feat: record client type in session audit events

Author: sricharan-varanasi

src/apps/audit/domain.py

@@ -39,6 +39,7 @@ class AuditEvent(PublicModel):
 
     Applicable to HTTP requests:
     - client_ip
+    - client_source
     - http_request_id
     - http_request_method,
     - http_response_status_code
@@ -92,6 +93,7 @@ class AuditEvent(PublicModel):
 
     # For HTTP requests
     client_ip: Annotated[str | None, Field(alias="client.ip")] = None
+    client_source: Annotated[str | None, Field(alias="client.source")] = None  # Mindlogger-Content-Source header
     http_request_id: Annotated[str | None, Field(alias="http.request.id")] = None  # from asgi-correlation-id
     http_request_method: Annotated[str | None, Field(alias="http.request.method")] = None
     http_response_status_code: Annotated[int | None, Field(alias="http.response.status_code")] = None

src/apps/audit/fields.py

@@ -15,6 +15,7 @@ def http_audit_fields(request: Request, error: BaseError | StarletteHTTPExceptio
     span = tracer.current_span()
     fields = {
         "client_ip": request.client and request.client.host,
+        "client_source": request.headers.get("mindlogger-content-source"),
         "http_request_id": correlation_id.get(),
         "http_request_method": request.method,
         "http_response_status_code": isinstance(route, APIRoute) and route.status_code or 200,

src/apps/authentication/tests/test_auth.py

@@ -446,6 +446,47 @@ async def test_login_embeds_client_claim(self, client: TestClient, user: User, c
         assert refresh_payload["client"] == content_source
         self._assert_lifetimes_unchanged(access_payload, refresh_payload, before, after)
 
+    async def test_login_audit_event_records_client_source(self, client: TestClient, user: User, mocker: MockerFixture):
+        audit_log = mocker.patch("apps.authentication.api.auth.log")
+        resp = await client.post(
+            self.get_token_url,
+            data={"email": user.email_encrypted, "password": TEST_PASSWORD},
+            headers={"Mindlogger-Content-Source": "admin"},
+        )
+        assert resp.status_code == http.HTTPStatus.OK
+        event = audit_log.call_args[0][0]
+        assert event.client_source == "admin"
+
+    async def test_login_audit_event_without_client_source(self, client: TestClient, user: User, mocker: MockerFixture):
+        audit_log = mocker.patch("apps.authentication.api.auth.log")
+        resp = await client.post(
+            self.get_token_url,
+            data={"email": user.email_encrypted, "password": TEST_PASSWORD},
+        )
+        assert resp.status_code == http.HTTPStatus.OK
+        event = audit_log.call_args[0][0]
+        assert event.client_source is None
+
+    async def test_refresh_audit_event_records_client_source(
+        self, client: TestClient, user: User, mocker: MockerFixture
+    ):
+        audit_log = mocker.patch("apps.authentication.api.auth.log")
+        refresh_token = AuthenticationService.create_refresh_token(
+            {
+                "sub": str(user.id),
+                "jti": str(uuid.uuid4()),
+                "client": "web",
+            }
+        )
+        resp = await client.post(
+            auth_router.url_path_for("refresh_access_token"),
+            data={"refresh_token": refresh_token},
+            headers={"Mindlogger-Content-Source": "web"},
+        )
+        assert resp.status_code == http.HTTPStatus.OK
+        event = audit_log.call_args[0][0]
+        assert event.client_source == "web"
+
     @pytest.mark.parametrize(
         "headers",
         (None, {"Mindlogger-Content-Source": "invalid-content-source"}),