Skip to content

Commit a85c422

Browse files
committed
feat: you can configure whether to record login attempts
The default is record only failure login attempts.
1 parent 235462b commit a85c422

File tree

4 files changed

+44
-17
lines changed

4 files changed

+44
-17
lines changed

src/Authentication/Authenticators/JWT.php

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use CodeIgniter\Shield\Authentication\AuthenticatorInterface;
1111
use CodeIgniter\Shield\Authentication\Authenticators\JWT\FirebaseAdapter;
1212
use CodeIgniter\Shield\Authentication\Authenticators\JWT\JWTAdapterInterface;
13+
use CodeIgniter\Shield\Config\Auth;
1314
use CodeIgniter\Shield\Config\AuthJWT;
1415
use CodeIgniter\Shield\Entities\User;
1516
use CodeIgniter\Shield\Exceptions\RuntimeException;
@@ -56,6 +57,9 @@ public function __construct(UserModel $provider, ?JWTAdapterInterface $jwtAdapte
5657
*/
5758
public function attempt(array $credentials): Result
5859
{
60+
/** @var AuthJWT $config */
61+
$config = config('AuthJWT');
62+
5963
/** @var IncomingRequest $request */
6064
$request = service('request');
6165

@@ -65,14 +69,16 @@ public function attempt(array $credentials): Result
6569
$result = $this->check($credentials);
6670

6771
if (! $result->isOK()) {
68-
// Always record a login attempt, whether success or not.
69-
$this->tokenLoginModel->recordLoginAttempt(
70-
self::ID_TYPE_JWT,
71-
$credentials['token'] ?? '',
72-
false,
73-
$ipAddress,
74-
$userAgent
75-
);
72+
if ($config->recordLoginAttempt >= Auth::RECORD_LOGIN_ATTEMPT_FAILURE) {
73+
// Record a failed login attempt.
74+
$this->tokenLoginModel->recordLoginAttempt(
75+
self::ID_TYPE_JWT,
76+
$credentials['token'] ?? '',
77+
false,
78+
$ipAddress,
79+
$userAgent
80+
);
81+
}
7682

7783
return $result;
7884
}
@@ -81,14 +87,17 @@ public function attempt(array $credentials): Result
8187

8288
$this->login($user);
8389

84-
$this->tokenLoginModel->recordLoginAttempt(
85-
self::ID_TYPE_JWT,
86-
$credentials['token'] ?? '',
87-
true,
88-
$ipAddress,
89-
$userAgent,
90-
$this->user->id
91-
);
90+
if ($config->recordLoginAttempt === Auth::RECORD_LOGIN_ATTEMPT_ALL) {
91+
// Record a successful login attempt.
92+
$this->tokenLoginModel->recordLoginAttempt(
93+
self::ID_TYPE_JWT,
94+
$credentials['token'] ?? '',
95+
true,
96+
$ipAddress,
97+
$userAgent,
98+
$this->user->id
99+
);
100+
}
92101

93102
return $result;
94103
}

src/Config/Auth.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@
1515

1616
class Auth extends BaseConfig
1717
{
18+
public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
19+
public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
20+
public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts
21+
1822
/**
1923
* ////////////////////////////////////////////////////////////////////
2024
* AUTHENTICATION

src/Config/AuthJWT.php

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
namespace CodeIgniter\Shield\Config;
66

77
use CodeIgniter\Config\BaseConfig;
8-
use CodeIgniter\Shield\Authentication\Authenticators\JWT;
98

109
/**
1110
* JWT Authenticator Configuration
@@ -38,4 +37,14 @@ class AuthJWT extends BaseConfig
3837
* Specifies the amount of time, in seconds, that a token is valid.
3938
*/
4039
public int $timeToLive = HOUR;
40+
41+
/**
42+
* Whether login attempts are recorded in the database.
43+
*
44+
* Valid values are:
45+
* - Auth::RECORD_LOGIN_ATTEMPT_NONE
46+
* - Auth::RECORD_LOGIN_ATTEMPT_FAILURE
47+
* - Auth::RECORD_LOGIN_ATTEMPT_ALL
48+
*/
49+
public int $recordLoginAttempt = Auth::RECORD_LOGIN_ATTEMPT_FAILURE;
4150
}

tests/Authentication/Authenticators/JWTAuthenticatorTest.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,11 @@ public function testAttemptBadSignatureToken(): void
197197

198198
public function testAttemptSuccess(): void
199199
{
200+
// Change $recordLoginAttempt in Config.
201+
/** @var AuthJWT $config */
202+
$config = config('AuthJWT');
203+
$config->recordLoginAttempt = Auth::RECORD_LOGIN_ATTEMPT_ALL;
204+
200205
$token = $this->generateJWT();
201206

202207
$result = $this->auth->attempt([

0 commit comments

Comments
 (0)