[NuGet Symbol Server] Auditing (#6431)

Author: shishirx34

src/NuGetGallery/Controllers/ApiController.cs

@@ -444,6 +444,13 @@ public virtual async Task<ActionResult> CreateSymbolPackagePutAsync()
                             var apiScopeEvaluationResult = EvaluateApiScope(ActionsRequiringPermissions.UploadSymbolPackage, package.PackageRegistration, NuGetScopes.PackagePushVersion, NuGetScopes.PackagePush);
                             if (!apiScopeEvaluationResult.IsSuccessful())
                             {
+                                await AuditingService.SaveAuditRecordAsync(
+                                    new FailedAuthenticatedOperationAuditRecord(
+                                        currentUser.Username,
+                                        AuditedAuthenticatedOperationAction.SymbolsPackagePushAttemptByNonOwner,
+                                        attemptedPackage: new AuditedPackageIdentifier(
+                                            id, version.ToNormalizedStringSafe())));
+
                                 // User cannot push a symbol package as the current user's scopes does not allow it to push for the corresponding package.
                                 return GetHttpResultFromFailedApiScopeEvaluationForPush(apiScopeEvaluationResult, id, version);
                             }
@@ -467,6 +474,7 @@ public virtual async Task<ActionResult> CreateSymbolPackagePutAsync()
                                 {
                                     message = ex.Message;
                                 }
+
                                 TelemetryService.TrackSymbolPackageFailedGalleryValidationEvent(id, normalizedVersion);
                                 return new HttpStatusCodeWithBodyResult(HttpStatusCode.BadRequest, message);
                             }
@@ -497,6 +505,9 @@ public virtual async Task<ActionResult> CreateSymbolPackagePutAsync()
                                     throw new NotImplementedException($"The symbol package commit result {commitResult} is not supported.");
                             }
 
+                            await AuditingService.SaveAuditRecordAsync(
+                                new PackageAuditRecord(package, AuditedPackageAction.SymbolsCreate, PackageCreatedVia.Api));
+
                             TelemetryService.TrackSymbolPackagePushEvent(id, normalizedVersion);
 
                             return new HttpStatusCodeResult(HttpStatusCode.Created);

tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs

@@ -321,8 +321,9 @@ public async Task CreateSymbolPackage_UnauthorizedUserWillGet403()
 
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user);
-
-                var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
+                var packageId = "theId";
+                var version = "1.0.42";
+                var nuGetPackage = TestPackage.CreateTestPackageStream(packageId, version);
                 controller.SetupPackageFromInputStream(nuGetPackage);
 
                 var package = new Package()
@@ -357,6 +358,16 @@ public async Task CreateSymbolPackage_UnauthorizedUserWillGet403()
 
                 // Assert
                 ResultAssert.IsStatusCode(result, HttpStatusCode.Unauthorized);
+
+                controller.AuditingService.WroteRecord<FailedAuthenticatedOperationAuditRecord>(
+                    (record) =>
+                    {
+                        return
+                            record.UsernameOrEmail == user.Username &&
+                            record.Action == AuditedAuthenticatedOperationAction.SymbolsPackagePushAttemptByNonOwner &&
+                            record.AttemptedPackage.Id == packageId &&
+                            record.AttemptedPackage.Version == version;
+                    });
             }
 
             [Fact]
@@ -520,7 +531,13 @@ public async Task CreateSymbolPackage_WillCreateSymbolPackageSuccessfully()
                 controller.MockTelemetryService.Verify(
                    x => x.TrackSymbolPackagePushEvent(It.IsAny<string>(), It.IsAny<string>()),
                    Times.Once());
+
                 ResultAssert.IsStatusCode(result, HttpStatusCode.Created);
+
+                Assert.True(controller.AuditingService.WroteRecord<PackageAuditRecord>(ar =>
+                    ar.Action == AuditedPackageAction.SymbolsCreate
+                    && ar.Id == package.PackageRegistration.Id
+                    && ar.Version == package.Version));
             }
 
             [Fact]