kobotoolbox / kpi / 28034696683 / 6

82%

master: 76%

push

github

feat(auth): add failed login attempts DEV-2276 (#7166)

### 📣 Summary
Added application-level logging for failed login attempts and exposed
them in the access logs UI and API

### 📖 Description
Failed authentications are tracker similar to how successful logins are
recorded, using audit logs. It also tracks failed logins for
non-existent accounts to help identify automated attacks (e.g. repeated
attempts across random usernames from a single IP).

* For this it hooks into Django's user_login_failed signal to create
AccessLog entries with a new AUTH_FAILED action. Safely handles
instances without an attached HTTP request or user object
* Updated AccessLogSerializer to expose the new action attribute. For
non-existent accounts where the user relationship is null, it falls back
to exposing the attempted_username stored in the metadata
* Updated OpenAPI outputs and TypeScript models to include action. Added
a "Status" column to the AccessLogsSection component table to clearly
distinguish between Success and Failed logins.

### 👀 Preview steps
1. Log into your account and navigate to Account Settings -> Security
2. Open an incognito window and attempt to log in with your valid
username but an incorrect password
3. Attempt to log in again using a non-existent username
4. Refresh the Security page on your active session. In the Recent
account activity table, you should see your failed attempt marked as
"Failed" under the new Status column.
5. Query the /api/v2/access-logs/ endpoint and verify that the failed
login for the non-existent account was also successfully logged and
tracked.

---------

Signed-off-by: Guillermo <lgar89@gmail.com>
Co-authored-by: Olivier Léger <olivierleger@gmail.com>

5188 of 12189 branches covered (42.56%)

19973 of 36446 relevant lines covered (54.8%)

0.55 hits per line