Added audit logs to be logged into database for staff ease

backend/app/api/auth_routes.py

@@ -10,9 +10,9 @@ from app.services.email_service import send_reset_password_email, send_verificat
 router = APIRouter(prefix="/auth", tags=["Auth"])
 
 @router.post("/login")
-def login(data: LoginRequest, db: Session = Depends(get_db)):
+def login(data: LoginRequest, request: Request, db: Session = Depends(get_db)):
     try:
-        token = login_user(db, data.email, data.password)
+        token = login_user(db, data.email, data.password, request)
         if not token:
             raise HTTPException(status_code=401, detail="Invalid Credentials")
         return {"access_token": token}
@@ -77,8 +77,8 @@ def request_reset(
     return {"message": "If that email exists, a reset link has been sent."}
 
 @router.post("/reset-password")
-def reset_password(data: PasswordResetConfirm, db: Session = Depends(get_db)):
-    success = confirm_password_reset(db, data.token, data.new_password)
+def reset_password(data: PasswordResetConfirm, request: Request, db: Session = Depends(get_db)):
+    success = confirm_password_reset(db, data.token, data.new_password, request)
     if not success:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,

backend/app/models/audit_model.py

@@ -0,0 +1,13 @@
+from sqlalchemy import Column, Integer, String, DateTime, JSON, ForeignKey
+from app.db.database import Base
+from datetime import datetime, UTC
+
+class AuditLog(Base):
+    __tablename__ = "audit_logs"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    action = Column(String, index=True, nullable=False)
+    timestamp = Column(DateTime, default=datetime.now(UTC), index=True)
+    ip = Column(String, nullable=True)
+    metadata_info = Column(JSON, nullable=True)

backend/app/services/audit_service.py

@@ -0,0 +1,29 @@
+from sqlalchemy.orm import Session
+from app.models.audit_model import AuditLog
+from fastapi import Request
+from app.core.request_id import get_request_id
+
+def log_audit_event(
+    db: Session,
+    action: str,
+    user_id: int | None = None,
+    request: Request | None = None,
+    details: dict | None = None
+):
+    ip_address = None
+    if request and request.client:
+        ip_address = request.client.host
+
+        # ip_address = request.headers.get("X-Forwarded-For", request.client.host)
+        meta = details or {}
+        meta["request_id"] = get_request_id()
+
+        audit_entry = AuditLog(
+            user_id=user_id,
+            action=action,
+            ip=ip_address,
+            metadata_info=meta
+        )
+
+        db.add(audit_entry)
+        db.commit()

backend/app/services/auth_service.py

@@ -4,17 +4,21 @@ from sqlalchemy.orm import Session
 from app.models.user_model import User
 from app.utils.security import verify_password, hash_password
 from app.utils.jwt_handler import create_access_token
+from fastapi import Request
+from app.services.audit_service import log_audit_event
 
-def login_user(db: Session, email: str, password: str):
+def login_user(db: Session, email: str, password: str, request: Request):
     user = db.query(User).filter(User.email == email).first()
     
     if not user:
+        log_audit_event(db, "login_failed", None, request, {"email_attempted": email, "reason": "user_not_found"})
         return None
     
     if user.locked_until:
         if datetime.now(UTC).replace(tzinfo=None) < user.locked_until:
             time_left = user.locked_until - datetime.now(UTC).replace(tzinfo=None)
             minutes_left = int(time_left.total_seconds() / 60) + 1
+            log_audit_event(db, "login_blocked", user.id, request, {"reason": "account_locked", "minutes_left": minutes_left})
             raise ValueError(f"locked_{minutes_left}")
         else:
             user.locked_until = None
@@ -27,10 +31,12 @@ def login_user(db: Session, email: str, password: str):
         if user.failed_attempts >= 5:
             user.locked_until = datetime.now(UTC).replace(tzinfo=None) + timedelta(minutes=15)
             db.commit()
+            log_audit_event(db, "account_locked", user.id, request, {"reason": "max_failed_attempts"})
             raise ValueError("locked_15")
         db.commit()
 
         attempts_left = 5 - user.failed_attempts
+        log_audit_event(db, "login_failed", user.id, request, {"reason": "bad_password", "attempts_left": attempts_left})
         raise ValueError(f"attempt_{attempts_left}")
 
     user.failed_attempts = 0
@@ -38,9 +44,11 @@ def login_user(db: Session, email: str, password: str):
     db.commit()
     
     if not user.is_verified:
+        log_audit_event(db, "login_blocked", user.id, request, {"reason": "unverified_email"})
         raise ValueError("unverified")
 
     token = create_access_token({"user_id": user.id})
+    log_audit_event(db, "login_success", user.id, request, {"provider": "local"})
     return token
 
 def request_password_reset(db: Session, email: str) -> str | None:
@@ -58,7 +66,7 @@ def request_password_reset(db: Session, email: str) -> str | None:
 
     return raw_token
 
-def confirm_password_reset(db: Session, token: str, new_password: str) -> bool:
+def confirm_password_reset(db: Session, token: str, new_password: str, request: Request) -> bool:
     active_reset_users = db.query(User).filter(User.reset_token_hash.isnot(None)).all()
 
     target_user = None
@@ -79,6 +87,7 @@ def confirm_password_reset(db: Session, token: str, new_password: str) -> bool:
 
     db.commit()
 
+    log_audit_event(db, "password_reset", target_user.id, request)
     return True
 
 def confirm_email_verification(db: Session, token: str) -> bool: