Feature | Two-Factor Audit Service#134
Conversation
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
📘 OpenAPI / Swagger preview ➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-134/ This page is automatically updated on each push to this PR. |
matiasperrone-exo
force-pushed
the
feat/two-factor-audit-service---cu-86ba2z5gz
branch
from
fad9611 to
ae4e42f
Compare
|
📘 OpenAPI / Swagger preview ➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-134/ This page is automatically updated on each push to this PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/Services/Auth/TwoFactorAuditService.php`:
- Around line 38-43: The Log::debug call in TwoFactorAuditService::log currently
emits raw 'user_id' and 'ip_address'; change it to avoid storing PII by removing
those fields or replacing them with a deterministic, non-reversible token (e.g.,
an HMAC/sha256 or other app-key-based hash) so you can still correlate events
without exposing raw identifiers; update the Log::debug invocation in the
TwoFactorAuditService::log method to keep 'event_type' and 'method' but
redact/hash 'user_id' and 'ip_address' (use the app key or a configured secret
to compute the hash).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fe8fe81e-6db5-47e3-a320-1fbaac8283d6
📒 Files selected for processing (5)
app/Services/Auth/ITwoFactorAuditService.phpapp/Services/Auth/TwoFactorAuditService.phpapp/Services/Auth/TwoFactorServiceProvider.phpphpunit.xmltests/Unit/TwoFactorAuditServiceTest.php
| Log::debug('TwoFactorAuditService::log', [ | ||
| 'user_id' => $user->getId(), | ||
| 'event_type' => $eventType, | ||
| 'method' => $method, | ||
| 'ip_address' => $ipAddress, | ||
| ]); |
There was a problem hiding this comment.
Avoid logging raw user identifiers in debug audit traces.
Line 38 currently logs user_id and ip_address directly. That increases privacy/compliance risk in log storage without being required for core behavior. Prefer removing these fields or redacting/hashing them before logging.
Suggested minimal change
- Log::debug('TwoFactorAuditService::log', [
- 'user_id' => $user->getId(),
- 'event_type' => $eventType,
- 'method' => $method,
- 'ip_address' => $ipAddress,
- ]);
+ Log::debug('TwoFactorAuditService::log', [
+ 'event_type' => $eventType,
+ 'method' => $method,
+ ]);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Log::debug('TwoFactorAuditService::log', [ | |
| 'user_id' => $user->getId(), | |
| 'event_type' => $eventType, | |
| 'method' => $method, | |
| 'ip_address' => $ipAddress, | |
| ]); | |
| Log::debug('TwoFactorAuditService::log', [ | |
| 'event_type' => $eventType, | |
| 'method' => $method, | |
| ]); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@app/Services/Auth/TwoFactorAuditService.php` around lines 38 - 43, The
Log::debug call in TwoFactorAuditService::log currently emits raw 'user_id' and
'ip_address'; change it to avoid storing PII by removing those fields or
replacing them with a deterministic, non-reversible token (e.g., an HMAC/sha256
or other app-key-based hash) so you can still correlate events without exposing
raw identifiers; update the Log::debug invocation in the
TwoFactorAuditService::log method to keep 'event_type' and 'method' but
redact/hash 'user_id' and 'ip_address' (use the app key or a configured secret
to compute the hash).
2 participants
ref.: https://app.clickup.com/t/86ba2z5gz
Changes:
New Files
app/Services/Auth/ITwoFactorAuditService.phplog()contractapp/Services/Auth/TwoFactorAuditService.phptests/Unit/TwoFactorAuditServiceTest.phpModified Files
app/Services/Auth/TwoFactorServiceProvider.phpITwoFactorAuditService → TwoFactorAuditServiceas a singletonphpunit.xmlTwo Factor Authentication Test SuiteDesign Decisions
Single method interface —
ITwoFactorAuditService::log(User, eventType, method, ipAddress, ?metadata)keeps the contract minimal and explicit. Validation of allowed event typesand methods is delegated to
TwoFactorAuditLogentity setters (throwsInvalidArgumentExceptionon unknown values).Sync persistence — the audit log is flushed immediately (
$repository->add($log, true)) to guarantee the record lands before the request finishes, regardless of OTEL availability.OTEL is optional —
EmitAuditLogJobis only dispatched whenopentelemetry.enabledistrue, keeping the happy path free of queue overhead in environments where telemetry isdisabled.
two_factor.successderivation — onlyEventChallengeFailedmaps tofalse; every other event type (issued, succeeded, device-trusted, etc.) is treated as asuccessful/informational outcome.
OTLP Attributes Emitted
When OpenTelemetry is enabled the following structured attributes are sent under
the
two_factor.auditmessage:two_factor.event_typestringTwoFactorAuditLog::Event*constantstwo_factor.methodstringTwoFactorAuditLog::Method*constantstwo_factor.user_idinttwo_factor.ip_addressstringtwo_factor.successboolfalseonly forchallenge_failedtwo_factor.device_trustedbooltrueonly fordevice_trustedeventselasticsearch.indexstringlogs-auditby default)Tests
tests/Unit/TwoFactorAuditServiceTest.php
testLogPersistsTwoFactorAuditLogWithCorrectFieldstestLogEmitsOtlpAttributestestLogEmitsSuccessFalseForChallengeFailedtwo_factor.success = falsefor failed challengestestLogAcceptsNullMetadatatestInvalidEventTypeThrowsInvalidArgumentExceptiontestInvalidMethodThrowsInvalidArgumentExceptionRequested GOAL
Current state
No 2FA-specific audit service exists. MFA events would be inconsistently logged or only visible through generic application logs.
Target state
TwoFactorAuditService provides a centralized audit primitive that persists TwoFactorAuditLog records and emits OTLP audit attributes through the existing fntech-audit pipeline.
This ticket provides audit infrastructure only. It does not wire audit calls into controller methods, strategies, or device-trust flows. That wiring belongs to Ticket 9/10, where the real MFA flow exists.
TASKS
ACCEPTANCE CRITERIA
DEVELOPMENT NOTES
Key files:
Gotchas:
Risks:
Out of scope:
Controller wiring, strategy wiring, device-trust wiring, Elastic dashboards, audit UI, retention policy.
Summary by CodeRabbit
Release Notes
New Features
Tests