public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-14 19:22:09 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add audit logging (#38189)

Browse Source 
Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-09-12 10:15:23 +02:00
committed by GitHub
parent 4d43445532
commit da37b7916b
136 changed files with 3864 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/auth/2fa.go
+6
View File
@@ -7,12 +7,14 @@ import (
"errors"
"net/http"
audit_model "gitea.dev/models/audit"
"gitea.dev/models/auth"
user_model "gitea.dev/models/user"
"gitea.dev/modules/session"
"gitea.dev/modules/setting"
"gitea.dev/modules/templates"
"gitea.dev/modules/web"
"gitea.dev/services/audit"
"gitea.dev/services/context"
"gitea.dev/services/forms"
)
@@ -82,6 +84,10 @@ func TwoFactorPost(ctx *context.Context) {
return
}
if u, err := user_model.GetUserByID(ctx, id); err == nil {
audit.RecordAs(ctx, u, audit_model.UserAuthenticationFailTwoFactor, u)
}
ctx.RenderWithErrDeprecated(ctx.Tr("auth.twofa_passcode_incorrect"), tplTwofa, forms.TwoFactorAuthForm{})
}
routers/web/auth/auth.go
+5
View File
@@ -13,6 +13,7 @@ import (
"net/url"
"strings"
audit_model "gitea.dev/models/audit"
"gitea.dev/models/auth"
"gitea.dev/models/db"
user_model "gitea.dev/models/user"
@@ -27,6 +28,7 @@ import (
"gitea.dev/modules/util"
"gitea.dev/modules/web"
"gitea.dev/modules/web/middleware"
"gitea.dev/services/audit"
auth_service "gitea.dev/services/auth"
"gitea.dev/services/auth/source/oauth2"
"gitea.dev/services/context"
@@ -453,12 +455,15 @@ func SignOut(ctx *context.Context) {
websocket_service.PublishLogout(ctx.Doer.ID, ctx.Session.ID())
}
impersonator := audit.ImpersonatorFromContext(ctx)
exitedImpersonated, err := auth_service.ExitImpersonatedUser(ctx.Session)
if err != nil {
ctx.ServerError("ExitImpersonatedUser", err)
return
}
if exitedImpersonated {
audit.RecordAs(ctx, impersonator, audit_model.UserImpersonationExit, ctx.Doer)
ctx.Redirect(setting.AppSubURL + "/-/admin")
return
}
routers/web/auth/oauth.go
+3 -2
View File
@@ -26,6 +26,7 @@ import (
"gitea.dev/modules/proxy"
"gitea.dev/modules/session"
"gitea.dev/modules/setting"
"gitea.dev/services/audit"
source_service "gitea.dev/services/auth/source"
"gitea.dev/services/auth/source/oauth2"
"gitea.dev/services/context"
@@ -419,7 +420,7 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
// Register last login
opts.SetLastLogin = true
if err := user_service.UpdateUser(ctx, u, opts); err != nil {
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, opts); err != nil {
ctx.ServerError("UpdateUser", err)
return
}
@@ -448,7 +449,7 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
}
if opts.IsActive.Has() || opts.IsAdmin.Has() || opts.IsRestricted.Has() {
if err := user_service.UpdateUser(ctx, u, opts); err != nil {
if err := user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, opts); err != nil {
ctx.ServerError("UpdateUser", err)
return
}
routers/web/auth/oauth2_provider.go
+5 -1
View File
@@ -12,6 +12,7 @@ import (
"net/url"
"strconv"
audit_model "gitea.dev/models/audit"
"gitea.dev/models/auth"
user_model "gitea.dev/models/user"
"gitea.dev/modules/auth/httpauth"
@@ -20,6 +21,7 @@ import (
"gitea.dev/modules/setting"
"gitea.dev/modules/templates"
"gitea.dev/modules/web"
"gitea.dev/services/audit"
auth_service "gitea.dev/services/auth"
"gitea.dev/services/context"
"gitea.dev/services/forms"
@@ -120,7 +122,7 @@ func InfoOAuth(ctx *context.Context) {
var accessTokenScope auth.AccessTokenScope
if auHead := ctx.Req.Header.Get("Authorization"); auHead != "" {
if parsed, ok := httpauth.ParseAuthorizationHeader(auHead); ok && parsed.BearerToken != nil {
accessTokenScope, _ = auth_service.GetOAuthAccessTokenScopeAndUserID(ctx, parsed.BearerToken.Token)
accessTokenScope, _, _ = auth_service.GetOAuthAccessTokenScopeAndUserID(ctx, parsed.BearerToken.Token)
}
}
@@ -427,6 +429,8 @@ func GrantApplicationOAuth(ctx *context.Context) {
}, form.RedirectURI)
return
}
audit.Record(ctx, audit_model.UserOAuth2ApplicationGrant, ctx.Doer, "oauth2_application", app.Name, "granted_scope", form.Scope)
} else if grant.Scope != form.Scope {
handleAuthorizeError(ctx, AuthorizeError{
State: form.State,
routers/web/auth/oauth_signin_sync.go
+2 -1
View File
@@ -12,6 +12,7 @@ import (
"gitea.dev/modules/log"
"gitea.dev/modules/util"
asymkey_service "gitea.dev/services/asymkey"
"gitea.dev/services/audit"
"gitea.dev/services/auth/source/oauth2"
"gitea.dev/services/context"
user_service "gitea.dev/services/user"
@@ -54,7 +55,7 @@ func oauth2SignInSync(ctx *context.Context, authSourceID int64, u *user_model.Us
// sync user flags (admin/restricted)
isAdmin, isRestricted := getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
if isAdmin.Has() || isRestricted.Has() {
if err = user_service.UpdateUser(ctx, u, &user_service.UpdateOptions{IsAdmin: isAdmin, IsRestricted: isRestricted}); err != nil {
if err = user_service.UpdateUser(audit.WithDoer(ctx, user_model.NewAuthenticationSourceUser()), u, &user_service.UpdateOptions{IsAdmin: isAdmin, IsRestricted: isRestricted}); err != nil {
log.Error("Unable to sync OAuth2 user admin or restricted status %s: %v", gothUser.Provider, err)
}
}
routers/web/auth/password.go
+6
View File
@@ -7,6 +7,7 @@ import (
"errors"
"net/http"
audit_model "gitea.dev/models/audit"
"gitea.dev/models/auth"
user_model "gitea.dev/models/user"
"gitea.dev/modules/auth/password"
@@ -16,6 +17,7 @@ import (
"gitea.dev/modules/templates"
"gitea.dev/modules/timeutil"
"gitea.dev/modules/web"
"gitea.dev/services/audit"
"gitea.dev/services/context"
"gitea.dev/services/forms"
"gitea.dev/services/mailer"
@@ -86,6 +88,10 @@ func ForgotPasswdPost(ctx *context.Context) {
mailer.SendResetPasswordMail(u)
// the request is unauthenticated, so the affected account is the only actor
// we can name; the recorded IP address carries the forensic signal
audit.RecordAs(ctx, u, audit_model.UserPasswordResetRequest, u)
if err = ctx.Cache.Put("MailResendLimit_"+u.LowerName, u.LowerName, 180); err != nil {
log.Error("Set cache(MailResendLimit) fail: %v", err)
}