feat: add activity logs on user actions with authentication, resource… (#6748)

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* fix: add unit tests to info package for context changes

* fix: add activity_interceptor.go suggestion

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* fix: refactoring and fixes through PR review

* fix: add auth service to lists of resourceAPIs

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Co-authored-by: Fabi <fabienne@zitadel.com>

internal/activity/activity.go

@@ -0,0 +1,73 @@
+package activity
+
+import (
+	"context"
+
+	"github.com/zitadel/logging"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
+	"github.com/zitadel/zitadel/internal/api/info"
+)
+
+const (
+	Activity = "activity"
+)
+
+type TriggerMethod int
+
+const (
+	Unspecified TriggerMethod = iota
+	ResourceAPI
+	OIDCAccessToken
+	OIDCRefreshToken
+	SessionAPI
+	SAMLResponse
+)
+
+func (t TriggerMethod) String() string {
+	switch t {
+	case Unspecified:
+		return "unspecified"
+	case ResourceAPI:
+		return "resourceAPI"
+	case OIDCRefreshToken:
+		return "refreshToken"
+	case OIDCAccessToken:
+		return "accessToken"
+	case SessionAPI:
+		return "sessionAPI"
+	case SAMLResponse:
+		return "samlResponse"
+	default:
+		return "unknown"
+	}
+}
+
+func Trigger(ctx context.Context, orgID, userID string, trigger TriggerMethod) {
+	triggerLog(authz.GetInstance(ctx).InstanceID(), orgID, userID, http_utils.ComposedOrigin(ctx), trigger, info.ActivityInfoFromContext(ctx))
+}
+
+func TriggerWithContext(ctx context.Context, trigger TriggerMethod) {
+	data := authz.GetCtxData(ctx)
+	ai := info.ActivityInfoFromContext(ctx)
+	// if GRPC call, path is prefilled with the grpc fullmethod and method is empty
+	if ai.Method == "" {
+		ai.Method = ai.Path
+		ai.Path = ""
+	}
+	triggerLog(authz.GetInstance(ctx).InstanceID(), data.OrgID, data.UserID, http_utils.ComposedOrigin(ctx), trigger, ai)
+}
+
+func triggerLog(instanceID, orgID, userID, domain string, trigger TriggerMethod, ai *info.ActivityInfo) {
+	logging.WithFields(
+		"instance", instanceID,
+		"org", orgID,
+		"user", userID,
+		"domain", domain,
+		"trigger", trigger.String(),
+		"method", ai.Method,
+		"path", ai.Path,
+		"requestMethod", ai.RequestMethod,
+	).Info(Activity)
+}