From 702d93ad61171082a8136a0cde302e7b8eceda43 Mon Sep 17 00:00:00 2001 From: Ronni Skansing Date: Thu, 4 Jun 2026 17:24:10 +0200 Subject: [PATCH] add audit log on totp disable Signed-off-by: Ronni Skansing --- backend/controller/user.go | 6 ++++-- backend/service/user.go | 7 ++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/backend/controller/user.go b/backend/controller/user.go index 9d9b18f..d224c18 100644 --- a/backend/controller/user.go +++ b/backend/controller/user.go @@ -583,7 +583,8 @@ func (c *User) Login(g *gin.Context) { return } // as the recovery code is valid, we can now disable MFA - err = c.UserService.DisableTOTP(g, &userID) + // no session exists yet during login so pass nil + err = c.UserService.DisableTOTP(g, nil, &userID) if ok := c.handleErrors(g, err); !ok { return } @@ -830,7 +831,7 @@ func (c *User) IsTOTPEnabled(g *gin.Context) { // DisableTOTP disables TOTP func (c *User) DisableTOTP(g *gin.Context) { - _, user, ok := c.handleSession(g) + session, user, ok := c.handleSession(g) if !ok { return } @@ -866,6 +867,7 @@ func (c *User) DisableTOTP(g *gin.Context) { // disable TOTP err = c.UserService.DisableTOTP( g.Request.Context(), + session, &userID, ) // handle response diff --git a/backend/service/user.go b/backend/service/user.go index 600dc90..9c818ed 100644 --- a/backend/service/user.go +++ b/backend/service/user.go @@ -791,10 +791,15 @@ func (u *User) IsTOTPEnabledByUserID( // DisableTOTP disables TOTP // without checking if the user privilige, use with consideration +// session may be nil when called during a pre session flow such as +// login with a recovery code func (u *User) DisableTOTP( ctx context.Context, + session *model.Session, userID *uuid.UUID, ) error { + ae := NewAuditEvent("User.DisableTOTP", session) + ae.Details["userId"] = userID.String() err := u.UserRepository.RemoveTOTP( ctx, userID, @@ -803,7 +808,7 @@ func (u *User) DisableTOTP( u.Logger.Errorw("failed to disable TOTP", "error", err) return err } - // TODO audit log successful TOTP disable + u.AuditLogAuthorized(ae) return nil }