feat: Add audit logging (#38189)

Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/repository/collaboration.go

@@ -8,12 +8,14 @@ import (
 	"context"
 	"fmt"
 
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/perm"
 	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/services/audit"
 
 	"xorm.io/builder"
 )
@@ -34,7 +36,8 @@ func AddOrUpdateCollaborator(ctx context.Context, repo *repo_model.Repository, u
 		return user_model.ErrBlockedUser
 	}
 
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	added, updated := false, false
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		collaboration, has, err := db.Get[repo_model.Collaboration](ctx, builder.Eq{
 			"repo_id": repo.ID,
 			"user_id": u.ID,
@@ -54,16 +57,31 @@ func AddOrUpdateCollaborator(ctx context.Context, repo *repo_model.Repository, u
 				}); err != nil {
 				return err
 			}
-		} else if err = db.Insert(ctx, &repo_model.Collaboration{
-			RepoID: repo.ID,
-			UserID: u.ID,
-			Mode:   mode,
-		}); err != nil {
-			return err
+			updated = true
+		} else {
+			if err = db.Insert(ctx, &repo_model.Collaboration{
+				RepoID: repo.ID,
+				UserID: u.ID,
+				Mode:   mode,
+			}); err != nil {
+				return err
+			}
+			added = true
 		}
 
 		return access_model.RecalculateUserAccess(ctx, repo, u.ID)
-	})
+	}); err != nil {
+		return err
+	}
+
+	switch {
+	case added:
+		audit.Record(ctx, audit_model.RepositoryCollaboratorAdd, repo, "collaborator", u.Name, "access_mode", mode.ToString())
+	case updated:
+		audit.Record(ctx, audit_model.RepositoryCollaboratorAccess, repo, "collaborator", u.Name, "access_mode", mode.ToString())
+	}
+
+	return nil
 }
 
 // DeleteCollaboration removes collaboration relation between the user and repository.
@@ -78,12 +96,14 @@ func deleteCollaborationByMode(ctx context.Context, repo *repo_model.Repository,
 }
 
 func deleteCollaboration(ctx context.Context, repo *repo_model.Repository, collaborator *user_model.User, collaboration *repo_model.Collaboration) (err error) {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		if deleted, err := db.GetEngine(ctx).Delete(collaboration); err != nil {
+	deleted := false
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
+		if n, err := db.GetEngine(ctx).Delete(collaboration); err != nil {
 			return err
-		} else if deleted == 0 {
+		} else if n == 0 {
 			return nil
 		}
+		deleted = true
 
 		if err := repo.LoadOwner(ctx); err != nil {
 			return err
@@ -98,7 +118,15 @@ func deleteCollaboration(ctx context.Context, repo *repo_model.Repository, colla
 
 		// Unassign a user from any issue (s)he has been assigned to in the repository
 		return ReconsiderRepoIssuesAssignee(ctx, repo, collaborator)
-	})
+	}); err != nil {
+		return err
+	}
+
+	if deleted {
+		audit.Record(ctx, audit_model.RepositoryCollaboratorRemove, repo, "collaborator", collaborator.Name)
+	}
+
+	return nil
 }
 
 func ReconsiderRepoIssuesAssignee(ctx context.Context, repo *repo_model.Repository, user *user_model.User) error {

services/repository/fork.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
 	repo_model "gitea.dev/models/repo"
@@ -19,6 +20,7 @@ import (
 	repo_module "gitea.dev/modules/repository"
 	"gitea.dev/modules/structs"
 	"gitea.dev/modules/util"
+	"gitea.dev/services/audit"
 	notify_service "gitea.dev/services/notify"
 
 	"xorm.io/builder"
@@ -210,7 +212,7 @@ func ForkRepository(ctx context.Context, doer, owner *user_model.User, opts Fork
 
 // ConvertForkToNormalRepository convert the provided repo from a forked repo to normal repo
 func ConvertForkToNormalRepository(ctx context.Context, repo *repo_model.Repository) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		repo, err := repo_model.GetRepositoryByID(ctx, repo.ID)
 		if err != nil {
 			return err
@@ -228,7 +230,13 @@ func ConvertForkToNormalRepository(ctx context.Context, repo *repo_model.Reposit
 		repo.IsFork = false
 		repo.ForkID = 0
 		return repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_fork", "fork_id")
-	})
+	}); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryConvertFork, repo)
+
+	return nil
 }
 
 type findForksOptions struct {

services/repository/repo_team.go

@@ -8,25 +8,33 @@ import (
 	"errors"
 	"fmt"
 
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/organization"
 	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/setting"
+	"gitea.dev/services/audit"
 )
 
 // TeamAddRepository adds new repository to team of organization.
-func TeamAddRepository(ctx context.Context, t *organization.Team, repo *repo_model.Repository) (err error) {
+func TeamAddRepository(ctx context.Context, t *organization.Team, repo *repo_model.Repository) error {
 	if repo.OwnerID != t.OrgID {
 		return errors.New("repository does not belong to organization")
 	} else if organization.HasTeamRepo(ctx, t.OrgID, t.ID, repo.ID) {
 		return nil
 	}
 
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		return addRepositoryToTeam(ctx, t, repo)
-	})
+	}); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryCollaboratorTeamAdd, repo, "team", t.Name)
+
+	return nil
 }
 
 func addRepositoryToTeam(ctx context.Context, t *organization.Team, repo *repo_model.Repository) (err error) {
@@ -62,7 +70,8 @@ func addRepositoryToTeam(ctx context.Context, t *organization.Team, repo *repo_m
 // AddAllRepositoriesToTeam adds all repositories to the team.
 // If the team already has some repositories they will be left unchanged.
 func AddAllRepositoriesToTeam(ctx context.Context, t *organization.Team) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	added := make([]*repo_model.Repository, 0, 5)
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		orgRepos, err := repo_model.GetOrgRepositories(ctx, t.OrgID)
 		if err != nil {
 			return fmt.Errorf("get org repos: %w", err)
@@ -73,11 +82,20 @@ func AddAllRepositoriesToTeam(ctx context.Context, t *organization.Team) error {
 				if err := addRepositoryToTeam(ctx, t, repo); err != nil {
 					return fmt.Errorf("AddRepository: %w", err)
 				}
+				added = append(added, repo)
 			}
 		}
 
 		return nil
-	})
+	}); err != nil {
+		return err
+	}
+
+	for _, repo := range added {
+		audit.Record(ctx, audit_model.RepositoryCollaboratorTeamAdd, repo, "team", t.Name)
+	}
+
+	return nil
 }
 
 // RemoveAllRepositoriesFromTeam removes all repositories from team and recalculates access
@@ -86,9 +104,23 @@ func RemoveAllRepositoriesFromTeam(ctx context.Context, t *organization.Team) (e
 		return nil
 	}
 
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	var removed repo_model.RepositoryList
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
+		var err error
+		removed, err = repo_model.GetTeamRepositories(ctx, &repo_model.SearchTeamRepoOptions{TeamID: t.ID})
+		if err != nil {
+			return fmt.Errorf("GetTeamRepositories: %w", err)
+		}
 		return removeAllRepositoriesFromTeam(ctx, t)
-	})
+	}); err != nil {
+		return err
+	}
+
+	for _, repo := range removed {
+		audit.Record(ctx, audit_model.RepositoryCollaboratorTeamRemove, repo, "team", t.Name)
+	}
+
+	return nil
 }
 
 // removeAllRepositoriesFromTeam removes all repositories from team and recalculates access
@@ -159,9 +191,15 @@ func RemoveRepositoryFromTeam(ctx context.Context, t *organization.Team, repoID
 		return err
 	}
 
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		return removeRepositoryFromTeam(ctx, t, repo, true)
-	})
+	}); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryCollaboratorTeamRemove, repo, "team", t.Name)
+
+	return nil
 }
 
 // removeRepositoryFromTeam removes a repository from a team and recalculates access

services/repository/repository.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	activities_model "gitea.dev/models/activities"
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
@@ -27,6 +28,7 @@ import (
 	repo_module "gitea.dev/modules/repository"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/structs"
+	"gitea.dev/services/audit"
 	notify_service "gitea.dev/services/notify"
 	pull_service "gitea.dev/services/pull"
 )
@@ -68,7 +70,13 @@ func DeleteRepository(ctx context.Context, doer *user_model.User, repo *repo_mod
 		notify_service.DeleteRepository(ctx, doer, repo)
 	}
 
-	return DeleteRepositoryDirectly(ctx, repo.ID)
+	if err := DeleteRepositoryDirectly(ctx, repo.ID); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryDelete, repo)
+
+	return nil
 }
 
 // PushCreateRepo creates a repository when a new repository is pushed to an appropriate namespace
@@ -127,6 +135,16 @@ func UpdateRepository(ctx context.Context, repo *repo_model.Repository, visibili
 }
 
 func MakeRepoPrivate(ctx context.Context, repo *repo_model.Repository, private bool) (err error) {
+	if err := setRepoVisibility(ctx, repo, private); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryVisibility, repo, "visibility", private)
+
+	return nil
+}
+
+func setRepoVisibility(ctx context.Context, repo *repo_model.Repository, private bool) (err error) {
 	return db.WithTx(ctx, func(ctx context.Context) error {
 		repo.IsPrivate = private
 		if err := repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_private"); err != nil {
@@ -173,8 +191,8 @@ func MakeRepoPrivate(ctx context.Context, repo *repo_model.Repository, private b
 				return fmt.Errorf("getRepositoriesByForkID: %w", err)
 			}
 			for _, forkRepo := range forkRepos {
-				if err = MakeRepoPrivate(ctx, forkRepo, private); err != nil {
-					return fmt.Errorf("MakeRepoPrivate[%d]: %w", forkRepo.ID, err)
+				if err = setRepoVisibility(ctx, forkRepo, private); err != nil {
+					return fmt.Errorf("setRepoVisibility[%d]: %w", forkRepo.ID, err)
 				}
 			}
 		}

services/repository/transfer.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	actions_model "gitea.dev/models/actions"
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/organization"
@@ -22,6 +23,7 @@ import (
 	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/util"
+	"gitea.dev/services/audit"
 	notify_service "gitea.dev/services/notify"
 )
 
@@ -352,7 +354,15 @@ func transferOwnership(ctx context.Context, doer *user_model.User, newOwnerName
 		}
 	}
 
-	return committer.Commit()
+	if err := committer.Commit(); err != nil {
+		return err
+	}
+
+	for _, team := range teams {
+		audit.Record(ctx, audit_model.RepositoryCollaboratorTeamAdd, newRepo, "team", team.Name)
+	}
+
+	return nil
 }
 
 // changeRepositoryName changes all corresponding setting from old repository name to new one.
@@ -417,6 +427,7 @@ func ChangeRepositoryName(ctx context.Context, doer *user_model.User, repo *repo
 	releaser()
 
 	repo.Name = newRepoName
+
 	notify_service.RenameRepository(ctx, doer, repo, oldRepoName)
 
 	return nil
@@ -502,7 +513,7 @@ func StartRepositoryTransfer(ctx context.Context, doer, newOwner *user_model.Use
 // thus cancel the transfer process.
 // The accepter can reject the transfer.
 func RejectRepositoryTransfer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		repoTransfer, err := repo_model.GetPendingRepositoryTransfer(ctx, repo)
 		if err != nil {
 			return err
@@ -525,7 +536,13 @@ func RejectRepositoryTransfer(ctx context.Context, repo *repo_model.Repository,
 		}
 
 		return repo_model.DeleteRepositoryTransfer(ctx, repo.ID)
-	})
+	}); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryTransferCancel, repo)
+
+	return nil
 }
 
 func removeTransferRecipientCollaboration(ctx context.Context, repoTransfer *repo_model.RepoTransfer) error {
@@ -565,7 +582,7 @@ func canUserCancelTransfer(ctx context.Context, r *repo_model.RepoTransfer, u *u
 // CancelRepositoryTransfer cancels the repository transfer process. The sender or
 // the users who have admin permission of the original repository can cancel the transfer
 func CancelRepositoryTransfer(ctx context.Context, repoTransfer *repo_model.RepoTransfer, doer *user_model.User) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		if err := repoTransfer.LoadAttributes(ctx); err != nil {
 			return err
 		}
@@ -583,5 +600,11 @@ func CancelRepositoryTransfer(ctx context.Context, repoTransfer *repo_model.Repo
 		}
 
 		return repo_model.DeleteRepositoryTransfer(ctx, repoTransfer.RepoID)
-	})
+	}); err != nil {
+		return err
+	}
+
+	audit.Record(ctx, audit_model.RepositoryTransferCancel, repoTransfer.Repo)
+
+	return nil
 }