06/03 Optimize app

app/routes/auth.py

@@ -12,6 +12,7 @@ from wtforms import StringField, PasswordField, BooleanField, SubmitField
 from wtforms.validators import DataRequired, Length
 from app.models.user import User
 from app.extensions import db, limiter
+from app.utils.audit import audit
 from datetime import datetime
 
 auth_bp = Blueprint('auth', __name__, url_prefix='/auth')
@@ -48,12 +49,14 @@ def login():
             login_user(user, remember=form.remember_me.data)
             user.last_login = datetime.utcnow()
             db.session.commit()
+            audit('login_success', f'user={user.username}')
             log.info('[auth] user %s logged in', user.username)
             next_page = request.args.get('next', '')
             if not next_page.startswith('/'):
                 next_page = url_for('dashboard.index')
             return redirect(next_page)
 
+        audit('login_failed', f'username={form.username.data!r}')
         log.warning('[auth] failed login attempt for username=%r ip=%s',
                     form.username.data, request.remote_addr)
         flash('Invalid username or password.', 'danger')
@@ -96,6 +99,7 @@ def totp_verify():
             login_user(user, remember=remember)
             user.last_login = datetime.utcnow()
             db.session.commit()
+            audit('login_success_2fa', f'user={user.username}')
             log.info('[auth] TOTP verified for user %s', user.username)
             return redirect(next_url)
         log.warning('[auth] invalid TOTP code for user %s ip=%s',
@@ -142,6 +146,7 @@ def totp_setup():
         user.totp_enabled = True
         db.session.commit()
         session.pop('_totp_setup_secret', None)
+        audit('totp_enabled', f'user={user.username}')
         log.info('[auth] TOTP enabled for user %s', user.username)
         flash('Two-factor authentication enabled successfully.', 'success')
         return redirect(url_for('settings.index'))
@@ -165,6 +170,7 @@ def totp_disable():
     user.totp_enabled = False
     user.totp_secret  = None
     db.session.commit()
+    audit('totp_disabled', f'user={user.username}')
     log.info('[auth] TOTP disabled for user %s', user.username)
     flash('Two-factor authentication disabled.', 'info')
     return redirect(url_for('settings.index'))