1.0.12

src/routes/api/auth/login/+server.ts

@@ -12,9 +12,11 @@ import {
 	isAuthEnabled
 } from '$lib/server/auth';
 import { getUser, getUserByUsername } from '$lib/server/db';
+import { auditAuth } from '$lib/server/audit';
 
 // POST /api/auth/login - Authenticate user
-export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
+export const POST: RequestHandler = async (event) => {
+	const { request, cookies, getClientAddress } = event;
 	// Check if auth is enabled
 	if (!(await isAuthEnabled())) {
 		return json({ error: 'Authentication is not enabled' }, { status: 400 });
@@ -80,6 +82,12 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress
 			const session = await createUserSession(user.id, authProviderType, cookies);
 			clearRateLimit(rateLimitKey);
 
+			// Audit log
+			await auditAuth(event, 'login', user.username, {
+				provider: authProviderType,
+				mfa: true
+			});
+
 			return json({
 				success: true,
 				user: {
@@ -97,6 +105,11 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress
 			const session = await createUserSession(result.user.id, authProviderType, cookies);
 			clearRateLimit(rateLimitKey);
 
+			// Audit log
+			await auditAuth(event, 'login', result.user.username, {
+				provider: authProviderType
+			});
+
 			return json({
 				success: true,
 				user: {

src/routes/api/auth/logout/+server.ts

@@ -1,11 +1,22 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
 import { destroySession } from '$lib/server/auth';
+import { authorize } from '$lib/server/authorize';
+import { auditAuth } from '$lib/server/audit';
 
 // POST /api/auth/logout - End session
-export const POST: RequestHandler = async ({ cookies }) => {
+export const POST: RequestHandler = async (event) => {
+	const { cookies } = event;
 	try {
+		// Get current user before destroying session for audit log
+		const auth = await authorize(cookies);
+		const username = auth.user?.username || 'unknown';
+
 		await destroySession(cookies);
+
+		// Audit log
+		await auditAuth(event, 'logout', username);
+
 		return json({ success: true });
 	} catch (error) {
 		console.error('Logout error:', error);

src/routes/api/auth/oidc/callback/+server.ts

@@ -1,9 +1,11 @@
 import { json, redirect } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
 import { handleOidcCallback, createUserSession, isAuthEnabled } from '$lib/server/auth';
+import { auditAuth } from '$lib/server/audit';
 
 // GET /api/auth/oidc/callback - Handle OIDC callback from IdP
-export const GET: RequestHandler = async ({ url, cookies }) => {
+export const GET: RequestHandler = async (event) => {
+	const { url, cookies } = event;
 	// Check if auth is enabled
 	if (!isAuthEnabled()) {
 		throw redirect(302, '/login?error=auth_disabled');
@@ -38,6 +40,13 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
 		// Create session
 		await createUserSession(result.user.id, 'oidc', cookies);
 
+		// Audit log
+		await auditAuth(event, 'login', result.user.username, {
+			provider: 'oidc',
+			providerId: result.providerId,
+			providerName: result.providerName
+		});
+
 		// Redirect to the original destination or home
 		const redirectUrl = result.redirectUrl || '/';
 		throw redirect(302, redirectUrl);