audit-logs: added web strip command to audit logs

rhodecode/apps/repository/views/strip.py

@@ -1,109 +1,117 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2017-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 from pyramid.view import view_config
 
 from rhodecode.apps._base import RepoAppView
+from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (LoginRequired, HasRepoPermissionAnyDecorator,
     NotAnonymous)
 from rhodecode.lib.ext_json import json
 
 log = logging.getLogger(__name__)
 
 
 class StripView(RepoAppView):
     def load_default_context(self):
         c = self._get_local_tmpl_context()
 
         # TODO(marcink): remove repo_info and use c.rhodecode_db_repo instead
         c.repo_info = self.db_repo
 
         self._register_global_c(c)
         return c
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @view_config(
         route_name='strip', request_method='GET',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def strip(self):
         c = self.load_default_context()
         c.active = 'strip'
         c.strip_limit = 10
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @view_config(
         route_name='strip_check', request_method='POST',
         renderer='json', xhr=True)
     def strip_check(self):
         from rhodecode.lib.vcs.backends.base import EmptyCommit
         data = {}
         rp = self.request.POST
         for i in range(1, 11):
             chset = 'changeset_id-%d' % (i,)
             check = rp.get(chset)
             if check:
                 data[i] = self.db_repo.get_changeset(rp[chset])
                 if isinstance(data[i], EmptyCommit):
                     data[i] = {'rev': None, 'commit': rp[chset]}
                 else:
                     data[i] = {'rev': data[i].raw_id, 'branch': data[i].branch,
                                'author': data[i].author,
                                'comment': data[i].message}
             else:
                 break
         return data
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @view_config(
         route_name='strip_execute', request_method='POST',
         renderer='json', xhr=True)
     def strip_execute(self):
         from rhodecode.model.scm import ScmModel
 
         c = self.load_default_context()
         user = self._rhodecode_user
         rp = self.request.POST
         data = {}
         for idx in rp:
             commit = json.loads(rp[idx])
             # If someone put two times the same branch
             if commit['branch'] in data.keys():
                 continue
             try:
                 ScmModel().strip(
                     repo=c.repo_info,
                     commit_id=commit['rev'], branch=commit['branch'])
                 log.info('Stripped commit %s from repo `%s` by %s' % (
                     commit['rev'], c.repo_info.repo_name, user))
                 data[commit['rev']] = True
+
+                audit_logger.store(
+                    action='repo.commit.strip',
+                    action_data={'commit_id': commit['rev']},
+                    repo=self.db_repo,
+                    user=self._rhodecode_user, commit=True)
+
             except Exception as e:
                 data[commit['rev']] = False
                 log.debug('Stripped commit %s from repo `%s` failed by %s, exeption %s' % (
                     commit['rev'], self.db_repo_name, user, e.message))
         return data

rhodecode/lib/audit_logger.py

@@ -1,143 +1,144 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2017-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import datetime
 
 from rhodecode.model import meta
 from rhodecode.model.db import User, UserLog
 
 
 log = logging.getLogger(__name__)
 
 
 ACTIONS = {
     'user.login.success': {},
     'user.login.failure': {},
     'user.logout': {},
     'user.password.reset_request': {},
 
     'repo.add': {},
     'repo.edit': {},
+    'repo.commit.strip': {}
 }
 
 
 class UserWrap(object):
     """
     Fake object used to imitate AuthUser
     """
 
     def __init__(self, user_id=None, username=None, ip_addr=None):
         self.user_id = user_id
         self.username = username
         self.ip_addr = ip_addr
 
 
 def _store_log(action_name, action_data, user_id, username, user_data,
                ip_address, repository_id, repository_name):
     user_log = UserLog()
     user_log.version = UserLog.VERSION_2
 
     user_log.action = action_name
     user_log.action_data = action_data
 
     user_log.user_ip = ip_address
 
     user_log.user_id = user_id
     user_log.username = username
     user_log.user_data = user_data
 
     user_log.repository_id = repository_id
     user_log.repository_name = repository_name
 
     user_log.action_date = datetime.datetime.now()
 
     log.info('AUDIT: Logging action: `%s` by user:id:%s[%s] ip:%s',
              action_name, user_id, username, ip_address)
 
     return user_log
 
 
 def store(
         action, user, action_data=None, user_data=None, ip_addr=None,
         repo=None, sa_session=None, commit=False):
     """
     Audit logger for various actions made by users, typically this results in a call such::
 
         from rhodecode.lib import audit_logger
 
         audit_logger.store(action='repo.edit', user=self._rhodecode_user)
         audit_logger.store(action='repo.delete', user=audit_logger.UserWrap(username='itried-to-login', ip_addr='8.8.8.8'))
 
         # without an user ?
         audit_user = audit_logger.UserWrap(
             username=self.request.params.get('username'),
             ip_addr=self.request.remote_addr)
         audit_logger.store(action='user.login.failure', user=audit_user)
     """
     from rhodecode.lib.utils2 import safe_unicode
     from rhodecode.lib.auth import AuthUser
 
     if action not in ACTIONS:
         raise ValueError('Action `{}` not in valid actions'.format(action))
 
     if not sa_session:
         sa_session = meta.Session()
 
     try:
         username = getattr(user, 'username', None)
         if not username:
             pass
 
         user_id = getattr(user, 'user_id', None)
         if not user_id:
             # maybe we have username ? Try to figure user_id from username
             if username:
                 user_id = getattr(
                     User.get_by_username(username), 'user_id', None)
 
         ip_addr = ip_addr or getattr(user, 'ip_addr', None)
         if not ip_addr:
             pass
 
         if not user_data:
             # try to get this from the auth user
             if isinstance(user, AuthUser):
                 user_data = {}
 
         repository_id = getattr(repo, 'repo_id', None)
         repository_name = getattr(repo, 'repo_name', None)
 
         user_log = _store_log(
             action_name=safe_unicode(action),
             action_data=action_data or {},
             user_id=user_id,
             username=username,
             user_data=user_data or {},
             ip_address=safe_unicode(ip_addr),
             repository_id=repository_id,
             repository_name=repository_name
         )
         sa_session.add(user_log)
         if commit:
             sa_session.commit()
 
     except Exception:
         log.exception('AUDIT: failed to store audit log')