diff --git a/ee/app/controllers/ee/passwords_controller.rb b/ee/app/controllers/ee/passwords_controller.rb index b686286e1178efd3cb9d5a0f031488c52de59911..5c1282a2dc5a507d2485ce671be43e2d1fc88606 100644 --- a/ee/app/controllers/ee/passwords_controller.rb +++ b/ee/app/controllers/ee/passwords_controller.rb @@ -11,16 +11,18 @@ module PasswordsController private def log_audit_event - ::AuditEventService.new( - current_user, - resource, - action: :custom, - custom_message: 'Ask for password reset', + unauth_author = ::Gitlab::Audit::UnauthenticatedAuthor.new + requester = resource || ::User.new(id: unauth_author.id) + + ::Gitlab::Audit::Auditor.audit({ + name: "password_reset_requested", + author: current_user || unauth_author, + scope: requester, + target: requester, + target_details: resource_params[:email], + message: "Ask for password reset", ip_address: request.remote_ip - ).for_user( - full_path: resource_params[:email], - entity_id: nil - ).unauth_security_event + }) end end end diff --git a/ee/config/audit_events/types/password_reset_requested.yml b/ee/config/audit_events/types/password_reset_requested.yml new file mode 100644 index 0000000000000000000000000000000000000000..970a446287e115dbc9b5773bf386245e9eb9a20e --- /dev/null +++ b/ee/config/audit_events/types/password_reset_requested.yml @@ -0,0 +1,10 @@ +--- +name: password_reset_requested +description: Event triggered when a user requests a password reset using a registered + email address +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/374107 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/114548 +feature_category: compliance_management +milestone: '15.11' +saved_to_database: true +streamed: false diff --git a/ee/spec/controllers/passwords_controller_spec.rb b/ee/spec/controllers/passwords_controller_spec.rb index 75ad364e3073af7f7509f0508868adc9ae4df52d..9c4d10497ddca0fdabf0c1c313c5a0c3186f3971 100644 --- a/ee/spec/controllers/passwords_controller_spec.rb +++ b/ee/spec/controllers/passwords_controller_spec.rb @@ -11,8 +11,60 @@ let_it_be(:user) { create(:user) } - subject { post :create, params: { user: { email: user.email } } } + subject(:post_create) { post :create, params: { user: { email: email } } } - it { expect { subject }.to change { AuditEvent.count }.by(1) } + context "when email exists" do + let(:email) { user.email } + + it "generates an audit event" do + expect { post_create }.to change { AuditEvent.count }.by(1) + + expect(AuditEvent.last).to have_attributes({ + attributes: hash_including({ + "entity_id" => user.id, + "entity_type" => "User", + "entity_path" => nil, + "author_name" => "An unauthenticated user", + "target_type" => "User", + "target_details" => user.email, + "target_id" => user.id + }), + details: hash_including({ + custom_message: "Ask for password reset", + author_name: "An unauthenticated user", + target_type: "User", + target_details: user.email + }) + }) + end + end + + context "when email does not exist" do + let(:email) { "#{user.email}.nonexistent" } + + it "generates an audit event" do + nonuser = ::Gitlab::Audit::UnauthenticatedAuthor.new + + expect { post_create }.to change { AuditEvent.count }.by(1) + + expect(AuditEvent.last).to have_attributes({ + attributes: hash_including({ + "entity_id" => nonuser.id, + "entity_type" => "User", + "entity_path" => nil, + "author_name" => "An unauthenticated user", + "target_type" => "User", + "target_details" => email, + "target_id" => nonuser.id + }), + details: hash_including({ + custom_message: "Ask for password reset", + author_name: "An unauthenticated user", + target_type: "User", + target_details: email + }) + }) + end + end end end