FDN-02/FDN-03/FDN-07/FDN-08: Migrations-Rollback, Objekt-Storage-Interface, go.sum-Fix, Observability

- FDN-02: Rollback-fähige Down-Migrationen (024-026), archivdms seed dev CLI
- FDN-03: internal/objectstore Interface + lokaler WORM-Treiber, signierte Download-URLs
- FDN-07: go.mod/go.sum vervollständigt (fehlender go-ldap/v3-Eintrag), CI-Pipeline (.gitea/workflows/ci.yml, bereits in FDN-01 committet) damit lauffähig
- FDN-08: Request-ID-Middleware, /metrics-Endpoint, Panic-Recovery, Login/Logout/Me technisches Logging inkl. Access-Log je Anfrage

internal/api/auth_handlers.go

@@ -13,15 +13,22 @@ type loginRequest struct {
 }
 
 func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	var req loginRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		s.reqLog(ctx).Warn("login: invalid request body",
+			"remote_ip", s.remoteIP(r), "err", err)
 		writeError(w, http.StatusBadRequest, "invalid request body")
 		return
 	}
 
 	ip := s.remoteIP(r)
-	token, user, err := s.authMgr.LoginFrom(r.Context(), req.Username, req.Password, ip)
+	token, user, err := s.authMgr.LoginFrom(ctx, req.Username, req.Password, ip)
 	if err != nil {
+		// Kein Passwort, keine Fehlerdetails vom Auth-Manager im Klartext:
+		// nur Benutzername + IP zur Korrelation von Brute-Force-Versuchen.
+		s.reqLog(ctx).Warn("login failed",
+			"username", req.Username, "remote_ip", ip, "reason", "invalid_credentials")
 		s.audlog.Log(audit.Entry{
 			EventType: audit.EventLogin,
 			Username:  req.Username,
@@ -43,7 +50,14 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		MaxAge:   8 * 60 * 60,
 	})
 
-	_ = s.users.UpdateLastLogin(user.ID)
+	if err := s.users.UpdateLastLogin(user.ID); err != nil {
+		s.reqLog(ctx).Warn("login: last_login update failed",
+			"user_id", user.ID, "err", err)
+	}
+
+	s.reqLog(ctx).Info("login succeeded",
+		"user_id", user.ID, "username", user.Username,
+		"tenant_id", user.TenantID, "remote_ip", ip)
 
 	s.audlog.Log(audit.Entry{
 		EventType: audit.EventLogin,
@@ -57,9 +71,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
-	sess := sessionFromCtx(r.Context())
+	ctx := r.Context()
+	sess := sessionFromCtx(ctx)
 	user, err := s.users.GetByID(sess.UserID)
 	if err != nil {
+		s.reqLog(ctx).Warn("me: user lookup failed",
+			"user_id", sess.UserID, "err", err)
 		writeError(w, http.StatusNotFound, "user not found")
 		return
 	}
@@ -67,7 +84,8 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
-	sess := sessionFromCtx(r.Context())
+	ctx := r.Context()
+	sess := sessionFromCtx(ctx)
 	token := ""
 	if c, err := r.Cookie(sessionCookieName); err == nil {
 		token = c.Value
@@ -76,9 +94,16 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 		token = extractBearerToken(r)
 	}
 	if token != "" {
-		_ = s.authMgr.Logout(token)
+		if err := s.authMgr.Logout(token); err != nil {
+			s.reqLog(ctx).Warn("logout: session invalidation failed",
+				"user_id", sess.UserID, "err", err)
+		}
 	}
 
+	s.reqLog(ctx).Info("logout",
+		"user_id", sess.UserID, "username", sess.Username,
+		"tenant_id", sess.TenantID, "remote_ip", s.remoteIP(r))
+
 	http.SetCookie(w, &http.Cookie{
 		Name:     sessionCookieName,
 		Value:    "",