[Fraud Protection] Add decision record audit log#5555
Merged
carmenlau merged 11 commits intoauthgear:feat-fraud-protectionfrom Mar 17, 2026
Merged
[Fraud Protection] Add decision record audit log#5555carmenlau merged 11 commits intoauthgear:feat-fraud-protectionfrom
carmenlau merged 11 commits intoauthgear:feat-fraud-protectionfrom
Conversation
tung2744
force-pushed
the
dev-3410
branch
3 times, most recently
from
e0f0e5b to
fb4fe47
Compare
carmenlau
approved these changes
Mar 13, 2026
tung2744
commented
Mar 13, 2026
| "v2.component.verify-bot-protection.default.title": "Checking your system...", | ||
| "v2.error.account-conflict": "{ IdentityTypeIncoming, select, login_id {{FlowType, select, login {Looks like you used {OAuthProviderNameExisting} for login before.} other {This {LoginIDNameIncoming} is already registered.}}} oauth {The email of this {OAuthProviderNameIncoming} account is already registered with another method.} other {This account is already registered} }", | ||
| "v2.error.account-not-found": "{ IdentityTypeIncoming, select, login_id {{ LoginIDTypeIncoming, select, email {This email} phone {This phone number} username {This username} other {This identity} }} oauth {This email} other {This identity} } cannot be found. Do you want to create an account?", | ||
| "v2.error.blocked-by-fraud-protection": "Your request has been blocked. Please try again later.", |
Contributor
Author
There was a problem hiding this comment.
Use a better message
- Remove block_mode from FraudProtectionDecisionRecord; it was specced but there is no corresponding config field and it adds no value over the decision field itself. - Use time.Time for Timestamp instead of a pre-formatted string. - Use typed consts (FraudProtectionDecision, FraudProtectionAction) instead of plain strings for the Decision and Action fields. - Define FraudProtectionDecisionRecord in pkg/api/model so it can be reused outside the event package. - Update docs/specs/fraud-protection.md and docs/plans/fraud-protection-implementation.md to reflect these changes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add EventService interface to fraudprotection.Service and wire it to event.Service in deps_common.go. In CheckAndRecord, dispatch a fraud_protection.decision_recorded audit event after warning evaluation and before the block-or-allow decision, recording the full decision record (decision, action, triggered warnings, IP, user agent, HTTP URL, HTTP referer, user ID, geo location code). Add httputil.HTTPReferer type and its providers for request, background, redis-queue, and e2e contexts so the Referer header is available via DI in the same manner as UserAgentString and HTTPRequestURL. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Also fix event dispatch in fraudprotection.Service to wrap in a read-only transaction when not already inside one. This is required because DispatchEventImmediately internally calls nextSeq which needs an active database transaction. Log an error if dispatch fails rather than silently ignoring it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d fraud protection
Contributor
Author
|
Rebased and updated the error message, thanks! |
tung2744
pushed a commit
that referenced
this pull request
Mar 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ref DEV-3410
requires