feat: Add audit logging (#38189)

Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/asymkey/deploy_key.go

@@ -8,9 +8,11 @@ import (
 	"fmt"
 
 	asymkey_model "gitea.dev/models/asymkey"
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	deploykey_model "gitea.dev/models/deploykey"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/services/audit"
 )
 
 // DeleteRepoDeployKeys deletes all deploy keys of a repository. permissions check should be done outside
@@ -64,6 +66,9 @@ func DeleteDeployKey(ctx context.Context, repo *repo_model.Repository, id int64)
 	if err != nil {
 		return nil, err
 	}
+
+	audit.Record(ctx, audit_model.RepositoryDeployKeyRemove, repo, "deploy_key", deleted.Name)
+
 	if deleted.KeyType == deploykey_model.KeyTypeToken {
 		return deleted, nil // a token never appears in the authorized_keys file
 	}

services/asymkey/ssh_key.go

@@ -7,8 +7,10 @@ import (
 	"context"
 
 	asymkey_model "gitea.dev/models/asymkey"
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/services/audit"
 )
 
 // DeletePublicKey deletes SSH key information both in database and authorized_keys file.
@@ -31,9 +33,15 @@ func DeletePublicKey(ctx context.Context, doer *user_model.User, id int64) (err
 		return err
 	}
 
+	owner := audit.ScopeFromUserID(ctx, key.OwnerID)
+
 	if key.Type == asymkey_model.KeyTypePrincipal {
+		audit.Record(ctx, audit_model.UserKeyPrincipalRemove, owner, "key", key.Name)
+
 		return RewriteAllPrincipalKeys(ctx)
 	}
 
+	audit.Record(ctx, audit_model.UserKeySSHRemove, owner, "fingerprint", key.Fingerprint)
+
 	return RewriteAllPublicKeys(ctx)
 }