feat: log when attempted password resets fail (coder#15267)

DanielleMaywood · mafredri · web-flow · commit 78ff375fed9a · 2024-10-29T12:19:56.000Z
Closes coder#15154 Log when someone attempts to either - Request a one-time passcode for an account that doesn't exist - Attempt to change a password with an invalid one-time passcode and/or email --------- Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -291,6 +291,8 @@ func (api *API) postRequestOneTimePasscode(rw http.ResponseWriter, r *http.Reque
 		if err != nil {
 			logger.Error(ctx, "unable to notify user about one-time passcode request", slog.Error(err))
 		}
+	} else {
+		logger.Warn(ctx, "password reset requested for account that does not exist", slog.F("email", req.Email))
 	}
 }
 
@@ -381,6 +383,7 @@ func (api *API) postChangePasswordWithOneTimePasscode(rw http.ResponseWriter, r
 
 		now := dbtime.Now()
 		if !equal || now.After(user.OneTimePasscodeExpiresAt.Time) {
+			logger.Warn(ctx, "password reset attempted with invalid or expired one-time passcode", slog.F("email", req.Email))
 			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 				Message: "Incorrect email or one-time passcode.",
 			})

Original file line number	Diff line number	Diff line change
`@@ -291,6 +291,8 @@ func (api API) postRequestOneTimePasscode(rw http.ResponseWriter, r http.Reque`
`291`	`291`	`if err != nil {`
`292`	`292`	`logger.Error(ctx, "unable to notify user about one-time passcode request", slog.Error(err))`
`293`	`293`	`}`
	`294`	`+ } else {`
	`295`	`+ logger.Warn(ctx, "password reset requested for account that does not exist", slog.F("email", req.Email))`
`294`	`296`	`}`
`295`	`297`	`}`
`296`	`298`
`@@ -381,6 +383,7 @@ func (api *API) postChangePasswordWithOneTimePasscode(rw http.ResponseWriter, r`
`381`	`383`
`382`	`384`	`now := dbtime.Now()`
`383`	`385`	`if !equal \|\| now.After(user.OneTimePasscodeExpiresAt.Time) {`
	`386`	`+ logger.Warn(ctx, "password reset attempted with invalid or expired one-time passcode", slog.F("email", req.Email))`
`384`	`387`	`httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{`
`385`	`388`	`Message: "Incorrect email or one-time passcode.",`
`386`	`389`	`})`