Kevin Adametz
d884eb7482
- GlitchTip über die Sentry-SDKs; Datenschutzfilter (nur User-ID, keine
Request-Bodys, Tokens aus URL/Query/Referer, E-Mails aus Meldungen).
Browser-SDK erst beim ersten Fehler nachgeladen.
- ReportErrorSignals: tote interne Links (404 mit eigenem Referrer), 403/429
für Angemeldete, 419 als gedrosselte Warnung.
- /health (Bearer-Token): DB, Cache, Queue-Rückstau, Scheduler-Herzschlag,
Plattenplatz → 200/503; Scheduler und Plattenplatz auch im Systemstatus.
- OperationalAlert zusätzlich per ntfy (JSON-POST), unabhängig von der Mail.
- Verlauf: login_failed (Grund unbekannt/kein Passwort/falsch),
login_lockout, two_factor_failed; IP nur als gekürzter HMAC.
- Umami: Kundenbereich mit eigenem Schalter und identify('user-<id>'),
nie im Admin/bei Impersonation; Query-Filter auch auf den Webseiten
(signierte Links gingen bisher an Umami).
- queue:prune-failed nach 30 Tagen.
- Versionsnummer: config('app.version') aus APP_VERSION oder Datei RELEASE
(git describe --tags), in GlitchTip, /health, Systemstatus, artisan about.
Plan: dev/betrieb/monitoring-plan.md (Entscheidungen M1–M9).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.9 KiB
PHP
76 lines
2.9 KiB
PHP
<?php
|
|
|
|
use App\Enums\ActivityType;
|
|
use App\Models\ActivityEvent;
|
|
use App\Models\User;
|
|
use Livewire\Volt\Volt;
|
|
use PragmaRX\Google2FA\Google2FA;
|
|
|
|
/**
|
|
* Gescheiterte Anmeldungen im Aktivitäts-Verlauf (Monitoring-Plan 1.7, M9):
|
|
* mit Grund und User-Bezug, ohne Passwort und ohne Klartext-IP.
|
|
*/
|
|
function failedLoginEvents(ActivityType $type)
|
|
{
|
|
return ActivityEvent::query()->where('type', $type->value)->orderBy('id')->get();
|
|
}
|
|
|
|
test('a wrong password is recorded with the account and the reason', function () {
|
|
$user = User::factory()->create(['email' => 'kunde@example.com']);
|
|
|
|
Volt::test('auth.login')
|
|
->set('email', 'kunde@example.com')
|
|
->set('password', 'falsches-passwort')
|
|
->call('login')
|
|
->assertHasErrors('email');
|
|
|
|
$event = failedLoginEvents(ActivityType::LoginFailed)->sole();
|
|
|
|
expect($event->user_id)->toBe($user->id)
|
|
->and($event->meta['reason'])->toBe('wrong_password')
|
|
->and($event->meta['ip_hash'])->toHaveLength(12)
|
|
->and($event->description)->toContain('falsches Passwort')
|
|
->and(json_encode($event->toArray()))->not->toContain('falsches-passwort')
|
|
->and(json_encode($event->toArray()))->not->toContain('127.0.0.1');
|
|
});
|
|
|
|
test('an account without password is told apart from an unknown address', function () {
|
|
User::factory()->create(['email' => 'legacy@example.com', 'password' => null]);
|
|
|
|
foreach (['legacy@example.com', 'niemand@example.com'] as $email) {
|
|
Volt::test('auth.login')->set('email', $email)->set('password', 'irgendwas')->call('login');
|
|
}
|
|
|
|
$events = failedLoginEvents(ActivityType::LoginFailed);
|
|
|
|
expect($events->pluck('meta.reason')->all())->toBe(['no_password', 'unknown_account'])
|
|
->and($events[1]->user_id)->toBeNull()
|
|
->and($events[1]->description)->not->toContain('niemand@example.com');
|
|
});
|
|
|
|
test('a lockout is recorded for the targeted account', function () {
|
|
$user = User::factory()->create(['email' => 'kunde@example.com']);
|
|
|
|
foreach (range(1, 6) as $attempt) {
|
|
Volt::test('auth.login')->set('email', 'kunde@example.com')->set('password', 'falsch')->call('login');
|
|
}
|
|
|
|
$lockout = failedLoginEvents(ActivityType::LoginLockout)->sole();
|
|
|
|
expect($lockout->user_id)->toBe($user->id)
|
|
->and($lockout->description)->toContain('gesperrt')
|
|
->and(failedLoginEvents(ActivityType::LoginFailed))->toHaveCount(5);
|
|
});
|
|
|
|
test('a wrong two-factor code is recorded', function () {
|
|
$user = User::factory()->create(['is_active' => true]);
|
|
$user->forceFill([
|
|
'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
|
|
'two_factor_confirmed_at' => now(),
|
|
])->save();
|
|
|
|
$this->withSession(['login.id' => $user->id, 'login.remember' => false])
|
|
->post('/two-factor-challenge', ['code' => '000000']);
|
|
|
|
expect(failedLoginEvents(ActivityType::TwoFactorFailed)->sole()->user_id)->toBe($user->id);
|
|
});
|