[v15] Add usage events for database autoprovisioning (#39841)

api/proto/teleport/legacy/types/events/events.proto

@@ -3096,6 +3096,11 @@ message DatabasePermissionUpdate {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "permission_summary"
   ];
+  // AffectedObjectCounts counts how many distinct objects of each kind were affected.
+  map<string, int32> AffectedObjectCounts = 6 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "affected_object_counts"
+  ];
 }
 
 // DatabasePermissionEntry is a summary of permissions, scoped to a particular permission.

lib/usagereporter/teleport/audit.go

@@ -23,6 +23,7 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	prehogv1a "github.com/gravitational/teleport/gen/proto/go/prehog/v1alpha"
 	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/srv/db/common/databaseobjectimportrule"
 )
 
 const (
@@ -265,6 +266,30 @@ func ConvertAuditEvent(event apievents.AuditEvent) Anonymizable {
 			DnsSansCount: int32(len(e.DNSSANs)),
 			SvidType:     e.SVIDType,
 		}
+	case *apievents.DatabaseUserCreate:
+		return &DatabaseUserCreatedEvent{
+			Database: &prehogv1a.SessionStartDatabaseMetadata{
+				DbType:     e.DatabaseType,
+				DbProtocol: e.DatabaseProtocol,
+				DbOrigin:   e.DatabaseOrigin,
+			},
+			UserName: e.User,
+			NumRoles: int32(len(e.DatabaseRoles)),
+		}
+	case *apievents.DatabasePermissionUpdate:
+		out := &DatabaseUserPermissionsUpdateEvent{
+			Database: &prehogv1a.SessionStartDatabaseMetadata{
+				DbType:     e.DatabaseType,
+				DbProtocol: e.DatabaseProtocol,
+				DbOrigin:   e.DatabaseOrigin,
+			},
+			UserName:  e.User,
+			NumTables: e.AffectedObjectCounts[databaseobjectimportrule.ObjectKindTable],
+		}
+		for _, entry := range e.PermissionSummary {
+			out.NumTablesPermissions += entry.Counts[databaseobjectimportrule.ObjectKindTable]
+		}
+		return out
 	}
 
 	return nil