kobotoolbox / kpi / 28034696683

82%

master: 76%

Build Type

push

github

Committed by web-flow

Commit Message

feat(auth): add failed login attempts DEV-2276 (#7166)

### 📣 Summary
Added application-level logging for failed login attempts and exposed
them in the access logs UI and API

### 📖 Description
Failed authentications are tracker similar to how successful logins are
recorded, using audit logs. It also tracks failed logins for
non-existent accounts to help identify automated attacks (e.g. repeated
attempts across random usernames from a single IP).

* For this it hooks into Django's user_login_failed signal to create
AccessLog entries with a new AUTH_FAILED action. Safely handles
instances without an attached HTTP request or user object
* Updated AccessLogSerializer to expose the new action attribute. For
non-existent accounts where the user relationship is null, it falls back
to exposing the attempted_username stored in the metadata
* Updated OpenAPI outputs and TypeScript models to include action. Added
a "Status" column to the AccessLogsSection component table to clearly
distinguish between Success and Failed logins.

### 👀 Preview steps
1. Log into your account and navigate to Account Settings -> Security
2. Open an incognito window and attempt to log in with your valid
username but an incorrect password
3. Attempt to log in again using a non-existent username
4. Refresh the Security page on your active session. In the Recent
account activity table, you should see your failed attempt marked as
"Failed" under the new Status column.
5. Query the /api/v2/access-logs/ endpoint and verify that the failed
login for the non-existent account was also successfully logged and
tracked.

---------

Signed-off-by: Guillermo <lgar89@gmail.com>
Co-authored-by: Olivier Léger <olivierleger@gmail.com>

Coverage Stats

9074 of 12315 branches covered (73.68%)

35 of 50 new or added lines in 5 files covered. (70.0%)

1 existing line in 1 file now uncovered.

29812 of 36529 relevant lines covered (81.61%)

5.56 hits per line