From e93abd2ab70c5a62d182aad061ec98660a90ac6e Mon Sep 17 00:00:00 2001
From: Miguel N <miguel456@spacejewel-hosting.com>
Date: Tue, 8 Sep 2020 01:31:09 +0100
Subject: [PATCH] Added logging for successful authentication attempts

---
 app/Listeners/LogAuthenticationSuccess.php | 36 ++++++++++++++++++++++
 app/Providers/EventServiceProvider.php     |  5 +++
 2 files changed, 41 insertions(+)
 create mode 100644 app/Listeners/LogAuthenticationSuccess.php

diff --git a/app/Listeners/LogAuthenticationSuccess.php b/app/Listeners/LogAuthenticationSuccess.php
new file mode 100644
index 0000000..40781d9
--- /dev/null
+++ b/app/Listeners/LogAuthenticationSuccess.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Listeners;
+
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Facades\Log;
+
+class LogAuthenticationSuccess
+{
+    /**
+     * Create the event listener.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        //
+    }
+
+    /**
+     * Handle the event.
+     *
+     * @param  object  $event
+     * @return void
+     */
+    public function handle($event)
+    {
+        Log::info('SECURITY (postauth-pre2fa): Detected successful login attempt', [
+            'accountID' => $event->user->id,
+            'sourceIP' => request()->ip(),
+            'matchesAccountLastIP' => request()->ip() == $event->user->originalIP,
+            'sourceUserAgent' => request()->userAgent(),
+        ]);
+    }
+}
diff --git a/app/Providers/EventServiceProvider.php b/app/Providers/EventServiceProvider.php
index 0f5a7d2..6ea787f 100644
--- a/app/Providers/EventServiceProvider.php
+++ b/app/Providers/EventServiceProvider.php
@@ -3,8 +3,10 @@
 namespace App\Providers;
 
 use App\Listeners\LogAuthenticationFailure;
+use App\Listeners\LogAuthenticationSuccess;
 use App\Listeners\OnUserRegistration;
 use Illuminate\Auth\Events\Failed;
+use Illuminate\Auth\Events\Login;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Auth\Listeners\SendEmailVerificationNotification;
 use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
@@ -25,6 +27,9 @@ class EventServiceProvider extends ServiceProvider
         Failed::class => [
             LogAuthenticationFailure::class
         ],
+        Login::class => [
+            LogAuthenticationSuccess::class
+        ],
         'App\Events\ApplicationApprovedEvent' => [
             'App\Listeners\PromoteUser'
         ],