Authentication Observability — Monitoring and Logging Auth Systems

// Structured auth event logging
function logAuthEvent(event, metadata) {
  const logEntry = {
    timestamp: new Date().toISOString(),
    event,
    correlationId: metadata.correlationId,
    userId: metadata.userId,
    clientId: metadata.clientId,
    ip: metadata.ip,
    userAgent: metadata.userAgent,
    success: metadata.success,
    duration: metadata.duration,
    failureReason: metadata.failureReason,
    authMethod: metadata.authMethod,
    mfaUsed: metadata.mfaUsed
  };

  logger.info('auth_event', logEntry);
  metrics.increment(`auth.${event}.${metadata.success ? 'success' : 'failure'}`);
  metrics.timing(`auth.${event}.duration`, metadata.duration);
}

// Auth metrics endpoint
app.get('/metrics/auth', async (req, res) => {
  const metrics = {
    loginRate: await prometheus.getMetric('auth_login_rate'),
    successRate: await prometheus.getMetric('auth_success_rate'),
    averageLatency: await prometheus.getMetric('auth_latency_ms'),
    activeUsers: await redis.scard('active_users'),
    failedLoginsByIP: await getTopFailedIPs(),
    mfaUsageRate: await prometheus.getMetric('auth_mfa_rate'),
    tokenRefreshRate: await prometheus.getMetric('auth_refresh_rate')
  };
  res.json(metrics);
});

// Alert on auth anomalies
async function checkAuthAnomalies() {
  const recentFailures = await redis.get('auth:failure_rate:1m');
  if (parseInt(recentFailures) > 100) {
    await alertService.sendAlert({
      severity: 'critical',
      title: 'High authentication failure rate',
      description: `${recentFailures} failures in the last minute`
    });
  }
}