From 72d76df35d1a0a1da2017d92f81cc5533f153f22 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Wed, 29 Apr 2026 03:02:30 +0000
Subject: [PATCH] Log session id from handlers on selected auth routes. Adds
 request.state.log_extra for handlers to print access log extra.

---
 paskia/fastapi/api.py     | 12 ++++++++++++
 paskia/fastapi/logging.py |  7 +------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/paskia/fastapi/api.py b/paskia/fastapi/api.py
index 35ec627..4ccfea3 100644
--- a/paskia/fastapi/api.py
+++ b/paskia/fastapi/api.py
@@ -21,6 +21,7 @@ from paskia.fastapi import authz, session, user
 from paskia.fastapi.response import MsgspecResponse
 from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME, get_client_ip
 from paskia.globals import passkey as global_passkey
+from paskia.util.crypto import hash_secret
 from paskia.util import hostutil, htmlutil, passphrase, permutil, userinfo
 from paskia.util.apistructs import (
     ApiCheckUserResponse,
@@ -56,6 +57,12 @@ async def http_exception_handler(_request: Request, exc: HTTPException):
 _REFRESH_INTERVAL = timedelta(minutes=5)
 
 
+def _set_log_extra(request: Request, *parts: str) -> None:
+    values = [part for part in parts if part]
+    if values:
+        request.state.log_extra = " ".join(values)
+
+
 @app.exception_handler(ValueError)
 async def value_error_handler(_request: Request, exc: ValueError):
     return JSONResponse(status_code=400, content={"detail": str(exc)})
@@ -110,6 +117,7 @@ async def validate_token(
             )
             session.set_session_cookie(response, auth)
             renewed = True
+        _set_log_extra(request, ctx.session.key)
     return MsgspecResponse(
         ApiValidateResponse(
             valid=True,
@@ -202,6 +210,7 @@ async def forward_authentication(
             host=request.headers.get("host"),
             max_age=max_age,
         )
+        _set_log_extra(request, request.headers.get("x-forwarded-uri", ""), ctx.session.key)
         # Build permission scopes for Remote-Groups header
         role_permissions = (
             {p.scope for p in ctx.permissions} if ctx.permissions else set()
@@ -276,6 +285,8 @@ async def api_user_info(
             clear_session=True,
         )
 
+    _set_log_extra(request, ctx.session.key)
+
     return MsgspecResponse(
         await userinfo.build_user_info(
             user_uuid=ctx.user.uuid,
@@ -351,5 +362,6 @@ async def api_set_session(
     if not ctx:
         raise HTTPException(401, f"Session not found on {host}")
 
+    _set_log_extra(request, hash_secret("cookie", secret))
     session.set_session_cookie(response, secret)
     return {"status": "ok", "user": str(ctx.user.uuid)}
diff --git a/paskia/fastapi/logging.py b/paskia/fastapi/logging.py
index 56efead..e243488 100644
--- a/paskia/fastapi/logging.py
+++ b/paskia/fastapi/logging.py
@@ -256,12 +256,7 @@ class AccessLogMiddleware(BaseHTTPMiddleware):
             path = f"{path}?{request.url.query}"
         status = response.status_code
 
-        extra = ""
-        # For forward-auth endpoint, include the original target URI when provided.
-        if request.url.path == "/auth/api/forward":
-            forwarded_uri = request.headers.get("x-forwarded-uri")
-            if forwarded_uri:
-                extra = forwarded_uri
+        extra = getattr(request.state, "log_extra", "")
 
         line = format_access_log(
             client, status, method, host, path, duration_ms, extra=extra