Release v2.20.4

src/web/lib/auth/better-auth.js

@@ -2,9 +2,34 @@ const crypto = require('crypto');
 const { isIP } = require('node:net');
 const { verifyEncodedPassword } = require('#src/auth');
 const { fetchAppSettings } = require('#src/data/app-settings');
+const { recordRequestAuditEvent } = require('#src/data/audit-log');
 const { formatAccountEmailExpiry, normalizeOtpEmailBody, renderAccountEmailTemplate } = require('#src/data/account-email-templates');
 
 const LOGIN_RATE_LIMIT_PATHS = ['/sign-in/username', '/sign-in/email', '/two-factor/verify-totp', '/two-factor/verify-backup-code'];
+const LOGIN_AUDIT_PATHS = LOGIN_RATE_LIMIT_PATHS.concat('/passkey/verify-authentication');
+
+function createLoginAuditHook(pool, recordAudit = recordRequestAuditEvent) {
+  return async function (ctx) {
+    const newSession = ctx.context.newSession;
+    if (!LOGIN_AUDIT_PATHS.includes(ctx.path) || !newSession || !newSession.session || !newSession.user) return;
+    const headers = ctx.headers || ctx.request && ctx.request.headers;
+    await recordAudit(pool, {
+      headers: headers ? Object.fromEntries(headers) : {},
+      ip: newSession.session.ipAddress
+    }, {
+      category: 'authentication',
+      eventType: 'login.success',
+      actorUserId: newSession.user.id,
+      targetType: 'user',
+      targetId: newSession.user.id,
+      targetLabel: newSession.user.username || newSession.user.email
+    });
+  };
+}
+
+function getTrustedProxies(value = process.env.AUTH_TRUSTED_PROXIES) {
+  return String(value || '').split(',').map(function (proxy) { return proxy.trim(); }).filter(Boolean);
+}
 
 function ensureBetterAuthClientIp(req) {
   if (!req.headers['x-forwarded-for'] && req.socket && req.socket.remoteAddress) {
@@ -272,6 +297,9 @@ async function createBetterAuth(pool, options) {
           after: [{
             matcher: function (ctx) { return LOGIN_RATE_LIMIT_PATHS.includes(ctx.path); },
             handler: apiModule.createAuthMiddleware(createLoginRateLimitResetHook(pool))
+          }, {
+            matcher: function (ctx) { return LOGIN_AUDIT_PATHS.includes(ctx.path); },
+            handler: apiModule.createAuthMiddleware(createLoginAuditHook(pool))
           }]
         }
       }
@@ -279,7 +307,8 @@ async function createBetterAuth(pool, options) {
     disabledPaths: ['/sign-up/email', '/forget-password', '/reset-password', '/change-password', '/send-verification-email', '/verify-email'],
     advanced: {
       ipAddress: {
-        ipAddressHeaders: ['x-forwarded-for']
+        ipAddressHeaders: ['x-forwarded-for'],
+        trustedProxies: getTrustedProxies()
       },
       useSecureCookies: false,
       defaultCookieAttributes: {
@@ -317,10 +346,12 @@ async function createBetterAuth(pool, options) {
 
 module.exports = {
   createBetterAuth,
+  getTrustedProxies,
   ensureBetterAuthClientIp,
   createPasswordCallbacks,
   createAccountLockSessionHook,
   createLoginRateLimitResetHook,
+  createLoginAuditHook,
   createPasskeyAuthenticationGuard,
   resolvePasskeyRpID,
   getRoleTwoFactorAuthError