passing the correct user id

Kira-Pilot · Kira-Pilot · commit 4c754d3aeea3 · 2023-02-01T20:14:24.000Z
diff --git a/coderd/audit/request.go b/coderd/audit/request.go
@@ -29,8 +29,9 @@ type RequestParams struct {
 type Request[T Auditable] struct {
 	params *RequestParams
 
-	Old T
-	New T
+	Old    T
+	New    T
+	UserId uuid.UUID
 }
 
 type BuildAuditParams[T Auditable] struct {
@@ -89,7 +90,6 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 	case database.AuditableGroup:
 		return typed.Group.ID
 	case database.APIKey:
-		// this doesn't seem right
 		return typed.UserID
 	default:
 		panic(fmt.Sprintf("unknown resource %T", tgt))
@@ -158,11 +158,19 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 			p.AdditionalFields = json.RawMessage("{}")
 		}
 
+		var userID uuid.UUID
+		key, ok := httpmw.APIKeyOptional(p.Request)
+		if ok {
+			userID = key.UserID
+		} else {
+			userID = req.UserId
+		}
+
 		ip := parseIP(p.Request.RemoteAddr)
 		auditLog := database.AuditLog{
 			ID:               uuid.New(),
 			Time:             database.Now(),
-			UserID:           uuid.Nil,
+			UserID:           userID,
 			Ip:               ip,
 			UserAgent:        sql.NullString{String: p.Request.UserAgent(), Valid: true},
 			ResourceType:     either(req.Old, req.New, ResourceType[T]),
diff --git a/coderd/users.go b/coderd/users.go
@@ -1005,11 +1005,15 @@ func (api *API) postLogin(rw http.ResponseWriter, r *http.Request) {
 			Action:  database.AuditActionLogin,
 		})
 	)
+	aReq.Old = database.APIKey{}
 
 	defer commitAudit()
 
 	var loginWithPassword codersdk.LoginWithPasswordRequest
 	if !httpapi.Read(ctx, rw, r, &loginWithPassword) {
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
@@ -1020,15 +1024,23 @@ func (api *API) postLogin(rw http.ResponseWriter, r *http.Request) {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error.",
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
+	aReq.UserId = user.ID
+
 	// If the user doesn't exist, it will be a default struct.
 	equal, err := userpassword.Compare(string(user.HashedPassword), loginWithPassword.Password)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error.",
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 	if !equal {
@@ -1037,13 +1049,19 @@ func (api *API) postLogin(rw http.ResponseWriter, r *http.Request) {
 		httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
 			Message: "Incorrect email or password.",
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
 	if user.LoginType != database.LoginTypePassword {
 		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 			Message: fmt.Sprintf("Incorrect login type, attempting to use %q but user is of login type %q", database.LoginTypePassword, user.LoginType),
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
@@ -1052,6 +1070,9 @@ func (api *API) postLogin(rw http.ResponseWriter, r *http.Request) {
 		httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
 			Message: "Your account is suspended. Contact an admin to reactivate your account.",
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
@@ -1065,10 +1086,12 @@ func (api *API) postLogin(rw http.ResponseWriter, r *http.Request) {
 			Message: "Failed to create API key.",
 			Detail:  err.Error(),
 		})
+		// We pass a disposable user ID just to force an audit diff
+		// and generate a log for a failed login
+		aReq.New = database.APIKey{UserID: uuid.New()}
 		return
 	}
 
-	// key := httpmw.APIKey(r)
 	aReq.New = *key
 
 	http.SetCookie(rw, cookie)
