diff --git a/auth.php b/auth.php
index 30fe7b0..9ff70e7 100644
--- a/auth.php
+++ b/auth.php
@@ -11,6 +11,7 @@
require_once __DIR__ . '/vendor/autoload.php';
require_once __DIR__ . '/JWTValidator.php';
require_once __DIR__ . '/UserRoleManager.php';
+require_once __DIR__ . '/ApplicationLogger.php';
$config = require __DIR__ . '/config.php';
$action = $_GET['action'] ?? '';
@@ -41,12 +42,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'login') {
exit;
}
- // Register user role on first login
+ // Register user role on first login (auto-promotes admin_emails)
$email = strtolower($result['claims']['preferred_username'] ?? $result['claims']['upn'] ?? '');
- if ($email) {
- $roleManager = new UserRoleManager();
- $roleManager->getRole($email); // triggers auto-promotion for admin_emails
- }
+ $name = $result['claims']['name'] ?? $email;
+ $roleManager = new UserRoleManager();
+ $role = $email ? $roleManager->getRole($email) : 'user';
+
+ // Log every login to Activity Logs
+ $logger = new ApplicationLogger();
+ $logger->log('user_login', ['email' => $email, 'name' => $name], [
+ 'role' => $role,
+ 'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown'
+ ]);
// Store the raw idToken in a secure HttpOnly cookie (24h)
$cookieOptions = [
diff --git a/logs-viewer.php b/logs-viewer.php
index f3beea7..a421437 100644
--- a/logs-viewer.php
+++ b/logs-viewer.php
@@ -98,6 +98,7 @@ require_once __DIR__ . '/header.php';