feat(obs): journaliser les evenements d'authentification

OBS-001. logging_config.py configurait un fichier auth.log avec rotation,
un logger nomme 'team_tryouts.auth' et un filtre de redaction. Mais
get_auth_logger n'etait importe nulle part : le fichier etait cree et
restait vide. Aucune connexion, aucun echec, aucun verrouillage, aucun
changement de role, aucune suppression de compte ne laissait de trace.
En cas de suspicion de compromission, il n'y avait rien a consulter.

Ajout de log_auth_event(event, **fields), qui emet des paires cle=valeur
ordonnees -- greppable sans dependance de journalisation JSON.

Evenements couverts
  authentification  login.success, login.failure,
                    login.failure.unknown_user, login.rejected.locked,
                    login.rejected.deactivated, account.locked, logout,
                    account.registered
  administration    account.created_by_admin, account.updated,
                    account.role_changed (avec ancien et nouveau role),
                    account.deleted, account.password_reset_by_admin
  libre-service     account.password_changed

Le champ ip vient de request.remote_addr, donc de X-Forwarded-For. Tant que
Waitress tourne avec trusted_proxy='*' (SEC-WEB-002), cette valeur est
choisie par l'appelant : c'est une indication, pas une preuve. Le point est
documente dans la docstring.

Un test a fait remonter ARCH-003, jusqu'ici classe comme fragilite latente
  Journaliser en fin de edit_user levait DetachedInstanceError : le
  changement de role appelle db.session.remove() en plein cycle de requete,
  ce qui detache current_user de la session. Le code s'en tirait parce qu'il
  redirigeait immediatement sans plus y toucher. L'identite de l'acteur est
  desormais capturee en debut de traitement. Le constat est donc confirme
  comme reel, et non plus seulement probable -- sa correction de fond reste
  au programme.

15 tests, dont 4 sur le filtre de redaction lui-meme : c'est un controle de
securite, il doit etre verifie.

Co-Authored-By: Claude Opus 5 <[email protected]>

app/logging_config.py

@@ -172,8 +172,40 @@ def configure_logging(app):
 # Module-level auth logger factory
 def get_auth_logger():
     """Get the authentication event logger.
-    
+
     Returns:
         logging.Logger: Logger for authentication events.
     """
-    return logging.getLogger('team_tryouts.auth')
+    return logging.getLogger('team_tryouts.auth')
+
+
+def log_auth_event(event, **fields):
+    """Record a security-relevant event to auth.log.
+
+    The handler, its rotation and its redaction filter were configured from
+    the start, but get_auth_logger was never imported anywhere: auth.log was
+    created and stayed empty. No login, failure, lockout, role change or
+    account deletion left any trace.
+
+    Fields are emitted as `key=value` pairs, ordered, so the file stays
+    greppable without pulling in a JSON logging dependency.
+
+    Note on `ip`: it is taken from request.remote_addr, which reflects
+    X-Forwarded-For. As long as Waitress runs with trusted_proxy='*'
+    (SEC-WEB-002), that value is attacker-controlled and must be read as an
+    indication rather than as evidence.
+
+    Args:
+        event: Dotted event name, e.g. 'login.success'.
+        **fields: Additional context. Never pass a secret: values are
+            recorded verbatim apart from the redaction filter's patterns.
+    """
+    from flask import has_request_context, request
+
+    parts = ['event=%s' % event]
+    if has_request_context():
+        parts.append('ip=%s' % request.remote_addr)
+        parts.append('path=%s' % request.path)
+    parts.extend('%s=%s' % (key, value) for key, value in fields.items())
+
+    get_auth_logger().info(' '.join(parts))

app/routes/users.py

@@ -24,6 +24,7 @@ from app.validators import (
     CreateUserSchema, EditUserSchema, EditProfileSchema,
     UploadContractSchema,
 )
+from app.logging_config import log_auth_event
 import requests
 
 ALLOWED_CONTRACT_EXTENSIONS = {'pdf'}
@@ -128,6 +129,11 @@ def edit_user(user_id):
     user = User.query.get_or_404(user_id)
 
     if request.method == 'POST':
+        # Captured up front, on purpose. A role change below calls
+        # db.session.remove(), which detaches current_user from the session:
+        # any later attribute access on it raises DetachedInstanceError.
+        actor_name, actor_id = current_user.username, current_user.id
+
         def _rerender():
             return render_template('pages/edit_user.html', user=user, roles=USER_TYPES,
                                    esport_games=ESPORT_GAMES, game_platforms=GAME_PLATFORMS,
@@ -165,6 +171,10 @@ def edit_user(user_id):
         # change invalidates the identity map for this instance and anything
         # that references it via relationships.
         if user.role != role:
+            log_auth_event('account.role_changed',
+                           actor=actor_name, actor_id=actor_id,
+                           target=user.username, target_id=user.id,
+                           previous_role=user.role, new_role=role)
             user_id_local = user.id
             db.session.execute(
                 db.text("UPDATE users SET role = :role WHERE id = :id"),
@@ -190,8 +200,14 @@ def edit_user(user_id):
         password = validated.get('password')
         if password:
             user.password_hash = hash_password(password)
+            log_auth_event('account.password_reset_by_admin',
+                           actor=actor_name, actor_id=actor_id,
+                           target=user.username, target_id=user.id)
 
         db.session.commit()
+        log_auth_event('account.updated',
+                       actor=actor_name, actor_id=actor_id,
+                       target=user.username, target_id=user.id, active=is_active)
         flash(f'User {user.username} updated successfully!', 'success')
         return redirect(url_for('users.list_users'))
 
@@ -242,9 +258,13 @@ def delete_user(user_id):
     OrgTeam.query.filter_by(created_by=user_id).update({'created_by': current_user.id})
     Contract.query.filter_by(uploaded_by_id=user_id).update({'uploaded_by_id': current_user.id})
 
+    deleted_username, deleted_role = user.username, user.role
     db.session.delete(user)
     db.session.commit()
-    flash(f'User {user.username} has been removed.', 'success')
+    log_auth_event('account.deleted',
+                   actor=current_user.username, actor_id=current_user.id,
+                   target=deleted_username, target_id=user_id, role=deleted_role)
+    flash(f'User {deleted_username} has been removed.', 'success')
     return redirect(url_for('users.list_users'))
 
 
@@ -289,6 +309,9 @@ def create_user():
         )
         db.session.add(user)
         db.session.commit()
+        log_auth_event('account.created_by_admin',
+                       actor=current_user.username, actor_id=current_user.id,
+                       target=user.username, target_id=user.id, role=role)
         flash(f'User {full_name} created as {role}!', 'success')
         return redirect(url_for('users.list_users'))
 
@@ -373,6 +396,8 @@ def edit_profile():
         password = validated.get('password')
         if password:
             current_user.password_hash = hash_password(password)
+            log_auth_event('account.password_changed',
+                           username=current_user.username, user_id=current_user.id)
 
         db.session.commit()
         flash('Profile updated successfully!', 'success')