feat: expand audit logging

lib/AuditLog/Operation.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Tables\AuditLog;
+
+/**
+ * Operations Tables writes to the admin audit log, in the form `app.entity.action`
+ *
+ * The values are matched by log consumers (filters, alert rules, SIEM imports),
+ * so changing one is a breaking change for them. Case names may be renamed.
+ */
+enum Operation: string {
+	case TableCreated = 'tables.table.created';
+	case TableArchived = 'tables.table.archived';
+	case TableUnarchived = 'tables.table.unarchived';
+	case TableDeleted = 'tables.table.deleted';
+	case TableTransferred = 'tables.table.transferred';
+	case ViewCreated = 'tables.view.created';
+	case ViewUpdated = 'tables.view.updated';
+	case ViewDeleted = 'tables.view.deleted';
+	case RowDeleted = 'tables.row.deleted';
+	case ColumnDeleted = 'tables.column.deleted';
+	case ImportCompleted = 'tables.import.completed';
+	case ContextCreated = 'tables.context.created';
+	case ContextUpdated = 'tables.context.updated';
+	case ContextDeleted = 'tables.context.deleted';
+	case ContextTransferred = 'tables.context.transferred';
+	case ShareCreated = 'tables.share.created';
+	case SharePermissionsUpdated = 'tables.share.permissions_updated';
+	case ShareDeleted = 'tables.share.deleted';
+	case FederatedShareReceived = 'tables.federated_share.received';
+	case FederatedSharePermissionsUpdated = 'tables.federated_share.permissions_updated';
+	case LinkShareAuthenticationFailed = 'tables.link_share.authentication_failed';
+
+	/**
+	 * Short description of when the operation is logged, used for the documentation
+	 */
+	public function description(): string {
+		return match ($this) {
+			self::TableCreated => 'A table was created, from the web interface, the API, occ tables:add or a template',
+			self::TableArchived => 'A table was archived for all users it is shared with',
+			self::TableUnarchived => 'A table was unarchived',
+			self::TableDeleted => 'A table was deleted with its views, rows and shares',
+			self::TableTransferred => 'The ownership of a table was transferred to another user',
+			self::ViewCreated => 'A view was created on a table',
+			self::ViewUpdated => 'The filter, columns or settings of a view were changed, which changes the data people the view is shared with can see',
+			self::ViewDeleted => 'A view was deleted with its shares',
+			self::RowDeleted => 'A row was deleted',
+			self::ColumnDeleted => 'A column was deleted with its values in all rows',
+			self::ImportCompleted => 'Rows were imported into a table or view from a spreadsheet, possibly creating columns',
+			self::ContextCreated => 'An application was created',
+			self::ContextUpdated => 'An application was changed, including tables and views added to or removed from it and changes to their permissions in it, which exposes them to the people the application is shared with',
+			self::ContextDeleted => 'An application was deleted with its pages and shares',
+			self::ContextTransferred => 'The ownership of an application was transferred to another user',
+			self::ShareCreated => 'A table, view or application was shared with a user, group, team, remote user or by public link',
+			self::SharePermissionsUpdated => 'The permissions of a share of a table or view were changed',
+			self::ShareDeleted => 'A share was deleted, by someone managing the shared node or through the share review',
+			self::FederatedShareReceived => 'A table or view was shared with a local user from another server',
+			self::FederatedSharePermissionsUpdated => 'The server a table or view was shared from changed the permissions of the share with a local user',
+			self::LinkShareAuthenticationFailed => 'A wrong password was entered for a password protected public link share',
+		};
+	}
+}

lib/Controller/PublicSharePageController.php

@@ -9,10 +9,12 @@
 namespace OCA\Tables\Controller;
 
 use OCA\Tables\AppInfo\Application;
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Db\Share;
 use OCA\Tables\Errors\NotFoundError;
 use OCA\Tables\Service\NodeService;
 use OCA\Tables\Service\ShareService;
+use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCA\Tables\Service\ValueObject\ShareToken;
 use OCA\Tables\Share\SharePageShareDataDecorator;
 use OCA\Text\Event\LoadEditor;
@@ -44,6 +46,7 @@ public function __construct(
 		private readonly NodeService $nodeService,
 		private readonly IInitialState $initialState,
 		private readonly IEventDispatcher $eventDispatcher,
+		private readonly AuditLogServiceInterface $auditLogService,
 	) {
 		parent::__construct($appName, $request, $session, $urlGenerator);
 		$token = $request->getParam('token');
@@ -103,6 +106,18 @@ public function showAuthenticate(): TemplateResponse {
 		return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
 	}
 
+	protected function authFailed(): void {
+		if ($this->share === null) {
+			return;
+		}
+
+		$this->auditLogService->log(Operation::LinkShareAuthenticationFailed, 'Wrong password entered for link share %s of %s %s', [
+			'shareId' => $this->share->getId(),
+			'nodeType' => $this->share->getNodeType(),
+			'nodeId' => $this->share->getNodeId(),
+		]);
+	}
+
 	protected function showAuthFailed(): TemplateResponse {
 		$templateParameters = ['share' => new SharePageShareDataDecorator($this->share), 'wrongpw' => true];
 		return new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');

lib/Federation/FederationProvider.php

@@ -9,6 +9,7 @@
 
 namespace OCA\Tables\Federation;
 
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Constants\ShareReceiverType;
 use OCA\Tables\Constants\ViewLayout;
 use OCA\Tables\Db\Share;
@@ -20,6 +21,7 @@
 use OCA\Tables\Errors\FederationDisabledError;
 use OCA\Tables\Errors\InternalError;
 use OCA\Tables\Service\FederationService;
+use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCA\Tables\Service\ValueObject\ShareToken;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\Federation\Exceptions\BadRequestException;
@@ -42,6 +44,7 @@ public function __construct(
 		private readonly ShareMapper $shareMapper,
 		private readonly ICloudIdManager $cloudIdManager,
 		private readonly FederationService $federationService,
+		private readonly AuditLogServiceInterface $auditLogService,
 	) {
 	}
 
@@ -89,10 +92,17 @@ public function shareReceived(ICloudFederationShare $share): string {
 		$localShare = $this->buildShareForFederationNode($share, $nodeId, $nodeType, $localUser);
 
 		try {
-			$this->shareMapper->insert($localShare);
+			$localShare = $this->shareMapper->insert($localShare);
 		} catch (\Exception $e) {
 			throw new ProviderCouldNotAddShareException('Could not create share for federated share: ' . $e->getMessage());
 		}
+		$this->auditLogService->log(Operation::FederatedShareReceived, 'Federated share %s of %s %s from "%s" was received for user "%s"', [
+			'shareId' => $localShare->getId(),
+			'nodeType' => $nodeType,
+			'nodeId' => $nodeId,
+			'sharedBy' => $share->getSharedBy(),
+			'receiver' => $localUser,
+		]);
 
 		return (string)$nodeId;
 	}
@@ -202,6 +212,18 @@ private function handlePermissionUpdate(array $notification): void {
 		$share->setPermissionUpdate($notification['permissionUpdate']);
 		$share->setPermissionDelete($notification['permissionDelete']);
 		$this->shareMapper->update($share);
+		$this->auditLogService->log(Operation::FederatedSharePermissionsUpdated, 'Permissions of federated share %s of %s %s for "%s" were changed by the sharing server', [
+			'shareId' => $share->getId(),
+			'nodeType' => $share->getNodeType(),
+			'nodeId' => $share->getNodeId(),
+			'receiver' => $share->getReceiver(),
+			'permissions' => [
+				'read' => $share->getPermissionRead(),
+				'create' => $share->getPermissionCreate(),
+				'update' => $share->getPermissionUpdate(),
+				'delete' => $share->getPermissionDelete(),
+			],
+		]);
 	}
 
 	private function handleNodeDelete(string $providerId, array $notification): void {

lib/Listener/WhenRowDeletedAuditLogListener.php

@@ -8,6 +8,7 @@
 
 namespace OCA\Tables\Listener;
 
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Event\RowDeletedEvent;
 use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCP\EventDispatcher\Event;
@@ -28,10 +29,10 @@ public function handle(Event $event): void {
 		}
 
 		$row = $event->getRow();
-		$rowId = $row->rowId;
 
-		$this->auditLogService->log("Row with ID: $rowId was deleted", [
-			'row' => $row->jsonSerialize(),
+		$this->auditLogService->log(Operation::RowDeleted, 'Row with ID: %s was deleted', [
+			'rowId' => $row->rowId,
+			'tableId' => $row->tableId,
 		]);
 	}
 }

lib/Listener/WhenTableDeletedAuditLogListener.php

@@ -8,6 +8,7 @@
 
 namespace OCA\Tables\Listener;
 
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Event\TableDeletedEvent;
 use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCP\EventDispatcher\Event;
@@ -29,8 +30,9 @@ public function handle(Event $event): void {
 
 		$table = $event->getTable();
 
-		$this->auditLogService->log("Table with ID: $table->id was deleted", [
-			'table' => $table->jsonSerialize(),
+		$this->auditLogService->log(Operation::TableDeleted, 'Table with ID: %s was deleted', [
+			'tableId' => $table->getId(),
+			'owner' => $table->getOwnership(),
 		]);
 	}
 }

lib/Listener/WhenTableTransferredAuditLogListener.php

@@ -8,6 +8,7 @@
 
 namespace OCA\Tables\Listener;
 
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Event\TableOwnershipTransferredEvent;
 use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCP\EventDispatcher\Event;
@@ -27,14 +28,10 @@ public function handle(Event $event): void {
 			return;
 		}
 
-		$table = $event->getTable();
-		$fromUserId = $event->getFromUserId();
-		$toUserId = $event->getToUserId();
-
-		$this->auditLogService->log("Table with ID: $table->id was transferred from user with ID: $fromUserId to user with ID: $toUserId", [
-			'table' => $table->jsonSerialize(),
-			'fromUserId' => $fromUserId,
-			'toUserId' => $toUserId,
+		$this->auditLogService->log(Operation::TableTransferred, 'Table with ID: %s was transferred from user with ID: %s to user with ID: %s', [
+			'tableId' => $event->getTable()->getId(),
+			'fromUserId' => $event->getFromUserId(),
+			'toUserId' => $event->getToUserId(),
 		]);
 	}
 }

lib/Listener/WhenViewDeletedAuditLogListener.php

@@ -8,6 +8,7 @@
 
 namespace OCA\Tables\Listener;
 
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Event\ViewDeletedEvent;
 use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCP\EventDispatcher\Event;
@@ -29,8 +30,9 @@ public function handle(Event $event): void {
 
 		$view = $event->getView();
 
-		$this->auditLogService->log("View with ID: $view->id was deleted", [
-			'view' => $view->jsonSerialize(),
+		$this->auditLogService->log(Operation::ViewDeleted, 'View with ID: %s was deleted', [
+			'viewId' => $view->getId(),
+			'tableId' => $view->getTableId(),
 		]);
 	}
 }

lib/Service/ColumnService.php

@@ -10,6 +10,7 @@
 use DateTime;
 use Exception;
 use OCA\Tables\Activity\ActivityManager;
+use OCA\Tables\AuditLog\Operation;
 use OCA\Tables\Constants\ColumnType;
 use OCA\Tables\Db\Column;
 use OCA\Tables\Db\ColumnMapper;
@@ -25,6 +26,7 @@
 use OCA\Tables\Model\SelectionOptions;
 use OCA\Tables\Notification\NotificationHelper;
 use OCA\Tables\ResponseDefinitions;
+use OCA\Tables\Service\Support\AuditLogServiceInterface;
 use OCA\Tables\Service\ValueObject\Title;
 use OCA\Tables\Service\ValueObject\ViewColumnInformation;
 use OCA\Tables\Validation\ColumnDtoValidator;
@@ -54,6 +56,7 @@ public function __construct(
 		private readonly IL10N $l,
 		private readonly UserHelper $userHelper,
 		private readonly ColumnDtoValidator $columnDtoValidator,
+		private readonly AuditLogServiceInterface $auditLogService,
 	) {
 		parent::__construct($logger, $userId, $permissionsService);
 	}
@@ -614,6 +617,10 @@ public function delete(int $id, bool $skipRowCleanup = false, ?string $userId =
 
 		if (!$skipRowCleanup) {
 			$this->viewService->deleteColumnDataFromViews($id, $table);
+			$this->auditLogService->log(Operation::ColumnDeleted, 'Column with ID: %s of table with ID: %s was deleted', [
+				'columnId' => $id,
+				'tableId' => $item->getTableId(),
+			]);
 		}
 
 		return $this->enhanceColumn($item);