snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/channels/audit/audit.go

@@ -0,0 +1,96 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+import (
+	"fmt"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/mlog"
+)
+
+// DefMaxQueueSize is sized for the post delivery audit stream, which emits one record per post
+// per recipient and so bursts far above the volume of the other audit levels.
+const DefMaxQueueSize = 10000
+
+type Audit struct {
+	logger *mlog.Logger
+
+	// OnQueueFull is called on an attempt to add an audit record to a full queue.
+	// Return true to drop record, or false to block until there is room in queue.
+	OnQueueFull func(qname string, maxQueueSize int) bool
+
+	// OnError is called when an error occurs while writing an audit record.
+	OnError func(err error)
+}
+
+func (a *Audit) Init(maxQueueSize int) {
+	a.logger, _ = mlog.NewLogger(
+		mlog.MaxQueueSize(maxQueueSize),
+		mlog.OnLoggerError(a.onLoggerError),
+		mlog.OnQueueFull(a.onQueueFull),
+		mlog.OnTargetQueueFull(a.onTargetQueueFull),
+	)
+}
+
+// LogRecord emits an audit record with complete info.
+func (a *Audit) LogRecord(level mlog.Level, rec model.AuditRecord) {
+	flds := []mlog.Field{
+		mlog.String(model.AuditKeyEventName, rec.EventName),
+		mlog.String(model.AuditKeyStatus, rec.Status),
+		mlog.Any(model.AuditKeyActor, rec.Actor),
+		mlog.Any(model.AuditKeyEvent, rec.EventData),
+		mlog.Any(model.AuditKeyMeta, rec.Meta),
+		mlog.Any(model.AuditKeyError, rec.Error),
+	}
+
+	a.logger.Log(level, "", flds...)
+}
+
+// Configure sets zero or more target to output audit logs to.
+func (a *Audit) Configure(cfg mlog.LoggerConfiguration) error {
+	return a.logger.ConfigureTargets(cfg, nil)
+}
+
+// Flush attempts to write all queued audit records to all targets.
+func (a *Audit) Flush() error {
+	err := a.logger.Flush()
+	if err != nil {
+		a.onLoggerError(err)
+	}
+	return err
+}
+
+// Shutdown cleanly stops the audit engine after making best efforts to flush all targets.
+func (a *Audit) Shutdown() error {
+	err := a.logger.Shutdown()
+	if err != nil {
+		a.onLoggerError(err)
+	}
+	return err
+}
+
+func (a *Audit) onQueueFull(rec *mlog.LogRec, maxQueueSize int) bool {
+	if a.OnQueueFull != nil {
+		return a.OnQueueFull("main", maxQueueSize)
+	}
+	mlog.Error("Audit logging queue full, dropping record.", mlog.Int("queue_size", maxQueueSize))
+	return true
+}
+
+func (a *Audit) onTargetQueueFull(target mlog.Target, rec *mlog.LogRec, maxQueueSize int) bool {
+	if a.OnQueueFull != nil {
+		return a.OnQueueFull(fmt.Sprintf("%v", target), maxQueueSize)
+	}
+	mlog.Error("Audit logging queue full for target, dropping record.", mlog.Any("target", target), mlog.Int("queue_size", maxQueueSize))
+	return true
+}
+
+func (a *Audit) onLoggerError(err error) {
+	if a.OnError != nil {
+		a.OnError(err)
+		return
+	}
+	mlog.Error("Auditing error", mlog.Err(err))
+}

server/channels/audit/audit_test.go

@@ -0,0 +1,102 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package audit
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/mlog"
+)
+
+func TestAudit_LogAuditRecord(t *testing.T) {
+	userId := model.NewId()
+	testCases := []struct {
+		description  string
+		auditLogFunc func(audit Audit)
+		expectedLogs []string
+	}{
+		{
+			"empty record",
+			func(audit Audit) {
+				rec := model.AuditRecord{}
+				audit.LogRecord(mlog.LvlAuditAPI, rec)
+			},
+			[]string{
+				`{"timestamp":0,"level":"audit-api","msg":"","event_name":"","status":"","actor":{"user_id":"","session_id":"","client":"","ip_address":"","x_forwarded_for":""},"event":{"parameters":null,"prior_state":null,"resulting_state":null,"object_type":""},"meta":null,"error":{}}`,
+			},
+		},
+		{
+			"update user record, no error",
+			func(audit Audit) {
+				usr := &model.User{}
+				usr.Id = userId
+				usr.Username = "TestABC"
+				usr.Password = "hello_world"
+
+				rec := model.AuditRecord{}
+				rec.AddEventObjectType("user")
+				rec.EventName = "User.Update"
+				rec.AddEventPriorState(usr)
+
+				usr.Username = "TestDEF"
+				rec.AddEventResultState(usr)
+				rec.Success()
+
+				audit.LogRecord(mlog.LvlAuditAPI, rec)
+			},
+			[]string{
+				strings.Replace(`{"timestamp":0,"level":"audit-api","msg":"","event_name":"User.Update","status":"success","actor":{"user_id":"","session_id":"","client":"","ip_address":"","x_forwarded_for":""},"event":{"parameters":null,"prior_state":{"allow_marketing":false,"auth_service":"","bot_description":"","bot_last_icon_update":0,"create_at":0,"delete_at":0,"disable_welcome_email":false,"email":"","email_verified":false,"failed_attempts":0,"id":"_____USERID_____","is_bot":false,"last_activity_at":0,"last_password_update":0,"last_picture_update":0,"locale":"","mfa_active":false,"notify_props":null,"position":"","props":null,"remote_id":"","roles":"","terms_of_service_create_at":0,"terms_of_service_id":"","timezone":null,"update_at":0,"username":"TestABC"},"resulting_state":{"allow_marketing":false,"auth_service":"","bot_description":"","bot_last_icon_update":0,"create_at":0,"delete_at":0,"disable_welcome_email":false,"email":"","email_verified":false,"failed_attempts":0,"id":"_____USERID_____","is_bot":false,"last_activity_at":0,"last_password_update":0,"last_picture_update":0,"locale":"","mfa_active":false,"notify_props":null,"position":"","props":null,"remote_id":"","roles":"","terms_of_service_create_at":0,"terms_of_service_id":"","timezone":null,"update_at":0,"username":"TestDEF"},"object_type":"user"},"meta":null,"error":{}}`, "_____USERID_____", userId, -1),
+			},
+		},
+	}
+
+	cfg := mlog.TargetCfg{
+		Type:          "file",
+		Format:        "json",
+		FormatOptions: nil,
+		Levels:        []mlog.Level{mlog.LvlAuditCLI, mlog.LvlAuditAPI, mlog.LvlAuditPerms, mlog.LvlAuditContent},
+	}
+
+	reTs := regexp.MustCompile(`"timestamp":"[0-9\.\-\+\:\sZ]+"`)
+
+	for _, testCase := range testCases {
+		t.Run(testCase.description, func(t *testing.T) {
+			tempDir, err := os.MkdirTemp(os.TempDir(), "TestAudit_LogRecord")
+			require.NoError(t, err)
+			defer os.Remove(tempDir)
+
+			filePath := filepath.Join(tempDir, "audit.log")
+			cfg.Options = json.RawMessage(fmt.Sprintf(`{"filename": "%s"}`, filePath))
+			logger, err := mlog.NewLogger()
+			require.NoError(t, err)
+
+			err = logger.ConfigureTargets(map[string]mlog.TargetCfg{testCase.description: cfg}, nil)
+			require.NoError(t, err)
+			mlog.InitGlobalLogger(logger)
+
+			audit := Audit{}
+			audit.logger = logger
+			testCase.auditLogFunc(audit)
+
+			err = logger.Shutdown()
+			require.NoError(t, err)
+
+			logs, err := os.ReadFile(filePath)
+			require.NoError(t, err)
+
+			actual := strings.TrimSpace(string(logs))
+			actual = reTs.ReplaceAllString(actual, `"timestamp":0`)
+			require.ElementsMatch(t, testCase.expectedLogs, strings.Split(actual, "\n"))
+		})
+	}
+}