/channels/utils/fileutils"
)
@@ -65,7 +64,7 @@ func authorizeOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("authorizeOAuthApp", audit.Fail)
auditRec := c.MakeAuditRecord("authorizeOAuthApp", model.AuditStatusFail)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
@@ -93,7 +92,7 @@ func deauthorizeOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deauthorizeOAuthApp", audit.Fail)
auditRec := c.MakeAuditRecord("deauthorizeOAuthApp", model.AuditStatusFail)
auditRec.AddMeta("client_id", clientId)
defer c.LogAuditRec(auditRec)
@@ -135,7 +134,7 @@ func authorizeOAuthPage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("authorizeOAuthPage", audit.Fail)
auditRec := c.MakeAuditRecord("authorizeOAuthPage", model.AuditStatusFail)
auditRec.AddMeta("client_id", authRequest.ClientId)
auditRec.AddMeta("scope", authRequest.Scope)
defer c.LogAuditRec(auditRec)
@@ -243,7 +242,7 @@ func getAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
redirectURI := r.FormValue("redirect_uri")
auditRec := c.MakeAuditRecord("getAccessToken", audit.Fail)
auditRec := c.MakeAuditRecord("getAccessToken", model.AuditStatusFail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("grant_type", grantType)
auditRec.AddMeta("client_id", clientId)
@@ -275,9 +274,9 @@ func completeOAuth(c *Context, w http.ResponseWriter, r *http.Request) {
service := c.Params.Service
auditRec := c.MakeAuditRecord("completeOAuth", audit.Fail)
auditRec := c.MakeAuditRecord("completeOAuth", model.AuditStatusFail)
defer c.LogAuditRec(auditRec)
audit.AddEventParameter(auditRec, "service", service)
model.AddEventParameterToAuditRec(auditRec, "service", service)
oauthError := r.URL.Query().Get("error")
if oauthError == "access_denied" {
@@ -440,7 +439,7 @@ func loginWithOAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("loginWithOAuth", audit.Fail)
auditRec := c.MakeAuditRecord("loginWithOAuth", model.AuditStatusFail)
auditRec.AddMeta("service", c.Params.Service)
defer c.LogAuditRec(auditRec)
@@ -476,7 +475,7 @@ func mobileLoginWithOAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("mobileLoginWithOAuth", audit.Fail)
auditRec := c.MakeAuditRecord("mobileLoginWithOAuth", model.AuditStatusFail)
auditRec.AddMeta("service", c.Params.Service)
defer c.LogAuditRec(auditRec)
@@ -511,7 +510,7 @@ func signupWithOAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("signupWithOAuth", audit.Fail)
auditRec := c.MakeAuditRecord("signupWithOAuth", model.AuditStatusFail)
auditRec.AddMeta("service", c.Params.Service)
defer c.LogAuditRec(auditRec)

3
server/channels/web/saml.go
Просмотреть файл

@@ -13,7 +13,6 @@ import (
"github.com/mattermost/mattermost/server/public/model"
"github.com/mattermost/mattermost/server/public/plugin"
"github.com/mattermost/mattermost/server/v8/channels/audit"
"github.com/mattermost/mattermost/server/v8/channels/utils"
)
@@ -104,7 +103,7 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
relayProps = model.MapFromJSON(strings.NewReader(stateStr))
}
auditRec := c.MakeAuditRecord("completeSaml", audit.Fail)
auditRec := c.MakeAuditRecord("completeSaml", model.AuditStatusFail)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")