audit-logs: added action logs for repository groups.

rhodecode/controllers/admin/repo_groups.py

@@ -34,6 +34,7 b' from pylons.i18n.translation import _, u'
 
 from rhodecode.lib import auth
 from rhodecode.lib import helpers as h
+from rhodecode.lib import audit_logger
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.auth import (
     LoginRequired, NotAnonymous, HasPermissionAll,
@@ -153,9 +154,6 b' class RepoGroupsController(BaseControlle'
 
     @NotAnonymous()
     def index(self):
-        """GET /repo_groups: All items in the collection"""
-        # url('repo_groups')
-
         repo_group_list = RepoGroup.get_all_repo_groups()
         _perms = ['group.admin']
         repo_group_list_acl = RepoGroupList(repo_group_list, perm_set=_perms)
@@ -168,8 +166,6 b' class RepoGroupsController(BaseControlle'
     @NotAnonymous()
     @auth.CSRFRequired()
     def create(self):
-        """POST /repo_groups: Create a new item"""
-        # url('repo_groups')
 
         parent_group_id = safe_int(request.POST.get('group_parent_id'))
         can_create = self._can_create_repo_group(parent_group_id)
@@ -183,20 +179,27 b' class RepoGroupsController(BaseControlle'
         try:
             owner = c.rhodecode_user
             form_result = repo_group_form.to_python(dict(request.POST))
-            RepoGroupModel().create(
+            repo_group = RepoGroupModel().create(
                 group_name=form_result['group_name_full'],
                 group_description=form_result['group_description'],
                 owner=owner.user_id,
                 copy_permissions=form_result['group_copy_permissions']
             )
             Session().commit()
+            repo_group_data = repo_group.get_api_data()
             _new_group_name = form_result['group_name_full']
+
+            audit_logger.store(
+                action='repo_group.create',
+                action_data={'repo_group_data': repo_group_data},
+                user=c.rhodecode_user, commit=True)
+
             repo_group_url = h.link_to(
                 _new_group_name,
                 h.route_path('repo_group_home', repo_group_name=_new_group_name))
             h.flash(h.literal(_('Created repository group %s')
                     % repo_group_url), category='success')
-            # TODO: in future action_logger(, '', '', '', self.sa)
+
         except formencode.Invalid as errors:
             return htmlfill.render(
                 render('admin/repo_groups/repo_group_add.mako'),
@@ -216,8 +219,6 b' class RepoGroupsController(BaseControlle'
     # perm checks inside
     @NotAnonymous()
     def new(self):
-        """GET /repo_groups/new: Form to create a new item"""
-        # url('new_repo_group')
         # perm check for admin, create_group perm or admin of parent_group
         parent_group_id = safe_int(request.GET.get('parent_group'))
         if not self._can_create_repo_group(parent_group_id):
@@ -229,11 +230,6 b' class RepoGroupsController(BaseControlle'
     @HasRepoGroupPermissionAnyDecorator('group.admin')
     @auth.CSRFRequired()
     def update(self, group_name):
-        """PUT /repo_groups/group_name: Update an existing item"""
-        # Forms posted to this method should contain a hidden field:
-        #    <input type="hidden" name="_method" value="PUT" />
-        # Or using helpers:
-        #    h.form(url('repos_group', group_name=GROUP_NAME), method='put')
 
         c.repo_group = RepoGroupModel()._get_repo_group(group_name)
         can_create_in_root = self._can_create_repo_group()
@@ -249,16 +245,21 b' class RepoGroupsController(BaseControlle'
             available_groups=c.repo_groups_choices,
             can_create_in_root=can_create_in_root, allow_disabled=True)()
 
+        old_values = c.repo_group.get_api_data()
         try:
             form_result = repo_group_form.to_python(dict(request.POST))
             gr_name = form_result['group_name']
             new_gr = RepoGroupModel().update(group_name, form_result)
+
+            audit_logger.store(
+                'repo_group.edit', action_data={'old_data': old_values},
+                user=c.rhodecode_user)
+
             Session().commit()
             h.flash(_('Updated repository group %s') % (gr_name,),
                     category='success')
             # we now have new name !
             group_name = new_gr.group_name
-            # TODO: in future action_logger(, '', '', '', self.sa)
         except formencode.Invalid as errors:
             c.active = 'settings'
             return htmlfill.render(
@@ -278,12 +279,6 b' class RepoGroupsController(BaseControlle'
     @HasRepoGroupPermissionAnyDecorator('group.admin')
     @auth.CSRFRequired()
     def delete(self, group_name):
-        """DELETE /repo_groups/group_name: Delete an existing item"""
-        # Forms posted to this method should contain a hidden field:
-        #    <input type="hidden" name="_method" value="DELETE" />
-        # Or using helpers:
-        #    h.form(url('repos_group', group_name=GROUP_NAME), method='delete')
-
         gr = c.repo_group = RepoGroupModel()._get_repo_group(group_name)
         repos = gr.repositories.all()
         if repos:
@@ -305,11 +300,18 b' class RepoGroupsController(BaseControlle'
             return redirect(url('repo_groups'))
 
         try:
+            old_values = gr.get_api_data()
             RepoGroupModel().delete(group_name)
+
+            audit_logger.store(
+                'repo_group.delete',
+                action_data={'old_data': old_values,
+                             'source': audit_logger.SOURCE_WEB},
+                user=c.rhodecode_user)
+
             Session().commit()
             h.flash(_('Removed repository group %s') % group_name,
                     category='success')
-            # TODO: in future action_logger(, '', '', '', self.sa)
         except Exception:
             log.exception("Exception during deletion of repository group")
             h.flash(_('Error occurred during deletion of repository group %s')
@@ -319,8 +321,7 b' class RepoGroupsController(BaseControlle'
 
     @HasRepoGroupPermissionAnyDecorator('group.admin')
     def edit(self, group_name):
-        """GET /repo_groups/group_name/edit: Form to edit an existing item"""
-        # url('edit_repo_group', group_name=GROUP_NAME)
+
         c.active = 'settings'
 
         c.repo_group = RepoGroupModel()._get_repo_group(group_name)
@@ -344,8 +345,6 b' class RepoGroupsController(BaseControlle'
 
     @HasRepoGroupPermissionAnyDecorator('group.admin')
     def edit_repo_group_advanced(self, group_name):
-        """GET /repo_groups/group_name/edit: Form to edit an existing item"""
-        # url('edit_repo_group', group_name=GROUP_NAME)
         c.active = 'advanced'
         c.repo_group = RepoGroupModel()._get_repo_group(group_name)
 
@@ -353,8 +352,6 b' class RepoGroupsController(BaseControlle'
 
     @HasRepoGroupPermissionAnyDecorator('group.admin')
     def edit_repo_group_perms(self, group_name):
-        """GET /repo_groups/group_name/edit: Form to edit an existing item"""
-        # url('edit_repo_group', group_name=GROUP_NAME)
         c.active = 'perms'
         c.repo_group = RepoGroupModel()._get_repo_group(group_name)
         self.__load_defaults()
@@ -372,8 +369,6 b' class RepoGroupsController(BaseControlle'
     def update_perms(self, group_name):
         """
         Update permissions for given repository group
-
-        :param group_name:
         """
 
         c.repo_group = RepoGroupModel()._get_repo_group(group_name)
@@ -391,14 +386,21 b' class RepoGroupsController(BaseControlle'
         # iterate over all members(if in recursive mode) of this groups and
         # set the permissions !
         # this can be potentially heavy operation
-        RepoGroupModel().update_permissions(
+        changes = RepoGroupModel().update_permissions(
             c.repo_group,
-            form['perm_additions'], form['perm_updates'],
-            form['perm_deletions'], form['recursive'])
+            form['perm_additions'], form['perm_updates'], form['perm_deletions'],
+            form['recursive'])
 
-        # TODO: implement this
-        # action_logger(c.rhodecode_user, 'admin_changed_repo_permissions',
-        #               repo_name, self.ip_addr, self.sa)
+        action_data = {
+            'added': changes['added'],
+            'updated': changes['updated'],
+            'deleted': changes['deleted'],
+            'source': audit_logger.SOURCE_WEB
+        }
+        audit_logger.store(
+            'repo_group.edit.permissions', action_data=action_data,
+            user=c.rhodecode_user)
+
         Session().commit()
         h.flash(_('Repository Group permissions updated'), category='success')
         return redirect(url('edit_repo_group_perms', group_name=group_name))

rhodecode/lib/audit_logger.py

@@ -42,6 +42,11 b' ACTIONS = {'
     'repo.delete': {},
     'repo.commit.strip': {},
     'repo.archive.download': {},
+
+    'repo_group.create': {},
+    'repo_group.edit': {},
+    'repo_group.edit.permissions': {},
+    'repo_group.delete': {},
 }
 
 SOURCE_WEB = 'source_web'

rhodecode/model/repo_group.py

@@ -340,6 +340,12 b' class RepoGroupModel(BaseModel):'
 
         req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
 
+        changes = {
+            'added': [],
+            'updated': [],
+            'deleted': []
+        }
+
         def _set_perm_user(obj, user, perm):
             if isinstance(obj, RepoGroup):
                 self.grant_user_permission(
@@ -382,7 +388,6 b' class RepoGroupModel(BaseModel):'
                     repo=obj, group_name=user_group)
 
         # start updates
-        updates = []
         log.debug('Now updating permissions for %s in recursive mode:%s',
                   repo_group, recursive)
 
@@ -408,10 +413,13 b' class RepoGroupModel(BaseModel):'
                 # in recursive mode
                 obj = repo_group
 
+            change_obj = obj.get_api_data()
+
             # update permissions
             for member_id, perm, member_type in perm_updates:
                 member_id = int(member_id)
                 if member_type == 'user':
+                    member_name = User.get(member_id).username
                     # this updates also current one if found
                     _set_perm_user(obj, user=member_id, perm=perm)
                 else:  # set for user group
@@ -420,10 +428,15 b' class RepoGroupModel(BaseModel):'
                                                          user=cur_user):
                         _set_perm_group(obj, users_group=member_id, perm=perm)
 
+                changes['updated'].append(
+                    {'change_obj': change_obj, 'type': member_type,
+                     'id': member_id, 'name': member_name, 'new_perm': perm})
+
             # set new permissions
             for member_id, perm, member_type in perm_additions:
                 member_id = int(member_id)
                 if member_type == 'user':
+                    member_name = User.get(member_id).username
                     _set_perm_user(obj, user=member_id, perm=perm)
                 else:  # set for user group
                     # check if we have permissions to alter this usergroup
@@ -432,10 +445,15 b' class RepoGroupModel(BaseModel):'
                                                          user=cur_user):
                         _set_perm_group(obj, users_group=member_id, perm=perm)
 
+                changes['added'].append(
+                    {'change_obj': change_obj, 'type': member_type,
+                     'id': member_id, 'name': member_name, 'new_perm': perm})
+
             # delete permissions
             for member_id, perm, member_type in perm_deletions:
                 member_id = int(member_id)
                 if member_type == 'user':
+                    member_name = User.get(member_id).username
                     _revoke_perm_user(obj, user=member_id)
                 else:  # set for user group
                     # check if we have permissions to alter this usergroup
@@ -444,13 +462,16 b' class RepoGroupModel(BaseModel):'
                                                          user=cur_user):
                         _revoke_perm_group(obj, user_group=member_id)
 
-            updates.append(obj)
+                changes['deleted'].append(
+                    {'change_obj': change_obj, 'type': member_type,
+                     'id': member_id, 'name': member_name, 'new_perm': perm})
+
             # if it's not recursive call for all,repos,groups
             # break the loop and don't proceed with other changes
             if recursive not in ['all', 'repos', 'groups']:
                 break
 
-        return updates
+        return changes
 
     def update(self, repo_group, form_data):
         try: