Add activity logging for authentication events

Author: DaneEveritt

app/Events/Auth/ProvidedAuthenticationToken.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Pterodactyl\Events\Auth;
+
+use Pterodactyl\Models\User;
+
+class ProvidedAuthenticationToken
+{
+    public User $user;
+
+    public bool $recovery;
+
+    public function __construct(User $user, bool $recovery = false)
+    {
+        $this->user = $user;
+        $this->recovery = $recovery;
+    }
+}

app/Extensions/Illuminate/Events/Contracts/SubscribesToEvents.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Pterodactyl\Extensions\Illuminate\Events\Contracts;
+
+use Illuminate\Contracts\Events\Dispatcher;
+
+interface SubscribesToEvents
+{
+    public function subscribe(Dispatcher $events): void;
+}

app/Facades/Activity.php

@@ -9,11 +9,14 @@
 /**
  * @method static ActivityLogService anonymous()
  * @method static ActivityLogService event(string $action)
- * @method static ActivityLogService withDescription(?string $description)
- * @method static ActivityLogService withSubject(Model $subject)
- * @method static ActivityLogService withActor(Model $actor)
+ * @method static ActivityLogService description(?string $description)
+ * @method static ActivityLogService subject(Model $subject)
+ * @method static ActivityLogService actor(Model $actor)
  * @method static ActivityLogService withProperties(\Illuminate\Support\Collection|array $properties)
- * @method static ActivityLogService withProperty(string $key, mixed $value)
+ * @method static ActivityLogService withRequestMetadata()
+ * @method static ActivityLogService property(string $key, mixed $value)
+ * @method static \Pterodactyl\Models\ActivityLog log(string $description = null)
+ * @method static ActivityLogService clone()
  * @method static mixed transaction(\Closure $callback)
  */
 class Activity extends Facade

app/Http/Controllers/Auth/LoginCheckpointController.php

@@ -7,8 +7,10 @@
 use Pterodactyl\Models\User;
 use Illuminate\Http\JsonResponse;
 use PragmaRX\Google2FA\Google2FA;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Contracts\Encryption\Encrypter;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Pterodactyl\Events\Auth\ProvidedAuthenticationToken;
 use Pterodactyl\Http\Requests\Auth\LoginCheckpointRequest;
 use Illuminate\Contracts\Validation\Factory as ValidationFactory;
 
@@ -72,12 +74,16 @@ public function __invoke(LoginCheckpointRequest $request): JsonResponse
         // Recovery tokens go through a slightly different pathway for usage.
         if (!is_null($recoveryToken = $request->input('recovery_token'))) {
             if ($this->isValidRecoveryToken($user, $recoveryToken)) {
+                Event::dispatch(new ProvidedAuthenticationToken($user, true));
+
                 return $this->sendLoginResponse($user, $request);
             }
         } else {
             $decrypted = $this->encrypter->decrypt($user->totp_secret);
 
             if ($this->google2FA->verifyKey($decrypted, (string) $request->input('authentication_code') ?? '', config('pterodactyl.auth.2fa.window'))) {
+                Event::dispatch(new ProvidedAuthenticationToken($user));
+
                 return $this->sendLoginResponse($user, $request);
             }
         }

app/Http/Controllers/Auth/LoginController.php

@@ -7,6 +7,7 @@
 use Illuminate\Http\Request;
 use Pterodactyl\Models\User;
 use Illuminate\Http\JsonResponse;
+use Pterodactyl\Facades\Activity;
 use Illuminate\Contracts\View\View;
 use Illuminate\Contracts\View\Factory as ViewFactory;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
@@ -71,6 +72,8 @@ public function login(Request $request): JsonResponse
             return $this->sendLoginResponse($user, $request);
         }
 
+        Activity::event('login.checkpoint')->withRequestMetadata()->subject($user)->log();
+
         $request->session()->put('auth_confirmation_token', [
             'user_id' => $user->id,
             'token_value' => $token = Str::random(64),

app/Listeners/Auth/AuthenticationListener.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Pterodactyl\Listeners\Auth;
+
+use Pterodactyl\Facades\Activity;
+use Illuminate\Auth\Events\Login;
+use Illuminate\Auth\Events\Failed;
+use Illuminate\Contracts\Events\Dispatcher;
+use Pterodactyl\Extensions\Illuminate\Events\Contracts\SubscribesToEvents;
+
+class AuthenticationListener implements SubscribesToEvents
+{
+    /**
+     * Handles an authentication event by logging the user and information about
+     * the request.
+     *
+     * @param \Illuminate\Auth\Events\Login|\Illuminate\Auth\Events\Failed $event
+     */
+    public function handle($event): void
+    {
+        $activity = Activity::withRequestMetadata();
+        if ($event->user) {
+            $activity = $activity->subject($event->user);
+        }
+
+        if ($event instanceof Failed) {
+            foreach ($event->credentials as $key => $value) {
+                $activity = $activity->property($key, $value);
+            }
+        }
+
+        $activity->event($event instanceof Failed ? 'login.failed' : 'login.success')->log();
+    }
+
+    public function subscribe(Dispatcher $events): void
+    {
+        $events->listen(Failed::class, self::class);
+        $events->listen(Login::class, self::class);
+    }
+}

app/Listeners/Auth/PasswordResetListener.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Pterodactyl\Listeners\Auth;
+
+use Illuminate\Http\Request;
+use Pterodactyl\Facades\Activity;
+use Illuminate\Auth\Events\PasswordReset;
+
+class PasswordResetListener
+{
+    protected Request $request;
+
+    public function __construct(Request $request)
+    {
+        $this->request = $request;
+    }
+
+    public function handle(PasswordReset $event)
+    {
+        Activity::event('login.password-reset')
+            ->withRequestMetadata()
+            ->subject($event->user)
+            ->log();
+    }
+}

app/Listeners/Auth/TwoFactorListener.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Pterodactyl\Listeners\Auth;
+
+use Pterodactyl\Facades\Activity;
+use Pterodactyl\Events\Auth\ProvidedAuthenticationToken;
+
+class TwoFactorListener
+{
+    public function handle(ProvidedAuthenticationToken $event)
+    {
+        Activity::event($event->recovery ? 'login.recovery-token' : 'login.token')
+            ->withRequestMetadata()
+            ->subject($event->user)
+            ->log();
+    }
+}

app/Models/User.php

@@ -3,6 +3,7 @@
 namespace Pterodactyl\Models;
 
 use Pterodactyl\Rules\Username;
+use Pterodactyl\Facades\Activity;
 use Illuminate\Support\Collection;
 use Illuminate\Validation\Rules\In;
 use Illuminate\Auth\Authenticatable;
@@ -214,6 +215,11 @@ public function toVueObject(): array
      */
     public function sendPasswordResetNotification($token)
     {
+        Activity::event('login.reset-password')
+            ->withRequestMetadata()
+            ->subject($this)
+            ->log('sending password reset email');
+
         $this->notify(new ResetPasswordNotification($token));
     }
 

app/Providers/EventServiceProvider.php

@@ -10,6 +10,7 @@
 use Pterodactyl\Observers\ServerObserver;
 use Pterodactyl\Observers\SubuserObserver;
 use Pterodactyl\Observers\EggVariableObserver;
+use Pterodactyl\Listeners\Auth\AuthenticationListener;
 use Pterodactyl\Events\Server\Installed as ServerInstalledEvent;
 use Pterodactyl\Notifications\ServerInstalled as ServerInstalledNotification;
 use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
@@ -22,9 +23,11 @@ class EventServiceProvider extends ServiceProvider
      * @var array
      */
     protected $listen = [
-        ServerInstalledEvent::class => [
-            ServerInstalledNotification::class,
-        ],
+        ServerInstalledEvent::class => [ServerInstalledNotification::class],
+    ];
+
+    protected $subscribe = [
+        AuthenticationListener::class,
     ];
 
     /**
@@ -39,4 +42,9 @@ public function boot()
         Subuser::observe(SubuserObserver::class);
         EggVariable::observe(EggVariableObserver::class);
     }
+
+    public function shouldDiscoverEvents()
+    {
+        return true;
+    }
 }