From 22146c422d3a10235e0e265e858a6a88962b46c4 Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Thu, 28 May 2026 15:14:13 +0200
Subject: [PATCH] fix(auth): audit-log login success + failure attempts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Login handler hatte h.Audit injiziert (mit Kommentar "login-success/fail
ins audit_log fließen") aber nie aufgerufen. Jetzt werden geloggt:
  - auth.login.failed (reason: invalid_credentials | account_disabled)
  - auth.login.success (mit role + remote IP)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                         |  2 +-
 cmd/edgeguard-api/main.go       |  2 +-
 cmd/edgeguard-ctl/main.go       |  2 +-
 cmd/edgeguard-scheduler/main.go |  2 +-
 internal/handlers/auth.go       | 17 +++++++++++++++++
 5 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/VERSION b/VERSION
index 6683f49..c4c90b9 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.130
+1.1.131
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 0cb01e6..a8b1fd4 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.130"
+var version = "1.1.131"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index afaecc8..3072bc5 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.130"
+var version = "1.1.131"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index 1e14701..962aec4 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.130"
+var version = "1.1.131"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go
index f418a3c..8699629 100644
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -86,16 +86,25 @@ func (h *AuthHandler) Login(c *gin.Context) {
 
 	email := strings.TrimSpace(req.Email)
 	actor, role := "", "admin"
+	remote := c.ClientIP()
 
 	// 1. Try DB users table first.
 	if h.Users != nil {
 		u, hash, dbErr := h.Users.FindByEmail(c.Request.Context(), email)
 		if dbErr == nil {
 			if !u.Active {
+				if h.Audit != nil {
+					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+						email, gin.H{"reason": "account_disabled", "remote": remote}, h.NodeID)
+				}
 				response.Unauthorized(c, errors.New("account_disabled"))
 				return
 			}
 			if !usersvc.VerifyPassword(hash, req.Password) {
+				if h.Audit != nil {
+					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+						email, gin.H{"reason": "invalid_credentials", "remote": remote}, h.NodeID)
+				}
 				response.Unauthorized(c, errors.New("invalid_credentials"))
 				return
 			}
@@ -108,6 +117,10 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	// 2. Fallback: setup-store admin (backwards compat for pre-DB installs).
 	if actor == "" {
 		if !strings.EqualFold(st.AdminEmail, email) || !st.VerifyAdminPassword(req.Password) {
+			if h.Audit != nil {
+				_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+					email, gin.H{"reason": "invalid_credentials", "remote": remote}, h.NodeID)
+			}
 			response.Unauthorized(c, errors.New("invalid_credentials"))
 			return
 		}
@@ -127,6 +140,10 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	}
 	setSessionCookie(c, raw, tok.Exp)
 
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actor, "auth.login.success",
+			actor, gin.H{"role": role, "remote": remote}, h.NodeID)
+	}
 	response.OK(c, loginResponse{
 		Actor:     tok.Actor,
 		Role:      tok.Role,