From 76c3b6fe0cf64af951355a0f93fd36c76f10114d Mon Sep 17 00:00:00 2001 From: Bubka <858858+Bubka@users.noreply.github.com> Date: Wed, 24 Apr 2024 14:06:15 +0200 Subject: [PATCH] Add logging of auth proxy user --- app/Extensions/RemoteUserProvider.php | 4 +++- app/Http/Middleware/LogUserLastSeen.php | 3 +-- .../Authentication/VisitedByProxyUserListener.php | 13 ++++++++----- app/Providers/EventServiceProvider.php | 7 ++++--- app/Services/Auth/ReverseProxyGuard.php | 13 +++++++++---- resources/js/components/AccessLogViewer.vue | 2 ++ resources/js/views/admin/users/Manage.vue | 12 +++++++++--- resources/lang/en/admin.php | 1 + 8 files changed, 37 insertions(+), 18 deletions(-) diff --git a/app/Extensions/RemoteUserProvider.php b/app/Extensions/RemoteUserProvider.php index e7ce6df9..e87fe421 100644 --- a/app/Extensions/RemoteUserProvider.php +++ b/app/Extensions/RemoteUserProvider.php @@ -16,6 +16,8 @@ use Illuminate\Validation\ValidationException; class RemoteUserProvider implements UserProvider { + const FAKE_REMOTE_DOMAIN = '@remote'; + /** * The currently authenticated user. * @@ -85,7 +87,7 @@ class RemoteUserProvider implements UserProvider */ protected function fakeRemoteEmail(mixed $id) { - return substr($id, 0, 184) . '@remote'; + return substr($id, 0, 184) . self::FAKE_REMOTE_DOMAIN; } /** diff --git a/app/Http/Middleware/LogUserLastSeen.php b/app/Http/Middleware/LogUserLastSeen.php index c5d5ce42..40d7cc97 100644 --- a/app/Http/Middleware/LogUserLastSeen.php +++ b/app/Http/Middleware/LogUserLastSeen.php @@ -23,8 +23,7 @@ class LogUserLastSeen // We do not track activity of: // - Guest // - User authenticated against a bearer token - // - User authenticated via a reverse-proxy - if (Auth::guard($guard)->check() && ! $request->bearerToken() && config('auth.defaults.guard') !== 'reverse-proxy-guard') { + if (Auth::guard($guard)->check() && ! $request->bearerToken()) { Auth::guard($guard)->user()->last_seen_at = Carbon::now()->format('Y-m-d H:i:s'); Auth::guard($guard)->user()->save(); break; diff --git a/app/Listeners/Authentication/VisitedByProxyUserListener.php b/app/Listeners/Authentication/VisitedByProxyUserListener.php index e026ccf5..0595df6d 100644 --- a/app/Listeners/Authentication/VisitedByProxyUserListener.php +++ b/app/Listeners/Authentication/VisitedByProxyUserListener.php @@ -1,8 +1,9 @@ request->userAgent(); $known = $user->authentications()->whereIpAddress($ip)->whereUserAgent($userAgent)->whereLoginSuccessful(true)->first(); $newUser = Carbon::parse($user->{$user->getCreatedAtColumn()})->diffInMinutes(Carbon::now()) < 1; + $guard = config('auth.defaults.guard'); $log = $user->authentications()->create([ - 'ip_address' => $ip, - 'user_agent' => $userAgent, - 'login_at' => now(), + 'ip_address' => $ip, + 'user_agent' => $userAgent, + 'login_at' => now(), 'login_successful' => true, + 'guard' => $guard, ]); - if (! $known && ! $newUser && $user->preferences['notifyOnNewAuthDevice']) { + if (! $known && ! $newUser && ! str_ends_with($user->email, RemoteUserProvider::FAKE_REMOTE_DOMAIN) && $user->preferences['notifyOnNewAuthDevice']) { $user->notify(new SignedInWithNewDevice($log)); } } diff --git a/app/Providers/EventServiceProvider.php b/app/Providers/EventServiceProvider.php index d241c6ea..16a08ed7 100644 --- a/app/Providers/EventServiceProvider.php +++ b/app/Providers/EventServiceProvider.php @@ -2,6 +2,7 @@ namespace App\Providers; +use App\Listeners\Authentication\VisitedByProxyUserListener; use App\Events\GroupDeleted; use App\Events\GroupDeleting; use App\Events\VisitedByProxyUser; @@ -65,9 +66,9 @@ class EventServiceProvider extends ServiceProvider Logout::class => [ LogoutListener::class, ], - // VisitedByProxyUser::class => [ - // ProxyUserAccessListener::class, - // ], + VisitedByProxyUser::class => [ + VisitedByProxyUserListener::class, + ], ]; /** diff --git a/app/Services/Auth/ReverseProxyGuard.php b/app/Services/Auth/ReverseProxyGuard.php index b4ab5221..61ff4afc 100644 --- a/app/Services/Auth/ReverseProxyGuard.php +++ b/app/Services/Auth/ReverseProxyGuard.php @@ -5,6 +5,7 @@ namespace App\Services\Auth; +use App\Events\VisitedByProxyUser; use Illuminate\Auth\GuardHelpers; use Illuminate\Contracts\Auth\Guard; use Illuminate\Contracts\Auth\UserProvider; @@ -17,14 +18,12 @@ class ReverseProxyGuard implements Guard /** * The currently authenticated user. * - * @var \Illuminate\Contracts\Auth\Authenticatable|null + * @var \Illuminate\Contracts\Auth\Authenticatable|\App\Models\User|null */ protected $user; /** * Create a new authentication guard. - * - * @return void */ public function __construct(UserProvider $provider) { @@ -76,7 +75,13 @@ class ReverseProxyGuard implements Guard } } - return $this->user = $this->provider->retrieveById($identifier); + if ($this->user = $this->provider->retrieveById($identifier)) { + if ($this->user->lastLoginAt() < now()->subMinutes(15)) { + event(new VisitedByProxyUser($this->user)); + } + } + + return $this->user; } /** diff --git a/resources/js/components/AccessLogViewer.vue b/resources/js/components/AccessLogViewer.vue index 57445fa2..c1f45182 100644 --- a/resources/js/components/AccessLogViewer.vue +++ b/resources/js/components/AccessLogViewer.vue @@ -7,6 +7,7 @@ import { UseColorMode } from '@vueuse/components' const notify = useNotifyStore() + const $2fauth = inject('2fauth') const props = defineProps({ userId: [Number, String], @@ -171,6 +172,7 @@
+
diff --git a/resources/js/views/admin/users/Manage.vue b/resources/js/views/admin/users/Manage.vue index fd831af1..fdf11bcc 100644 --- a/resources/js/views/admin/users/Manage.vue +++ b/resources/js/views/admin/users/Manage.vue @@ -11,6 +11,7 @@ const router = useRouter() const user = useUserStore() const bus = useBusStore() + const $2fauth = inject('2fauth') const isFetching = ref(false) const managedUser = ref(null) @@ -212,12 +213,14 @@
{{ $t('admin.registered_on_date', { date: managedUser.info.created_at }) }} - {{ $t('admin.last_seen_on_date', { date: managedUser.info.last_seen_at }) }}
+
-
-

{{ $t('admin.access') }}

-
+

{{ $t('admin.access') }}

+ +
+
@@ -245,6 +248,7 @@
+
{{ $t('settings.personal_access_tokens') }} @@ -263,6 +267,7 @@
+
{{ $t('auth.webauthn.security_devices') }} @@ -282,6 +287,7 @@
+

{{ $t('admin.last_accesses') }}

diff --git a/resources/lang/en/admin.php b/resources/lang/en/admin.php index c454cbdc..762175ec 100644 --- a/resources/lang/en/admin.php +++ b/resources/lang/en/admin.php @@ -71,6 +71,7 @@ return [ 'successful_login_on' => 'Successful login on :login_at', 'successful_logout_on' => 'Successful logout on :login_at', 'failed_login_on' => 'Failed login on :login_at', + 'viewed_on' => 'Viewed on :login_at', 'last_accesses' => 'Last accesses', 'see_full_log' => 'See full log', 'browser_on_platform' => ':browser on :platform',