From ea4af90a9e05bc340b56033ddeac1a71711987bc Mon Sep 17 00:00:00 2001
From: crahn <5043504+crahn@users.noreply.github.com>
Date: Tue, 25 Aug 2026 14:22:19 -0500
Subject: [PATCH] Log IP/username on two-factor email-login credential failures

The three "Username or password is incorrect" errors in
send_email_login() (email.rs) don't log the client IP or submitted
identifier, unlike the equivalent wrong-password error in
password_login() (identity.rs), which logs both via
format!("IP: {}. Username: {username}.", ip.ip).

This makes the two code paths inconsistent for the same underlying
error, and means log-based tooling that keys on the identity.rs
error's "IP: x.x.x.x" pattern can't do the same for this endpoint.
Bring email.rs's three call sites in line with identity.rs's existing
format. The two email-present branches log IP+Username (the email
submitted); the device-identifier-only branch (SSO path, no email in
scope) logs IP+Device instead of fabricating a username.

Verified: cargo build/test/clippy/fmt all pass with the sqlite feature
(matching one leg of this repo's own CI matrix), including the two
existing unit tests in this file.
---
 src/api/core/two_factor/email.rs | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs
index 44ba2e7f..3667b871 100644
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -63,13 +63,19 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 
     let user = if let Some(email) = email {
         let Some(user) = User::find_by_mail(email, &conn).await else {
-            err!("Username or password is incorrect. Try again.")
+            err!(
+                "Username or password is incorrect. Try again",
+                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+            )
         };
 
         if let Some(master_password_hash) = master_password_hash {
             // Check password
             if !user.check_valid_password(master_password_hash) {
-                err!("Username or password is incorrect. Try again.")
+                err!(
+                    "Username or password is incorrect. Try again",
+                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+                )
             }
         } else if let Some(auth_request_id) = auth_request_id {
             let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
@@ -96,7 +102,10 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         };
         // SSO login only sends device id, so we get the user by the most recently used device
         let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
-            err!("Username or password is incorrect. Try again.")
+            err!(
+                "Username or password is incorrect. Try again",
+                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
+            )
         };
 
         user