Mirrors/audiobookshelf
Mirrors/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2024-12-20 19:06:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update:Log local auth login attempts for failed and successful #2533 #2579

Browse Source
This commit is contained in:
advplyr 2024-08-17 15:02:59 -05:00
parent 9e0f17f7c6
commit 1b914d5d4f
1 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
server/Auth.js
View File

@ -3,6 +3,7 @@ const passport = require('passport')
const { Request, Response, NextFunction } = require('express') const { Request, Response, NextFunction } = require('express')
const bcrypt = require('./libs/bcryptjs') const bcrypt = require('./libs/bcryptjs')
const jwt = require('./libs/jsonwebtoken') const jwt = require('./libs/jsonwebtoken')
const requestIp = require('./libs/requestIp')
const LocalStrategy = require('./libs/passportLocal') const LocalStrategy = require('./libs/passportLocal')
const JwtStrategy = require('passport-jwt').Strategy const JwtStrategy = require('passport-jwt').Strategy
const ExtractJwt = require('passport-jwt').ExtractJwt const ExtractJwt = require('passport-jwt').ExtractJwt
@ -76,7 +77,7 @@ class Auth {
* Passport use LocalStrategy * Passport use LocalStrategy
*/ */
initAuthStrategyPassword() { initAuthStrategyPassword() {
passport.use(new LocalStrategy(this.localAuthCheckUserPw.bind(this))) passport.use(new LocalStrategy({ passReqToCallback: true }, this.localAuthCheckUserPw.bind(this)))
} }
/** /**
@ -825,15 +826,21 @@ class Auth {
/** /**
* Checks if a username and password tuple is valid and the user active. * Checks if a username and password tuple is valid and the user active.
* @param {Request} req
* @param {string} username * @param {string} username
* @param {string} password * @param {string} password
* @param {Promise<function>} done * @param {Promise<function>} done
*/ */
async localAuthCheckUserPw(username, password, done) { async localAuthCheckUserPw(req, username, password, done) {
// Load the user given it's username // Load the user given it's username
const user = await Database.userModel.getUserByUsername(username.toLowerCase()) const user = await Database.userModel.getUserByUsername(username.toLowerCase())
if (!user?.isActive) { if (!user?.isActive) {
if (user) {
this.logFailedLocalAuthLoginAttempt(req, user.username, 'User is not active')
} else {
this.logFailedLocalAuthLoginAttempt(req, username, 'User not found')
}
done(null, null) done(null, null)
return return
} }
@ -842,14 +849,16 @@ class Auth {
if (user.type === 'root' && !user.pash) { if (user.type === 'root' && !user.pash) {
if (password) { if (password) {
// deny login // deny login
this.logFailedLocalAuthLoginAttempt(req, user.username, 'Root user has no password set')
done(null, null) done(null, null)
return return
} }
// approve login // approve login
Logger.info(`[Auth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
done(null, user) done(null, user)
return return
} else if (!user.pash) { } else if (!user.pash) {
Logger.error(`[Auth] User "${user.username}"/"${user.type}" attempted to login without a password set`) this.logFailedLocalAuthLoginAttempt(req, user.username, 'User has no password set. Might have been created with OpenID')
done(null, null) done(null, null)
return return
} }
@ -858,14 +867,27 @@ class Auth {
const compare = await bcrypt.compare(password, user.pash) const compare = await bcrypt.compare(password, user.pash)
if (compare) { if (compare) {
// approve login // approve login
Logger.info(`[Auth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
done(null, user) done(null, user)
return return
} }
// deny login // deny login
this.logFailedLocalAuthLoginAttempt(req, user.username, 'Invalid password')
done(null, null) done(null, null)
return return
} }
/**
*
* @param {Request} req
* @param {string} username
* @param {string} message
*/
logFailedLocalAuthLoginAttempt(req, username, message) {
if (!req || !username || !message) return
Logger.error(`[Auth] Failed login attempt for username "${username}" from ip ${requestIp.getClientIp(req)} (${message})`)
}
/** /**
* Hashes a password with bcrypt. * Hashes a password with bcrypt.
* @param {string} password * @param {string} password