v1.0.19

src/routes/api/auth/login/+server.ts

@@ -30,11 +30,14 @@ export const POST: RequestHandler = async (event) => {
 		}
 
 		// Rate limiting by IP and username
-		const clientIp = getClientAddress();
+		const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+			|| request.headers.get('x-real-ip')
+			|| getClientAddress();
 		const rateLimitKey = `${clientIp}:${username}`;
 
 		const { limited, retryAfter } = isRateLimited(rateLimitKey);
 		if (limited) {
+			console.warn(`[Auth] Login rate-limited: user=${username} ip=${clientIp} retryAfter=${retryAfter}s`);
 			return json(
 				{ error: `Too many login attempts. Please try again in ${retryAfter} seconds.` },
 				{ status: 429 }
@@ -66,6 +69,7 @@ export const POST: RequestHandler = async (event) => {
 
 		if (!result.success) {
 			recordFailedAttempt(rateLimitKey);
+			console.warn(`[Auth] Login failed: user=${username} provider=${authProviderType} ip=${clientIp} reason=${result.error || 'Authentication failed'}`);
 			return json({ error: result.error || 'Authentication failed' }, { status: 401 });
 		}
 
@@ -80,12 +84,14 @@ export const POST: RequestHandler = async (event) => {
 			const user = await getUserByUsername(username);
 			if (!user || !(await verifyMfaToken(user.id, mfaToken))) {
 				recordFailedAttempt(rateLimitKey);
+				console.warn(`[Auth] MFA failed: user=${username} ip=${clientIp}`);
 				return json({ error: 'Invalid MFA code' }, { status: 401 });
 			}
 
 			// MFA verified, create session
-			const session = await createUserSession(user.id, authProviderType, cookies);
+			const session = await createUserSession(user.id, authProviderType, cookies, request);
 			clearRateLimit(rateLimitKey);
+			console.log(`[Auth] Login successful: user=${username} provider=${authProviderType} ip=${clientIp} mfa=yes`);
 
 			// Audit log
 			await auditAuth(event, 'login', user.username, {
@@ -107,8 +113,9 @@ export const POST: RequestHandler = async (event) => {
 
 		// No MFA, create session directly
 		if (result.user) {
-			const session = await createUserSession(result.user.id, authProviderType, cookies);
+			const session = await createUserSession(result.user.id, authProviderType, cookies, request);
 			clearRateLimit(rateLimitKey);
+			console.log(`[Auth] Login successful: user=${result.user.username} provider=${authProviderType} ip=${clientIp} mfa=no`);
 
 			// Audit log
 			await auditAuth(event, 'login', result.user.username, {

src/routes/api/auth/logout/+server.ts

@@ -11,8 +11,12 @@ export const POST: RequestHandler = async (event) => {
 		// Get current user before destroying session for audit log
 		const auth = await authorize(cookies);
 		const username = auth.user?.username || 'unknown';
+		const clientIp = event.request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+			|| event.request.headers.get('x-real-ip')
+			|| event.getClientAddress();
 
 		await destroySession(cookies);
+		console.log(`[Auth] Logout: user=${username} ip=${clientIp}`);
 
 		// Audit log
 		await auditAuth(event, 'logout', username);

src/routes/api/auth/oidc/callback/+server.ts

@@ -17,9 +17,15 @@ export const GET: RequestHandler = async (event) => {
 	const error = url.searchParams.get('error');
 	const errorDescription = url.searchParams.get('error_description');
 
+	// Extract client IP for logging
+	const clientIp = event.request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+		|| event.request.headers.get('x-real-ip')
+		|| event.getClientAddress();
+
 	// Handle error from IdP
 	if (error) {
 		console.error('OIDC error from IdP:', error, errorDescription);
+		console.warn(`[Auth] OIDC login failed: ip=${clientIp} error=${errorDescription || error}`);
 		const errorMsg = encodeURIComponent(errorDescription || error);
 		throw redirect(302, `/login?error=${errorMsg}`);
 	}
@@ -33,12 +39,14 @@ export const GET: RequestHandler = async (event) => {
 		const result = await handleOidcCallback(code, state);
 
 		if (!result.success || !result.user) {
+			console.warn(`[Auth] OIDC login failed: ip=${clientIp} error=${result.error || 'Authentication failed'}`);
 			const errorMsg = encodeURIComponent(result.error || 'Authentication failed');
 			throw redirect(302, `/login?error=${errorMsg}`);
 		}
 
 		// Create session
-		await createUserSession(result.user.id, 'oidc', cookies);
+		await createUserSession(result.user.id, 'oidc', cookies, event.request);
+		console.log(`[Auth] OIDC login successful: user=${result.user.username} provider=${result.providerName || 'oidc'} ip=${clientIp}`);
 
 		// Audit log
 		await auditAuth(event, 'login', result.user.username, {