From f44e7fc4e7c3eb2586c8d91ed186f99a3cf83cbb Mon Sep 17 00:00:00 2001
From: Ryan Clark <ryan@ryanclark.me>
Date: Mon, 15 Aug 2022 19:10:46 +0100
Subject: [PATCH] Add an event for when a session recording is accessed

---
 .../src/Audit/EventList/EventTypeCell.tsx     |  1 +
 .../__snapshots__/Audit.story.test.tsx.snap   | 41 ++++++++++++++++++-
 packages/teleport/src/Audit/fixtures/index.ts |  9 ++++
 .../teleport/src/services/audit/makeEvent.ts  |  7 ++++
 packages/teleport/src/services/audit/types.ts |  8 ++++
 5 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/packages/teleport/src/Audit/EventList/EventTypeCell.tsx b/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
index ca1d7d7de..0d818af41 100644
--- a/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
+++ b/packages/teleport/src/Audit/EventList/EventTypeCell.tsx
@@ -130,6 +130,7 @@ const EventIconMap: Record<EventCode, React.FC> = {
   [eventCodes.X11_FORWARD_FAILURE]: Icons.Info,
   [eventCodes.CERTIFICATE_CREATED]: Icons.Keypair,
   [eventCodes.UPGRADE_WINDOW_UPDATED]: Icons.Info,
+  [eventCodes.SESSION_RECORDING_ACCESS]: Icons.Info,
   [eventCodes.UNKNOWN]: Icons.Question,
 };
 
diff --git a/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap b/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap
index df7532a7a..ad19765da 100644
--- a/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap
+++ b/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap
@@ -358,12 +358,12 @@ exports[`list of all events 1`] = `
           </strong>
            - 
           <strong>
-            89
+            90
           </strong>
            of
            
           <strong>
-            89
+            90
           </strong>
         </div>
         <button
@@ -471,6 +471,43 @@ exports[`list of all events 1`] = `
           </button>
         </td>
       </tr>
+      <tr>
+        <td
+          style="vertical-align: inherit;"
+        >
+          <div
+            class="c14"
+          >
+            <span
+              class="c10 c15 icon icon-info_outline c10 c15"
+              color="light"
+              font-size="3"
+            />
+            Session Recording Accessed
+          </div>
+        </td>
+        <td
+          style="word-break: break-word;"
+        >
+          User [ops@gravitational.io] accessed a session recording [44c6cea8-362f-11ea-83aa-125400432324]
+        </td>
+        <td
+          style="min-width: 120px;"
+        >
+          2022-07-14T18:04:37.067Z
+        </td>
+        <td
+          align="right"
+        >
+          <button
+            class="c16"
+            kind="border"
+            width="87px"
+          >
+            Details
+          </button>
+        </td>
+      </tr>
       <tr>
         <td
           style="vertical-align: inherit;"
diff --git a/packages/teleport/src/Audit/fixtures/index.ts b/packages/teleport/src/Audit/fixtures/index.ts
index 7e0118260..18979864c 100644
--- a/packages/teleport/src/Audit/fixtures/index.ts
+++ b/packages/teleport/src/Audit/fixtures/index.ts
@@ -1256,6 +1256,15 @@ export const events = [
     event: 'upgradewindowstart.update',
     upgrade_window_start: '23:00',
   },
+  {
+    code: 'T2012I',
+    event: 'session.recording.access',
+    sid: '44c6cea8-362f-11ea-83aa-125400432324',
+    success: true,
+    time: '2022-07-14T18:04:37.067Z',
+    uid: '7d440ee1-15f6-4b56-9391-344e8984fd97',
+    user: 'ops@gravitational.io',
+  },
 ].map(makeEvent);
 
 export const eventsSample = [
diff --git a/packages/teleport/src/services/audit/makeEvent.ts b/packages/teleport/src/services/audit/makeEvent.ts
index 2d5772a8b..e0d9bb026 100644
--- a/packages/teleport/src/services/audit/makeEvent.ts
+++ b/packages/teleport/src/services/audit/makeEvent.ts
@@ -703,6 +703,13 @@ export const formatters: Formatters = {
       return `Upgrade Window Start updated to [${upgrade_window_start}] by user [${user}]`;
     },
   },
+  [eventCodes.SESSION_RECORDING_ACCESS]: {
+    type: 'session.recording.access',
+    desc: 'Session Recording Accessed',
+    format: ({ sid, user }) => {
+      return `User [${user}] accessed a session recording [${sid}]`;
+    },
+  },
   [eventCodes.UNKNOWN]: {
     type: 'unknown',
     desc: 'Unknown Event',
diff --git a/packages/teleport/src/services/audit/types.ts b/packages/teleport/src/services/audit/types.ts
index abe098fd2..c41884473 100644
--- a/packages/teleport/src/services/audit/types.ts
+++ b/packages/teleport/src/services/audit/types.ts
@@ -127,6 +127,7 @@ export const eventCodes = {
   SESSION_START: 'T2000I',
   SESSION_UPLOAD: 'T2005I',
   SESSION_CONNECT: 'T2010I',
+  SESSION_RECORDING_ACCESS: 'T2012I',
   SUBSYSTEM_FAILURE: 'T3001E',
   SUBSYSTEM: 'T3001I',
   TERMINAL_RESIZE: 'T2002I',
@@ -753,6 +754,13 @@ export type RawEvents = {
       upgrade_window_start: string;
     }
   >;
+  [eventCodes.SESSION_RECORDING_ACCESS]: RawEvent<
+    typeof eventCodes.SESSION_RECORDING_ACCESS,
+    {
+      sid: string;
+      user: string;
+    }
+  >;
 };
 
 /**