diff --git a/auth.php b/auth.php index 30fe7b0..9ff70e7 100644 --- a/auth.php +++ b/auth.php @@ -11,6 +11,7 @@ require_once __DIR__ . '/vendor/autoload.php'; require_once __DIR__ . '/JWTValidator.php'; require_once __DIR__ . '/UserRoleManager.php'; +require_once __DIR__ . '/ApplicationLogger.php'; $config = require __DIR__ . '/config.php'; $action = $_GET['action'] ?? ''; @@ -41,12 +42,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'login') { exit; } - // Register user role on first login + // Register user role on first login (auto-promotes admin_emails) $email = strtolower($result['claims']['preferred_username'] ?? $result['claims']['upn'] ?? ''); - if ($email) { - $roleManager = new UserRoleManager(); - $roleManager->getRole($email); // triggers auto-promotion for admin_emails - } + $name = $result['claims']['name'] ?? $email; + $roleManager = new UserRoleManager(); + $role = $email ? $roleManager->getRole($email) : 'user'; + + // Log every login to Activity Logs + $logger = new ApplicationLogger(); + $logger->log('user_login', ['email' => $email, 'name' => $name], [ + 'role' => $role, + 'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown' + ]); // Store the raw idToken in a secure HttpOnly cookie (24h) $cookieOptions = [ diff --git a/logs-viewer.php b/logs-viewer.php index f3beea7..a421437 100644 --- a/logs-viewer.php +++ b/logs-viewer.php @@ -98,6 +98,7 @@ require_once __DIR__ . '/header.php';