feat: log changes made regarding app passwords and unified sharing

apps/admin_audit/lib/Operation.php

@@ -36,6 +36,22 @@ enum Operation: string {
 	case ShareExpirationRemoved = 'sharing.share.expiration_removed';
 	case ShareLinkAccessed = 'sharing.share.link_accessed';
 
+	// Unified sharing API
+	// TODO: Merge with the legacy sharing.share.* operations above once the legacy sharing API is removed
+	case UnifiedShareCreated = 'unified_sharing.share.created';
+	case UnifiedShareDeleted = 'unified_sharing.share.deleted';
+	case UnifiedShareStateUpdated = 'unified_sharing.share.state_updated';
+	case UnifiedShareUserStatusUpdated = 'unified_sharing.share.user_status_updated';
+	case UnifiedShareSourceAdded = 'unified_sharing.source.added';
+	case UnifiedShareSourceRemoved = 'unified_sharing.source.removed';
+	case UnifiedShareRecipientAdded = 'unified_sharing.recipient.added';
+	case UnifiedShareRecipientRemoved = 'unified_sharing.recipient.removed';
+	case UnifiedShareRecipientSecretUpdated = 'unified_sharing.recipient_secret.updated';
+	case UnifiedSharePropertyUpdated = 'unified_sharing.property.updated';
+	case UnifiedSharePermissionUpdated = 'unified_sharing.permission.updated';
+	case UnifiedShareRecipientPermissionUpdated = 'unified_sharing.recipient_permission.updated';
+	case UnifiedSharePermissionPresetSelected = 'unified_sharing.permission_preset.selected';
+
 	// Trash bin and versions
 	case TrashbinFileDeleted = 'trashbin.file.deleted';
 	case TrashbinFileRestored = 'trashbin.file.restored';
@@ -49,6 +65,8 @@ enum Operation: string {
 	case LogoutPerformed = 'auth.logout.performed';
 	case TwoFactorPassed = 'auth.twofactor.passed';
 	case TwoFactorFailed = 'auth.twofactor.failed';
+	case PasswordResetRequested = 'auth.password_reset.requested';
+	case RemoteWipeFinished = 'auth.remote_wipe.finished';
 
 	// Users
 	case UserCreated = 'users.user.created';

core/Controller/AppPasswordController.php

@@ -33,6 +33,7 @@
 use OCP\IRequest;
 use OCP\ISession;
 use OCP\IUserManager;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 use OCP\Security\Bruteforce\IThrottler;
 use OCP\Security\ISecureRandom;
 
@@ -104,6 +105,12 @@ public function getAppPassword(): DataResponse {
 		$this->eventDispatcher->dispatchTyped(
 			new AppPasswordCreatedEvent($generatedToken)
 		);
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'App password with ID "%s" and name "%s" was created',
+			['tokenId' => $generatedToken->getId(), 'tokenName' => $generatedToken->getName()],
+			false,
+			'auth.app_password.created',
+		));
 
 		return new DataResponse([
 			'apppassword' => $token
@@ -134,6 +141,12 @@ public function deleteAppPassword(): DataResponse {
 		}
 
 		$this->tokenProvider->invalidateTokenById($token->getUID(), $token->getId());
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'App password with ID "%s" was deleted',
+			['tokenId' => $token->getId()],
+			false,
+			'auth.app_password.deleted',
+		));
 		return new DataResponse();
 	}
 
@@ -242,6 +255,12 @@ public function getAppPasswordWithOneTimePassword(): DataResponse {
 		$this->eventDispatcher->dispatchTyped(
 			new AppPasswordCreatedEvent($generatedToken)
 		);
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'App password with ID "%s" and name "%s" was created',
+			['tokenId' => $generatedToken->getId(), 'tokenName' => $generatedToken->getName()],
+			false,
+			'auth.app_password.created',
+		));
 
 		return new DataResponse([
 			'apppassword' => $token

core/Controller/ClientFlowLoginController.php

@@ -39,6 +39,7 @@
 use OCP\ISession;
 use OCP\IURLGenerator;
 use OCP\IUserSession;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 use OCP\Security\ICrypto;
 use OCP\Security\ISecureRandom;
 use OCP\Session\Exceptions\SessionNotAvailableException;
@@ -337,6 +338,12 @@ public function generateAppPassword(
 		$this->eventDispatcher->dispatchTyped(
 			new AppPasswordCreatedEvent($generatedToken)
 		);
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'App password with ID "%s" and name "%s" was created',
+			['tokenId' => $generatedToken->getId(), 'tokenName' => $generatedToken->getName()],
+			false,
+			'auth.app_password.created',
+		));
 
 		return new RedirectResponse($redirectUri);
 	}

core/Controller/LostController.php

@@ -37,6 +37,7 @@
 use OCP\IURLGenerator;
 use OCP\IUser;
 use OCP\IUserManager;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 use OCP\Mail\IMailer;
 use OCP\PreConditionNotMetException;
 use OCP\Security\VerificationToken\InvalidTokenException;
@@ -283,6 +284,13 @@ protected function sendEmail(string $input): void {
 			// Log the exception and continue
 			$this->logger->error($e->getMessage(), ['app' => 'core', 'exception' => $e]);
 		}
+
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'Password reset was requested for user "%s"',
+			['userId' => $user->getUID()],
+			false,
+			'auth.password_reset.requested',
+		));
 	}
 
 	/**

core/Service/LoginFlowV2Service.php

@@ -21,7 +21,9 @@
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IConfig;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 use OCP\Security\ICrypto;
 use OCP\Security\ISecureRandom;
 use Psr\Log\LoggerInterface;
@@ -35,6 +37,7 @@ public function __construct(
 		private ICrypto $crypto,
 		private LoggerInterface $logger,
 		private IProvider $tokenProvider,
+		private IEventDispatcher $eventDispatcher,
 	) {
 	}
 
@@ -153,7 +156,7 @@ public function flowDone(string $loginToken, string $sessionId, string $server,
 		}
 
 		$appPassword = $this->random->generate(72, ISecureRandom::CHAR_UPPER . ISecureRandom::CHAR_LOWER . ISecureRandom::CHAR_DIGITS);
-		$this->tokenProvider->generateToken(
+		$generatedToken = $this->tokenProvider->generateToken(
 			$appPassword,
 			$userId,
 			$loginName,
@@ -162,6 +165,12 @@ public function flowDone(string $loginToken, string $sessionId, string $server,
 			IToken::PERMANENT_TOKEN,
 			IToken::DO_NOT_REMEMBER
 		);
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'App password with ID "%s" and name "%s" was created',
+			['tokenId' => $generatedToken->getId(), 'tokenName' => $generatedToken->getName()],
+			false,
+			'auth.app_password.created',
+		));
 
 		$data->setLoginName($loginName);
 		$data->setServer($server);

lib/private/Authentication/Token/RemoteWipe.php

@@ -15,6 +15,7 @@
 use OCP\Authentication\Exceptions\WipeTokenException;
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IUser;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 use Psr\Log\LoggerInterface;
 use function array_filter;
 
@@ -119,6 +120,12 @@ public function finish(string $token): bool {
 
 		$this->logger->info('user ' . $dbToken->getUID() . ' finished a remote wipe');
 		$this->eventDispatcher->dispatch(RemoteWipeFinished::class, new RemoteWipeFinished($dbToken));
+		$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+			'Remote wipe of app password with ID "%s" of user "%s" was finished',
+			['tokenId' => $dbToken->getId(), 'userId' => $dbToken->getUID()],
+			false,
+			'auth.remote_wipe.finished',
+		));
 
 		return true;
 	}

lib/private/Security/Bruteforce/Throttler.php

@@ -65,6 +65,8 @@ public function registerAttempt(string $action,
 				new CriticalActionPerformedEvent(
 					'Bruteforce attempt from "{ip}" detected for action "{action}" not throttled due to allow-list.',
 					['ip' => $ip, 'action' => $action],
+					false,
+					'auth.bruteforce.bypassed',
 				)
 			);
 			return;