chore: add audit logs to delegated actions

lib/Controller/AccountsController.php

@@ -182,6 +182,7 @@ public function update(int $id,
 			$result = MailJsonResponse::success(
 				$this->setup->createNewAccount($accountName, $emailAddress, $imapHost, $imapPort, $imapSslMode, $imapUser, $imapPassword, $smtpHost, $smtpPort, $smtpSslMode, $smtpUser, $smtpPassword, $effectiveUserId, $authMethod, $id)
 			);
+			$this->delegationService->logDelegatedAction("$this->currentUserId updated account <$id> on behalf of $effectiveUserId");
 			return $result;
 		} catch (CouldNotConnectException $e) {
 			$data = [
@@ -294,6 +295,7 @@ public function patchAccount(int $id,
 		$result = new JSONResponse(
 			new Account($this->accountService->save($dbAccount))
 		);
+		$this->delegationService->logDelegatedAction("$this->currentUserId patched account <$id> on behalf of $effectiveUserId");
 		return $result;
 	}
 
@@ -312,6 +314,7 @@ public function patchAccount(int $id,
 	public function updateSignature(int $id, ?string $signature = null): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAccountUserId($id, $this->currentUserId);
 		$this->accountService->updateSignature($id, $effectiveUserId, $signature);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated signature for account <$id> on behalf of $effectiveUserId");
 		return new JSONResponse();
 	}
 
@@ -328,6 +331,7 @@ public function updateSignature(int $id, ?string $signature = null): JSONRespons
 	public function destroy(int $id): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAccountUserId($id, $this->currentUserId);
 		$this->accountService->delete($effectiveUserId, $id);
+		$this->delegationService->logDelegatedAction("$this->currentUserId deleted account <$id> on behalf of $effectiveUserId");
 		return new JSONResponse();
 	}
 
@@ -463,6 +467,7 @@ public function draft(int $id,
 				null,
 				[]
 			);
+			$this->delegationService->logDelegatedAction("$this->currentUserId saved draft in account <$id> on behalf of $effectiveUserId");
 			return new JSONResponse([
 				'id' => $this->mailManager->getMessageIdForUid($draftsMailbox, $newUID)
 			]);
@@ -505,6 +510,7 @@ public function updateSmimeCertificate(int $id, ?int $smimeCertificateId = null)
 		$account = $this->accountService->find($effectiveUserId, $id)->getMailAccount();
 		$account->setSmimeCertificateId($smimeCertificateId);
 		$this->accountService->update($account);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated S/MIME certificate for account <$id> on behalf of $effectiveUserId");
 		return MailJsonResponse::success();
 	}
 

lib/Controller/AliasesController.php

@@ -70,15 +70,15 @@ public function update(int $id,
 		string $aliasName,
 		?int $smimeCertificateId = null): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAliasUserId($id, $this->currentUserId);
-		return new JSONResponse(
-			$this->aliasService->update(
-				$effectiveUserId,
-				$id,
-				$alias,
-				$aliasName,
-				$smimeCertificateId,
-			)
+		$alias = $this->aliasService->update(
+			$effectiveUserId,
+			$id,
+			$alias,
+			$aliasName,
+			$smimeCertificateId,
 		);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated alias: $id on behalf of $effectiveUserId");
+		return new JSONResponse($alias);
 	}
 
 	/**
@@ -90,7 +90,9 @@ public function update(int $id,
 	#[TrapError]
 	public function destroy(int $id): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAliasUserId($id, $this->currentUserId);
-		return new JSONResponse($this->aliasService->delete($effectiveUserId, $id));
+		$alias = $this->aliasService->delete($effectiveUserId, $id);
+		$this->delegationService->logDelegatedAction("$this->currentUserId deleted alias: $id on behalf of $effectiveUserId");
+		return new JSONResponse($alias);
 	}
 
 	/**
@@ -106,8 +108,11 @@ public function destroy(int $id): JSONResponse {
 	#[TrapError]
 	public function create(int $accountId, string $alias, string $aliasName): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAccountUserId($accountId, $this->currentUserId);
+		$alias = $this->aliasService->create($effectiveUserId, $accountId, $alias, $aliasName);
+		$id = $alias->getId();
+		$this->delegationService->logDelegatedAction("$this->currentUserId created alias: $id  on behalf of $effectiveUserId");
 		return new JSONResponse(
-			$this->aliasService->create($effectiveUserId, $accountId, $alias, $aliasName),
+			$alias,
 			Http::STATUS_CREATED
 		);
 	}
@@ -124,6 +129,8 @@ public function create(int $accountId, string $alias, string $aliasName): JSONRe
 	#[TrapError]
 	public function updateSignature(int $id, ?string $signature = null): JSONResponse {
 		$effectiveUserId = $this->delegationService->resolveAliasUserId($id, $this->currentUserId);
-		return new JSONResponse($this->aliasService->updateSignature($effectiveUserId, $id, $signature));
+		$alias = $this->aliasService->updateSignature($effectiveUserId, $id, $signature);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated alias: $id 's signature on behalf of $effectiveUserId");
+		return new JSONResponse($alias);
 	}
 }

lib/Controller/DraftsController.php

@@ -125,7 +125,8 @@ public function create(
 		}
 
 		$this->service->saveMessage($account, $message, $to, $cc, $bcc, $attachments);
-
+		$id = $message->getId();
+		$this->delegationService->logDelegatedAction("$this->userId created draft: $id  on behalf of $effectiveUserId");
 		return JsonResponse::success($message, Http::STATUS_CREATED);
 	}
 
@@ -213,6 +214,7 @@ public function destroy(int $id): JsonResponse {
 		$this->accountService->find($effectiveUserId, $message->getAccountId());
 
 		$this->service->deleteMessage($effectiveUserId, $message);
+		$this->delegationService->logDelegatedAction("$this->userId deleted draft: $id  on behalf of $effectiveUserId");
 		return JsonResponse::success('Message deleted', Http::STATUS_ACCEPTED);
 	}
 
@@ -229,6 +231,7 @@ public function move(int $id): JsonResponse {
 		$account = $this->accountService->find($effectiveUserId, $message->getAccountId());
 
 		$this->service->sendMessage($message, $account);
+		$this->delegationService->logDelegatedAction("$this->userId moved draft: $id to the IMAP server on behalf of $effectiveUserId");
 		return  JsonResponse::success(
 			'Message moved to IMAP', Http::STATUS_ACCEPTED
 		);

lib/Controller/FilterController.php

@@ -66,6 +66,7 @@ public function updateFilters(int $accountId, array $filters): JSONResponse {
 		}
 
 		$this->mailFilterService->update($account->getMailAccount(), $filters);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated account: $accountId 's filters  on behalf of $effectiveUserId");
 
 		return new JSONResponse([]);
 	}

lib/Controller/ListController.php

@@ -99,6 +99,7 @@ public function unsubscribe(int $id): JsonResponse {
 		} finally {
 			$client->logout();
 		}
+		$this->delegationService->logDelegatedAction("$this->currentUserId unsubscribed from mailing list: $id on behalf of $effectiveUserId");
 
 		return JsonResponse::success();
 	}

lib/Controller/MailboxesController.php

@@ -126,21 +126,26 @@ public function patch(int $id,
 				$mailbox,
 				$name
 			);
+			$this->delegationService->logDelegatedAction("$this->currentUserId changed mailbox: id 's name to $name  on behalf of $effectiveUserId");
 		}
 		if ($subscribed !== null) {
 			$mailbox = $this->mailManager->updateSubscription(
 				$account,
 				$mailbox,
 				$subscribed
 			);
+			$subscribedVerb = $subscribed ? 'subscribed' : 'unsubscribed';
+			$this->delegationService->logDelegatedAction("$this->currentUserId $subscribedVerb to mailbox: $id on behalf of $effectiveUserId");
+
 		}
 		if ($syncInBackground !== null) {
 			$mailbox = $this->mailManager->enableMailboxBackgroundSync(
 				$mailbox,
 				$syncInBackground
 			);
+			$syncVerb = $syncInBackground ? 'enabled' : 'disabled';
+			$this->delegationService->logDelegatedAction("$this->currentUserId $syncVerb background sync for mailbox: $id on behalf of $effectiveUserId");
 		}
-
 		return new JSONResponse($mailbox);
 	}
 
@@ -251,6 +256,8 @@ public function markAllAsRead(int $id): JSONResponse {
 
 		$this->mailManager->markFolderAsRead($account, $mailbox);
 
+		$this->delegationService->logDelegatedAction("$this->currentUserId marked all messages as read in mailbox: $id on behalf of $effectiveUserId");
+
 		return new JSONResponse([]);
 	}
 
@@ -321,8 +328,11 @@ public function create(int $accountId, string $name): JSONResponse {
 			return new JSONResponse([], Http::STATUS_FORBIDDEN);
 		}
 		$account = $this->accountService->find($effectiveUserId, $accountId);
+		$mailbox = $this->mailManager->createMailbox($account, $name);
+		$id = $mailbox->getId();
+		$this->delegationService->logDelegatedAction("$this->currentUserId created mailbox: $id on behalf of $effectiveUserId");
 
-		return new JSONResponse($this->mailManager->createMailbox($account, $name));
+		return new JSONResponse($mailbox);
 	}
 
 	/**
@@ -349,6 +359,8 @@ public function destroy(int $id): JSONResponse {
 		$account = $this->accountService->find($effectiveUserId, $mailbox->getAccountId());
 
 		$this->mailManager->deleteMailbox($account, $mailbox);
+		$this->delegationService->logDelegatedAction("$this->currentUserId deleted mailbox: $id on behalf of $effectiveUserId");
+
 		return new JSONResponse();
 	}
 
@@ -377,6 +389,7 @@ public function clearMailbox(int $id): JSONResponse {
 		$account = $this->accountService->find($effectiveUserId, $mailbox->getAccountId());
 
 		$this->mailManager->clearMailbox($account, $mailbox);
+		$this->delegationService->logDelegatedAction("$this->currentUserId cleared mailbox: $id on behalf of $effectiveUserId");
 		return new JSONResponse();
 	}
 
@@ -400,6 +413,8 @@ public function repair(int $id): JSONResponse {
 		$account = $this->accountService->find($effectiveUserId, $mailbox->getAccountId());
 
 		$this->syncService->repairSync($account, $mailbox);
+		$this->delegationService->logDelegatedAction("$this->currentUserId repaired mailbox: $id on behalf of $effectiveUserId");
+
 		return new JsonResponse();
 	}
 }

lib/Controller/MessageApiController.php

@@ -206,8 +206,16 @@ public function send(
 			$this->logger->error('SMTP error: could not send message', ['exception' => $e]);
 			return new DataResponse('Fatal SMTP error: could not send message, and no resending is possible. Please check the mail server logs.', Http::STATUS_INTERNAL_SERVER_ERROR);
 		}
-
-		return match ($localMessage->getStatus()) {
+		$status = $localMessage->getStatus();
+		$this->delegationService->logDelegatedAction(match ($status) {
+			LocalMessage::STATUS_PROCESSED => "$this->userId sent a message on behalf of $effectiveUserId",
+			LocalMessage::STATUS_NO_SENT_MAILBOX => "$this->userId attempted sending a message on behalf of $effectiveUserId but no sent mailbox is configured",
+			LocalMessage::STATUS_SMPT_SEND_FAIL => "$this->userId attempted sending a message on behalf of $effectiveUserId but SMTP sending failed",
+			LocalMessage::STATUS_IMAP_SENT_MAILBOX_FAIL => "$this->userId sent a message on behalf of $effectiveUserId but copying to sent mailbox failed",
+			default => "$this->userId attempted sending a message on behalf of $effectiveUserId but an unknown error occurred",
+		});
+
+		return match ($status) {
 			LocalMessage::STATUS_PROCESSED => new DataResponse('', Http::STATUS_OK),
 			LocalMessage::STATUS_NO_SENT_MAILBOX => new DataResponse('Configuration error: Cannot send message without sent mailbox.', Http::STATUS_FORBIDDEN),
 			LocalMessage::STATUS_SMPT_SEND_FAIL => new DataResponse('SMTP error: could not send message. Message sending will be retried. Please check the logs.', Http::STATUS_INTERNAL_SERVER_ERROR),

lib/Controller/MessagesController.php

@@ -427,6 +427,9 @@ public function move(int $id, int $destFolderId): JSONResponse {
 			$dstAccount,
 			$dstMailbox->getName()
 		);
+
+		$this->delegationService->logDelegatedAction("$this->currentUserId moved message <$id> to mailbox <$destFolderId> on behalf of $effectiveUserId");
+
 		return new JSONResponse();
 	}
 
@@ -458,6 +461,7 @@ public function snooze(int $id, int $unixTimestamp, int $destMailboxId): JSONRes
 		}
 
 		$this->snoozeService->snoozeMessage($message, $unixTimestamp, $srcAccount, $srcMailbox, $dstAccount, $dstMailbox);
+		$this->delegationService->logDelegatedAction("$this->currentUserId snoozed message <$id> to <$unixTimestamp> on behalf of $effectiveUserId");
 
 		return new JSONResponse();
 	}
@@ -484,6 +488,7 @@ public function unSnooze(int $id): JSONResponse {
 		}
 
 		$this->snoozeService->unSnoozeMessage($message, $effectiveUserId);
+		$this->delegationService->logDelegatedAction("$this->currentUserId unsnoozed message <$id> on behalf of $effectiveUserId");
 
 		return new JSONResponse();
 	}
@@ -889,10 +894,14 @@ public function setFlags(int $id, array $flags): JSONResponse {
 			return new JSONResponse([], Http::STATUS_FORBIDDEN);
 		}
 
+		$flagChanges = [];
 		foreach ($flags as $flag => $value) {
 			$value = filter_var($value, FILTER_VALIDATE_BOOLEAN);
 			$this->mailManager->flagMessage($account, $mailbox->getName(), $message->getUid(), $flag, $value);
+			$flagChanges[] = "$flag=" . ($value ? 'true' : 'false');
 		}
+		$flagsSummary = implode(', ', $flagChanges);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated flags on message <$id> with [$flagsSummary] on behalf of $effectiveUserId");
 		return new JSONResponse();
 	}
 
@@ -928,6 +937,7 @@ public function setTag(int $id, string $imapLabel): JSONResponse {
 		}
 
 		$this->mailManager->tagMessage($account, $mailbox->getName(), $message, $tag, true);
+		$this->delegationService->logDelegatedAction("$this->currentUserId added tag <$imapLabel> on message <$id> on behalf of $effectiveUserId");
 		return new JSONResponse($tag);
 	}
 
@@ -963,6 +973,7 @@ public function removeTag(int $id, string $imapLabel): JSONResponse {
 		}
 
 		$this->mailManager->tagMessage($account, $mailbox->getName(), $message, $tag, false);
+		$this->delegationService->logDelegatedAction("$this->currentUserId removed tag <$imapLabel> on message <$id> on behalf of $effectiveUserId");
 		return new JSONResponse($tag);
 	}
 
@@ -995,6 +1006,7 @@ public function destroy(int $id): JSONResponse {
 			$mailbox->getName(),
 			$message->getUid()
 		);
+		$this->delegationService->logDelegatedAction("$this->currentUserId deleted message <$id> on behalf of $effectiveUserId");
 		return new JSONResponse();
 	}
 

lib/Controller/OutboxController.php

@@ -142,6 +142,7 @@ public function create(
 		}
 
 		$this->service->saveMessage($account, $message, $to, $cc, $bcc, $attachments);
+		$this->delegationService->logDelegatedAction("$this->userId created an outbox message for account <$accountId> on behalf of $effectiveUserId");
 
 		return JsonResponse::success($message, Http::STATUS_CREATED);
 	}
@@ -159,6 +160,7 @@ public function createFromDraft(DraftsService $draftsService, int $id, int $send
 		$this->accountService->find($effectiveUserId, $draftMessage->getAccountId());
 
 		$outboxMessage = $this->service->convertDraft($draftMessage, $sendAt);
+		$this->delegationService->logDelegatedAction("$this->userId created an outbox message from draft <$id> on behalf of $effectiveUserId");
 
 		return JsonResponse::success(
 			$outboxMessage,
@@ -235,6 +237,7 @@ public function update(
 		}
 
 		$message = $this->service->updateMessage($account, $message, $to, $cc, $bcc, $attachments);
+		$this->delegationService->logDelegatedAction("$this->userId updated outbox message <$id> for account <$accountId> on behalf of $effectiveUserId");
 
 		return JsonResponse::success($message, Http::STATUS_ACCEPTED);
 	}
@@ -252,8 +255,13 @@ public function send(int $id): JsonResponse {
 		$account = $this->accountService->find($effectiveUserId, $message->getAccountId());
 
 		$message = $this->service->sendMessage($message, $account);
+		$status = $message->getStatus();
+		$this->delegationService->logDelegatedAction(match ($status) {
+			LocalMessage::STATUS_PROCESSED => "$this->userId sent outbox message <$id> on behalf of $effectiveUserId",
+			default => "$this->userId attempted sending outbox message <$id> on behalf of $effectiveUserId but sending failed",
+		});
 
-		if ($message->getStatus() !== LocalMessage::STATUS_PROCESSED) {
+		if ($status !== LocalMessage::STATUS_PROCESSED) {
 			return JsonResponse::error('Could not send message', Http::STATUS_INTERNAL_SERVER_ERROR, [$message]);
 		}
 		return JsonResponse::success(
@@ -272,6 +280,7 @@ public function destroy(int $id): JsonResponse {
 		$effectiveUserId = $this->delegationService->resolveLocalMessageUserId($id, $this->userId);
 		$message = $this->service->getMessage($id, $effectiveUserId);
 		$this->service->deleteMessage($effectiveUserId, $message);
+		$this->delegationService->logDelegatedAction("$this->userId deleted outbox message <$id> on behalf of $effectiveUserId");
 		return JsonResponse::success('Message deleted', Http::STATUS_ACCEPTED);
 	}
 }

lib/Controller/SieveController.php

@@ -99,6 +99,7 @@ public function updateActiveScript(int $id, string $script): JSONResponse {
 			$this->logger->error('Installing sieve script failed: ' . $e->getMessage(), ['app' => 'mail', 'exception' => $e]);
 			return new JSONResponse(data: ['message' => $e->getMessage()], statusCode: Http::STATUS_UNPROCESSABLE_ENTITY);
 		}
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated the active sieve script for account <$id> on behalf of $effectiveUserId");
 
 		return new JSONResponse();
 	}
@@ -182,6 +183,7 @@ public function updateAccount(int $id,
 		}
 
 		$this->mailAccountMapper->save($mailAccount);
+		$this->delegationService->logDelegatedAction("$this->currentUserId updated sieve settings for account <$id> on behalf of $effectiveUserId");
 		return new JSONResponse(['sieveEnabled' => $mailAccount->isSieveEnabled()]);
 	}
 }