audit logging

app/routes/auth.py

@@ -4,6 +4,7 @@ from fastapi import APIRouter, Form, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
 
 from app.auth import authenticate_user, current_user
+from app.db.audit import log_audit_event
 from app.templates.layout import page
 
 router = APIRouter()
@@ -26,12 +27,27 @@ def login(request: Request, username: str = Form(...), password: str = Form(...)
 
     request.session.clear()
     request.session["user_id"] = user["id"]
+    log_audit_event(
+        user,
+        action="login_success",
+        target_type="user",
+        target_id=user.get("id"),
+        metadata={"username": user.get("username")},
+    )
 
     return RedirectResponse(url="/portal", status_code=303)
 
 
 @router.post("/logout")
 def logout(request: Request):
+    user = current_user(request)
+    log_audit_event(
+        user,
+        action="logout",
+        target_type="user",
+        target_id=user.get("id") if user else None,
+        metadata={"username": user.get("username")} if user else {},
+    )
     request.session.clear()
     return RedirectResponse(url="/portal/login", status_code=303)