From 6bcb1a033fbb8d0d64ec040f2f21b78e7dd22ec6 Mon Sep 17 00:00:00 2001
From: Marin Jankovski <maxlazio@gmail.com>
Date: Fri, 21 Nov 2014 16:51:06 +0100
Subject: [PATCH] Add removal and addition of the user to the group membership
 to audit events.

---
 .../groups/group_members_controller.rb        | 30 +++++++++++++++++--
 .../projects/team_members_controller.rb       |  5 ++--
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/app/controllers/groups/group_members_controller.rb b/app/controllers/groups/group_members_controller.rb
index 0618d71832..114acca51e 100644
--- a/app/controllers/groups/group_members_controller.rb
+++ b/app/controllers/groups/group_members_controller.rb
@@ -7,7 +7,22 @@ class Groups::GroupMembersController < ApplicationController
   layout 'group'
 
   def create
-    @group.add_users(params[:user_ids].split(','), params[:access_level])
+    access_level = params[:access_level]
+    user_ids = params[:user_ids].split(',')
+
+    @group.add_users(user_ids, access_level)
+
+    users = User.where(id: user_ids).pluck(:id, :name)
+    users.each do |user|
+      details = {
+        add: "user_access",
+        as: Gitlab::Access.options_with_owner.key(access_level.to_i),
+        target_id: user[0],
+        target_type: "User",
+        target_details: user[1],
+      }
+      AuditEventService.new(current_user, @group, details).security_event
+    end
 
     redirect_to members_group_path(@group), notice: 'Users were successfully added.'
   end
@@ -33,7 +48,18 @@ class Groups::GroupMembersController < ApplicationController
     @users_group = @group.group_members.find(params[:id])
 
     if can?(current_user, :destroy, @users_group)  # May fail if last owner.
-      @users_group.destroy
+      user_id = @users_group.id
+      user_name = @users_group.user.name
+      if @users_group.destroy
+        details = {
+          remove: "user_access",
+          target_id: user_id,
+          target_type: "User",
+          target_details: user_name,
+        }
+        AuditEventService.new(current_user, @group, details).security_event
+      end
+
       respond_to do |format|
         format.html { redirect_to members_group_path(@group), notice: 'User was  successfully removed from group.' }
         format.js { render nothing: true }
diff --git a/app/controllers/projects/team_members_controller.rb b/app/controllers/projects/team_members_controller.rb
index b739e36231..ca9649978e 100644
--- a/app/controllers/projects/team_members_controller.rb
+++ b/app/controllers/projects/team_members_controller.rb
@@ -16,12 +16,13 @@ class Projects::TeamMembersController < Projects::ApplicationController
 
   def create
     users = User.where(id: params[:user_ids].split(','))
-
-    @project.team << [users, params[:access_level]]
+    access_level = params[:access_level]
+    @project.team << [users, access_level]
 
     users.each do |user|
       details = {
         add: "user_access",
+        as: Gitlab::Access.options_with_owner.key(access_level.to_i),
         target_id: user.id,
         target_type: "User",
         target_details: user.name,