[IMP] base, auth_totp: log user in case of failed login

When a login attempt is ignored, we add the user info for a better
understanding on the attack (brute force, credentials stuffing...).

closes odoo/odoo#91588

X-original-commit: 0f69448202244e808e1122a618be701806d606cf
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>

addons/auth_totp/controllers/home.py

@@ -37,7 +37,7 @@ class Home(web_home.Home):
 
         elif user and request.httprequest.method == 'POST' and kwargs.get('totp_token'):
             try:
-                with user._assert_can_auth():
+                with user._assert_can_auth(user=user.id):
                     user._totp_check(int(re.sub(r'\s', '', kwargs['totp_token'])))
             except AccessDenied as e:
                 error = str(e)

odoo/addons/base/models/res_users.py

@@ -702,7 +702,7 @@ class Users(models.Model):
         try:
             with cls.pool.cursor() as cr:
                 self = api.Environment(cr, SUPERUSER_ID, {})[cls._name]
-                with self._assert_can_auth():
+                with self._assert_can_auth(user=login):
                     user = self.search(self._get_login_domain(login), order=self._get_login_order(), limit=1)
                     if not user:
                         raise AccessDenied()
@@ -759,7 +759,7 @@ class Users(models.Model):
 
         with contextlib.closing(cls.pool.cursor()) as cr:
             self = api.Environment(cr, uid, {})[cls._name]
-            with self._assert_can_auth():
+            with self._assert_can_auth(user=uid):
                 if not self.env.user.active:
                     raise AccessDenied()
                 self._check_credentials(passwd, {'interactive': False})
@@ -954,7 +954,7 @@ class Users(models.Model):
         )
 
     @contextlib.contextmanager
-    def _assert_can_auth(self):
+    def _assert_can_auth(self, user=None):
         """ Checks that the current environment even allows the current auth
         request to happen.
 
@@ -963,6 +963,8 @@ class Users(models.Model):
         cooldown. During the cooldown period, login *attempts* are ignored
         and logged.
 
+        :param user: user id or login, for logging purpose
+
         .. warning::
 
             The login counter is not shared between workers and not
@@ -993,13 +995,13 @@ class Users(models.Model):
         (failures, previous) = failures_map[source]
         if self._on_login_cooldown(failures, previous):
             _logger.warning(
-                "Login attempt ignored for %s on %s: "
+                "Login attempt ignored for %s (user %r) on %s: "
                 "%d failures since last success, last failure at %s. "
                 "You can configure the number of login failures before a "
                 "user is put on cooldown as well as the duration in the "
                 "System Parameters. Disable this feature by setting "
                 "\"base.login_cooldown_after\" to 0.",
-                source, self.env.cr.dbname, failures, previous)
+                source, user or "?", self.env.cr.dbname, failures, previous)
             if ipaddress.ip_address(source).is_private:
                 _logger.warning(
                     "The rate-limited IP address %s is classified as private "