From 18fc0e4f939c6d580eac683bc98bce3d059ff79d Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Mon, 21 Oct 2024 20:42:12 -0400
Subject: [PATCH] audit logs for failed login attempts (#4564)

* audit logs for failed login attempts

* updating ee ref
---
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-api/openapi.yaml             |  1 +
 backend/windmill-api/src/users.rs             | 28 +++++++++++++++----
 .../auditLogs/AuditLogsFilters.svelte         |  1 +
 4 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 2ada4955ca..0b60c124b1 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-ce38a7f85ca257c48471c46e3811a1281d9e2f27
+d61c163e0a311ecd86d1398aff883eaea8d0b09a
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index a75a8cc1db..53a4f79379 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -10735,6 +10735,7 @@ components:
             - "users.delete"
             - "users.update"
             - "users.login"
+            - "users.login_failure"
             - "users.logout"
             - "users.accept_invite"
             - "users.decline_invite"
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 57d191e6e8..f753e4d9d2 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -2290,6 +2290,8 @@ async fn login(
 ) -> Result<String> {
     let mut tx = db.begin().await?;
     let email = email.to_lowercase();
+    let audit_author =
+        AuditAuthor { email: email.clone(), username: email.clone(), username_override: None };
     let email_w_h: Option<(String, String, bool, bool)> = sqlx::query_as(
         "SELECT email, password_hash, super_admin, first_time_user FROM password WHERE email = $1 AND login_type = \
          'password'",
@@ -2305,6 +2307,16 @@ async fn login(
             .verify_password(password.as_bytes(), &parsed_hash)
             .is_err()
         {
+            audit_log(
+                &mut *tx,
+                &audit_author,
+                "users.login_failure",
+                ActionKind::Create,
+                "global",
+                None,
+                None,
+            )
+            .await?;
             Err(Error::BadRequest("Invalid login".to_string()))
         } else {
             if first_time_user {
@@ -2330,11 +2342,7 @@ async fn login(
 
             audit_log(
                 &mut *tx,
-                &AuditAuthor {
-                    username: email.clone(),
-                    email: email.clone(),
-                    username_override: None,
-                },
+                &audit_author,
                 "users.login",
                 ActionKind::Create,
                 "global",
@@ -2347,6 +2355,16 @@ async fn login(
             Ok(token)
         }
     } else {
+        audit_log(
+            &mut *tx,
+            &audit_author,
+            "users.login_failure",
+            ActionKind::Create,
+            "global",
+            None,
+            None,
+        )
+        .await?;
         Err(Error::BadRequest("Invalid login".to_string()))
     }
 }
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 107d80b0c0..c6c8bfb2d8 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -241,6 +241,7 @@
 		USERS_SETPASSWORD: 'users.setpassword',
 		USERS_UPDATE: 'users.update',
 		USERS_LOGIN: 'users.login',
+		USERS_LOGIN_FAILURE: 'users.login_failure',
 		USERS_LOGOUT: 'users.logout',
 		USERS_ACCEPT_INVITE: 'users.accept_invite',
 		USERS_DECLINE_INVITE: 'users.decline_invite',