Add detailed diagnostic log statements throughout the local authentication
path to help identify why valid local user logins are failing.
Changes:
- app/auth.py: log received username, multi_user_enabled status, LocalUser
DB lookup result, is_active status, password verification outcome, and
the specific failure reason (empty_username / wrong_password / no_match)
at every decision point. Also log form keys and Content-Type header on
empty-username failures to detect Starlette body-consumption issues.
- app/middleware/csrf.py: log Content-Type, form field names, and whether
the CSRF token was present in _get_submitted_token() to reveal if the
middleware is consuming form data before the endpoint can read it.
- app/utils/local_auth.py: verify_password() now logs DEBUG on mismatch
and WARNING (with exception type) on unexpected bcrypt errors instead
of silently swallowing exceptions.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Use astimezone() instead of replace() for timezone conversion in is_token_expired
- Log cleanup exceptions with logger.exception() in signup
- Add security warning when STRIPE_WEBHOOK_SECRET is not configured
- Increase Stripe price ID column length from 64 to 128 characters
- Replace alert() with aria-live assertive region in pricing.html
- Convert auth() login tests to use pytest.mark.asyncio and await
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
copilot-swe-agent[bot]