From 9eed0d71c83cdd7e6fe6694651c72337a827e5a5 Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Wed, 13 May 2026 15:16:17 +0200 Subject: [PATCH] Log identity_id on every authenticated request Add a single info log line in each authn middleware once an identity is resolved, so every authenticated request emits a record that ties the request back to its user and credential: - Cookie session middleware logs "session authenticated" with identity_id and session_id. - API key middleware logs "api key authenticated" with identity_id and api_key_id. - OAuth2 access token middleware logs "access token authenticated" with identity_id and access_token_id. The credential IDs are row identifiers (GIDs), not the secret token values, so they're safe to log and let operators correlate a request back to the specific credential used. The log lines use the request-scoped logger from httpserver.LoggerFromContext so they inherit http_request_id and any other middleware-attached attributes. Signed-off-by: Sacha Al Himdani --- pkg/server/api/authn/api_key_middleware.go | 8 ++++++++ pkg/server/api/authn/oauth2_access_token_middleware.go | 9 +++++++++ pkg/server/api/authn/session_middleware.go | 8 ++++++++ 3 files changed, 25 insertions(+) diff --git a/pkg/server/api/authn/api_key_middleware.go b/pkg/server/api/authn/api_key_middleware.go index fdbb46490..1906251e1 100644 --- a/pkg/server/api/authn/api_key_middleware.go +++ b/pkg/server/api/authn/api_key_middleware.go @@ -22,6 +22,7 @@ import ( "github.com/99designs/gqlgen/graphql" "github.com/vektah/gqlparser/v2/gqlerror" "go.gearno.de/kit/httpserver" + "go.gearno.de/kit/log" "go.probo.inc/probo/pkg/gid" "go.probo.inc/probo/pkg/iam" "go.probo.inc/probo/pkg/securetoken" @@ -87,6 +88,13 @@ func NewAPIKeyMiddleware(svc *iam.Service, tokenSecret string) func(next http.Ha ctx = ContextWithAPIKey(ctx, apiKey) ctx = ContextWithIdentity(ctx, identity) + httpserver.LoggerFromContext(ctx).InfoCtx( + ctx, + "api key authenticated", + log.String("identity_id", identity.ID.String()), + log.String("api_key_id", apiKey.ID.String()), + ) + next.ServeHTTP(w, r.WithContext(ctx)) }, ) diff --git a/pkg/server/api/authn/oauth2_access_token_middleware.go b/pkg/server/api/authn/oauth2_access_token_middleware.go index e123c0227..58b91b264 100644 --- a/pkg/server/api/authn/oauth2_access_token_middleware.go +++ b/pkg/server/api/authn/oauth2_access_token_middleware.go @@ -18,6 +18,8 @@ import ( "fmt" "net/http" + "go.gearno.de/kit/httpserver" + "go.gearno.de/kit/log" "go.probo.inc/probo/pkg/bearertoken" "go.probo.inc/probo/pkg/iam" ) @@ -52,6 +54,13 @@ func NewOAuth2AccessTokenMiddleware(svc *iam.Service) func(next http.Handler) ht ctx = ContextWithIdentity(ctx, identity) + httpserver.LoggerFromContext(ctx).InfoCtx( + ctx, + "access token authenticated", + log.String("identity_id", identity.ID.String()), + log.String("access_token_id", accessToken.ID.String()), + ) + next.ServeHTTP(w, r.WithContext(ctx)) }, ) diff --git a/pkg/server/api/authn/session_middleware.go b/pkg/server/api/authn/session_middleware.go index 781cd3e62..0003cccbb 100644 --- a/pkg/server/api/authn/session_middleware.go +++ b/pkg/server/api/authn/session_middleware.go @@ -23,6 +23,7 @@ import ( "github.com/99designs/gqlgen/graphql" "github.com/vektah/gqlparser/v2/gqlerror" "go.gearno.de/kit/httpserver" + "go.gearno.de/kit/log" "go.probo.inc/probo/pkg/gid" "go.probo.inc/probo/pkg/iam" "go.probo.inc/probo/pkg/securecookie" @@ -105,6 +106,13 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu ctx = ContextWithSession(ctx, session) ctx = ContextWithIdentity(ctx, identity) + httpserver.LoggerFromContext(ctx).InfoCtx( + ctx, + "session authenticated", + log.String("identity_id", identity.ID.String()), + log.String("session_id", session.ID.String()), + ) + next.ServeHTTP(w, r.WithContext(ctx)) err = svc.SessionService.UpdateSessionData(ctx, session.ID, session.Data)