Add detailed diagnostic log statements throughout the local authentication
path to help identify why valid local user logins are failing.
Changes:
- app/auth.py: log received username, multi_user_enabled status, LocalUser
DB lookup result, is_active status, password verification outcome, and
the specific failure reason (empty_username / wrong_password / no_match)
at every decision point. Also log form keys and Content-Type header on
empty-username failures to detect Starlette body-consumption issues.
- app/middleware/csrf.py: log Content-Type, form field names, and whether
the CSRF token was present in _get_submitted_token() to reveal if the
middleware is consuming form data before the endpoint can read it.
- app/utils/local_auth.py: verify_password() now logs DEBUG on mismatch
and WARNING (with exception type) on unexpected bcrypt errors instead
of silently swallowing exceptions.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]
c5b330cb4e