Mono repo -> Master (#22553)

Combines the following repositories into one:

https://github.com/mattermost/mattermost-server
https://github.com/mattermost/mattermost-webapp
https://github.com/mattermost/focalboard
https://github.com/mattermost/mattermost-plugin-playbooks

server/channels/audit/audit.go

@@ -0,0 +1,91 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+import (
+	"fmt"
+
+	"github.com/mattermost/mattermost-server/v6/server/platform/shared/mlog"
+)
+
+type Audit struct {
+	logger *mlog.Logger
+
+	// OnQueueFull is called on an attempt to add an audit record to a full queue.
+	// Return true to drop record, or false to block until there is room in queue.
+	OnQueueFull func(qname string, maxQueueSize int) bool
+
+	// OnError is called when an error occurs while writing an audit record.
+	OnError func(err error)
+}
+
+func (a *Audit) Init(maxQueueSize int) {
+	a.logger, _ = mlog.NewLogger(
+		mlog.MaxQueueSize(maxQueueSize),
+		mlog.OnLoggerError(a.onLoggerError),
+		mlog.OnQueueFull(a.onQueueFull),
+		mlog.OnTargetQueueFull(a.onTargetQueueFull),
+	)
+}
+
+// LogRecord emits an audit record with complete info.
+func (a *Audit) LogRecord(level mlog.Level, rec Record) {
+	flds := []mlog.Field{
+		mlog.String(KeyEventName, rec.EventName),
+		mlog.String(KeyStatus, rec.Status),
+		mlog.Any(KeyActor, rec.Actor),
+		mlog.Any(KeyEvent, rec.EventData),
+		mlog.Any(KeyMeta, rec.Meta),
+		mlog.Any(KeyError, rec.Error),
+	}
+
+	a.logger.Log(level, "", flds...)
+}
+
+// Configure sets zero or more target to output audit logs to.
+func (a *Audit) Configure(cfg mlog.LoggerConfiguration) error {
+	return a.logger.ConfigureTargets(cfg, nil)
+}
+
+// Flush attempts to write all queued audit records to all targets.
+func (a *Audit) Flush() error {
+	err := a.logger.Flush()
+	if err != nil {
+		a.onLoggerError(err)
+	}
+	return err
+}
+
+// Shutdown cleanly stops the audit engine after making best efforts to flush all targets.
+func (a *Audit) Shutdown() error {
+	err := a.logger.Shutdown()
+	if err != nil {
+		a.onLoggerError(err)
+	}
+	return err
+}
+
+func (a *Audit) onQueueFull(rec *mlog.LogRec, maxQueueSize int) bool {
+	if a.OnQueueFull != nil {
+		return a.OnQueueFull("main", maxQueueSize)
+	}
+	mlog.Error("Audit logging queue full, dropping record.", mlog.Int("queueSize", maxQueueSize))
+	return true
+}
+
+func (a *Audit) onTargetQueueFull(target mlog.Target, rec *mlog.LogRec, maxQueueSize int) bool {
+	if a.OnQueueFull != nil {
+		return a.OnQueueFull(fmt.Sprintf("%v", target), maxQueueSize)
+	}
+	mlog.Error("Audit logging queue full for target, dropping record.", mlog.Any("target", target), mlog.Int("queueSize", maxQueueSize))
+	return true
+}
+
+func (a *Audit) onLoggerError(err error) {
+	if a.OnError != nil {
+		a.OnError(err)
+		return
+	}
+	mlog.Error("Auditing error", mlog.Err(err))
+}

server/channels/audit/audit_test.go

@@ -0,0 +1,103 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost-server/v6/model"
+	"github.com/mattermost/mattermost-server/v6/server/platform/shared/mlog"
+)
+
+func TestAudit_LogRecord(t *testing.T) {
+	userId := model.NewId()
+	testCases := []struct {
+		description  string
+		auditLogFunc func(audit Audit)
+		expectedLogs []string
+	}{
+		{
+			"empty record",
+			func(audit Audit) {
+				rec := Record{}
+				audit.LogRecord(mlog.LvlAuditAPI, rec)
+			},
+			[]string{
+				`{"timestamp":0,"level":"audit-api","msg":"","event_name":"","status":"","actor":{"user_id":"","session_id":"","client":"","ip_address":""},"event":{"parameters":null,"prior_state":null,"resulting_state":null,"object_type":""},"meta":null,"error":{}}`,
+			},
+		},
+		{
+			"update user record, no error",
+			func(audit Audit) {
+
+				usr := &model.User{}
+				usr.Id = userId
+				usr.Username = "TestABC"
+				usr.Password = "hello_world"
+
+				rec := Record{}
+				rec.AddEventObjectType("user")
+				rec.EventName = "User.Update"
+				rec.AddEventPriorState(usr)
+
+				usr.Username = "TestDEF"
+				rec.AddEventResultState(usr)
+				rec.Success()
+
+				audit.LogRecord(mlog.LvlAuditAPI, rec)
+			},
+			[]string{
+				strings.Replace(`{"timestamp":0,"level":"audit-api","msg":"","event_name":"User.Update","status":"success","actor":{"user_id":"","session_id":"","client":"","ip_address":""},"event":{"parameters":null,"prior_state":{"allow_marketing":false,"auth_service":"","bot_description":"","bot_last_icon_update":0,"create_at":0,"delete_at":0,"disable_welcome_email":false,"email":"","email_verified":false,"failed_attempts":0,"id":"_____USERID_____","is_bot":false,"last_activity_at":0,"last_password_update":0,"last_picture_update":0,"locale":"","mfa_active":false,"notify_props":null,"position":"","props":null,"remote_id":null,"roles":"","terms_of_service_create_at":0,"terms_of_service_id":"","timezone":null,"update_at":0,"username":"TestABC"},"resulting_state":{"allow_marketing":false,"auth_service":"","bot_description":"","bot_last_icon_update":0,"create_at":0,"delete_at":0,"disable_welcome_email":false,"email":"","email_verified":false,"failed_attempts":0,"id":"_____USERID_____","is_bot":false,"last_activity_at":0,"last_password_update":0,"last_picture_update":0,"locale":"","mfa_active":false,"notify_props":null,"position":"","props":null,"remote_id":null,"roles":"","terms_of_service_create_at":0,"terms_of_service_id":"","timezone":null,"update_at":0,"username":"TestDEF"},"object_type":"user"},"meta":null,"error":{}}`, "_____USERID_____", userId, -1),
+			},
+		},
+	}
+
+	cfg := mlog.TargetCfg{
+		Type:          "file",
+		Format:        "json",
+		FormatOptions: nil,
+		Levels:        []mlog.Level{mlog.LvlAuditCLI, mlog.LvlAuditAPI, mlog.LvlAuditPerms, mlog.LvlAuditContent},
+	}
+
+	reTs := regexp.MustCompile(`"timestamp":"[0-9\.\-\+\:\sZ]+"`)
+
+	for _, testCase := range testCases {
+		t.Run(testCase.description, func(t *testing.T) {
+			tempDir, err := os.MkdirTemp(os.TempDir(), "TestAudit_LogRecord")
+			require.NoError(t, err)
+			defer os.Remove(tempDir)
+
+			filePath := filepath.Join(tempDir, "audit.log")
+			cfg.Options = json.RawMessage(fmt.Sprintf(`{"filename": "%s"}`, filePath))
+			logger, err := mlog.NewLogger()
+			require.NoError(t, err)
+
+			err = logger.ConfigureTargets(map[string]mlog.TargetCfg{testCase.description: cfg}, nil)
+			require.NoError(t, err)
+			mlog.InitGlobalLogger(logger)
+
+			audit := Audit{}
+			audit.logger = logger
+			testCase.auditLogFunc(audit)
+
+			err = logger.Shutdown()
+			require.NoError(t, err)
+
+			logs, err := os.ReadFile(filePath)
+			require.NoError(t, err)
+
+			actual := strings.TrimSpace(string(logs))
+			actual = reTs.ReplaceAllString(actual, `"timestamp":0`)
+			require.ElementsMatch(t, testCase.expectedLogs, strings.Split(actual, "\n"))
+		})
+	}
+}

server/channels/audit/const.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+const (
+	DefMaxQueueSize = 1000
+
+	KeyActor     = "actor"
+	KeyAPIPath   = "api_path"
+	KeyEvent     = "event"
+	KeyEventData = "event_data"
+	KeyEventName = "event_name"
+	KeyMeta      = "meta"
+	KeyError     = "error"
+	KeyStatus    = "status"
+	KeyUserID    = "user_id"
+	KeySessionID = "session_id"
+	KeyClient    = "client"
+	KeyIPAddress = "ip_address"
+	KeyClusterID = "cluster_id"
+
+	Success = "success"
+	Attempt = "attempt"
+	Fail    = "fail"
+)

server/channels/audit/record.go

@@ -0,0 +1,122 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+// Record provides a consistent set of fields used for all audit logging.
+type Record struct {
+	EventName string                 `json:"event_name"`
+	Status    string                 `json:"status"`
+	EventData EventData              `json:"event"`
+	Actor     EventActor             `json:"actor"`
+	Meta      map[string]interface{} `json:"meta"`
+	Error     EventError             `json:"error,omitempty"`
+}
+
+// EventData contains all event specific data about the modified entity
+type EventData struct {
+	Parameters  map[string]interface{} `json:"parameters"`      // Payload and parameters being processed as part of the request
+	PriorState  map[string]interface{} `json:"prior_state"`     // Prior state of the object being modified, nil if no prior state
+	ResultState map[string]interface{} `json:"resulting_state"` // Resulting object after creating or modifying it
+	ObjectType  string                 `json:"object_type"`     // String representation of the object type. eg. "post"
+}
+
+// EventActor is the subject triggering the event
+type EventActor struct {
+	UserId    string `json:"user_id"`
+	SessionId string `json:"session_id"`
+	Client    string `json:"client"`
+	IpAddress string `json:"ip_address"`
+}
+
+// EventMeta is a key-value store to store related information to the event that is not directly related to the modified entity
+type EventMeta struct {
+	ApiPath   string `json:"api_path"`
+	ClusterId string `json:"cluster_id"`
+}
+
+// EventError contains error information in case of failure of the event
+type EventError struct {
+	Description string `json:"description,omitempty"`
+	Code        int    `json:"status_code,omitempty"`
+}
+
+// Auditable for sensitive object classes, consider implementing Auditable and include whatever the
+// AuditableObject returns. For example: it's likely OK to write a user object to the
+// audit logs, but not the user password in cleartext or hashed form
+type Auditable interface {
+	Auditable() map[string]interface{}
+}
+
+// Success marks the audit record status as successful.
+func (rec *Record) Success() {
+	rec.Status = Success
+}
+
+// Fail marks the audit record status as failed.
+func (rec *Record) Fail() {
+	rec.Status = Fail
+}
+
+// AddEventParameter adds a parameter, e.g. query or post body, to the event
+func AddEventParameter[T string | bool | int | int64 | []string | map[string]string](rec *Record, key string, val T) {
+	if rec.EventData.Parameters == nil {
+		rec.EventData.Parameters = make(map[string]interface{})
+	}
+
+	rec.EventData.Parameters[key] = val
+}
+
+// AddEventParameterAuditable adds an object that is of type Auditable to the event
+func AddEventParameterAuditable(rec *Record, key string, val Auditable) {
+	if rec.EventData.Parameters == nil {
+		rec.EventData.Parameters = make(map[string]interface{})
+	}
+
+	rec.EventData.Parameters[key] = val.Auditable()
+}
+
+// AddEventParameterAuditableArray adds an array of objects of type Auditable to the event
+func AddEventParameterAuditableArray[T Auditable](rec *Record, key string, val []T) {
+	if rec.EventData.Parameters == nil {
+		rec.EventData.Parameters = make(map[string]interface{})
+	}
+
+	processedAuditables := make([]map[string]interface{}, 0, len(val))
+	for _, auditableVal := range val {
+		processedAuditables = append(processedAuditables, auditableVal.Auditable())
+	}
+
+	rec.EventData.Parameters[key] = processedAuditables
+}
+
+// AddEventPriorState adds the prior state of the modified object to the audit record
+func (rec *Record) AddEventPriorState(object Auditable) {
+	rec.EventData.PriorState = object.Auditable()
+}
+
+// AddEventResultState adds the result state of the modified object to the audit record
+func (rec *Record) AddEventResultState(object Auditable) {
+	rec.EventData.ResultState = object.Auditable()
+}
+
+// AddEventObjectType adds the object type of the modified object to the audit record
+func (rec *Record) AddEventObjectType(objectType string) {
+	rec.EventData.ObjectType = objectType
+}
+
+// AddMeta adds a key/value entry to the audit record that can be used for related information not directly related to
+// the modified object, e.g. authentication method
+func (rec *Record) AddMeta(name string, val interface{}) {
+	rec.Meta[name] = val
+}
+
+// AddErrorCode adds the error code for a failed event to the audit record
+func (rec *Record) AddErrorCode(code int) {
+	rec.Error.Code = code
+}
+
+// AddErrorDesc adds the error description for a failed event to the audit record
+func (rec *Record) AddErrorDesc(description string) {
+	rec.Error.Description = description
+}