Add audit event when a service manager changes someones profile

We should audit when a service manager changes a user profile that is not
their own. This can be recorded in our events table, which is currently
only used to record successful logins.

This adds two new types of event, `update_user_email` and
`update_user_mobile_number` which store the
- browser fingerprint
- IP address
- user id of the user being updated
- user id of the service manager  making the change
- original email address and new email address (for `update_user_email`
events)
- original mobile number and new mobile number (for
`update_user_mobile_number` events)

app/event_handlers.py

@@ -3,18 +3,43 @@ from flask import request
 from app import events_api_client
 
 
-def on_user_logged_in(sender, user):
-    _send_event(sender, event_type='sucessful_login', user=user)
+def on_user_logged_in(_sender, user):
+    _send_event(event_type='sucessful_login', user_id=user.id)
 
 
-def _send_event(sender, **kwargs):
+def create_email_change_event(user_id, updated_by_id, original_email_address, new_email_address):
+    _send_event(
+        event_type='update_user_email',
+        user_id=user_id,
+        updated_by_id=updated_by_id,
+        original_email_address=original_email_address,
+        new_email_address=new_email_address)
+
+
+def create_mobile_number_change_event(user_id, updated_by_id, original_mobile_number, new_mobile_number):
+    _send_event(
+        event_type='update_user_mobile_number',
+        user_id=user_id,
+        updated_by_id=updated_by_id,
+        original_mobile_number=original_mobile_number,
+        new_mobile_number=new_mobile_number)
+
+
+def _send_event(**kwargs):
     if not kwargs.get('event_type'):
         return
 
     event_data = _construct_event_data(request)
+    event_fields = ('user_id',
+                    'updated_by_id',
+                    'original_email_address',
+                    'new_email_address',
+                    'original_mobile_number',
+                    'new_mobile_number')
 
-    if kwargs.get('user'):
-        event_data['user_id'] = kwargs.get('user').id
+    for field in event_fields:
+        if kwargs.get(field):
+            event_data[field] = kwargs[field]
 
     events_api_client.create_event(kwargs['event_type'], event_data)
 

app/main/views/manage_users.py

@@ -16,6 +16,10 @@ from app import (
     service_api_client,
     user_api_client,
 )
+from app.event_handlers import (
+    create_email_change_event,
+    create_mobile_number_change_event,
+)
 from app.main import main
 from app.main.forms import (
     ChangeEmailForm,
@@ -196,6 +200,8 @@ def confirm_edit_user_email(service_id, user_id):
             user_api_client.update_user_attribute(str(user_id), email_address=new_email, updated_by=current_user.id)
         except HTTPError as e:
             abort(500, e)
+        else:
+            create_email_change_event(user.id, current_user.id, user.email_address, new_email)
         finally:
             session.pop('team_member_email_change', None)
 
@@ -254,6 +260,8 @@ def confirm_edit_user_mobile_number(service_id, user_id):
             user_api_client.update_user_attribute(str(user_id), mobile_number=new_number, updated_by=current_user.id)
         except HTTPError as e:
             abort(500, e)
+        else:
+            create_mobile_number_change_event(user.id, current_user.id, user.mobile_number, new_number)
         finally:
             session.pop('team_member_mobile_change', None)