1 files changed, 20 insertions, 0 deletions

diff --git a/app/controllers/login.go b/app/controllers/login.go
index 603eb20..f59789f 100644
--- a/app/controllers/login.go
+++ b/app/controllers/login.go
@@ -13,6 +13,21 @@ import (
         "github.com/go-webauthn/webauthn/protocol"
         "github.com/go-webauthn/webauthn/webauthn"
         "github.com/labstack/echo/v4"
+        "github.com/prometheus/client_golang/prometheus"
+        "github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+        loginError = promauto.NewCounterVec(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "login_error",
+                Help:      "Total number of errors during login operation",
+        }, []string{"type"})
+        loginSuccess = promauto.NewCounter(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "login_success",
+                Help:      "Total number of successful logins",
+        })
 )
 
 type LoginController[T app.AppSession] struct {
@@ -57,6 +72,7 @@ func (a *LoginController[T]) HandleFinish(c echo.Context) error {
         user, err := a.Users.Get(ctx, c.Param("username"))
         if err != nil {
                 a.Logger.Errorf("Error getting user: %s", err)
+                loginError.With(prometheus.Labels{"type": "no_user"}).Inc()
                 return c.NoContent(http.StatusNotFound)
         }
 
@@ -76,6 +92,7 @@ func (a *LoginController[T]) HandleFinish(c echo.Context) error {
 
         if _, err := a.Webauthn.ValidateLogin(user, *s.WebauthnSession, response); err != nil {
                 a.Logger.Errorf("Error validating login: %s", err)
+                loginError.With(prometheus.Labels{"type": "webauthn_invalid"}).Inc()
                 return c.NoContent(http.StatusBadRequest)
         }
 
@@ -96,11 +113,13 @@ func (a *LoginController[T]) HandleFinish(c echo.Context) error {
         authSession, err := a.AuthSessions.GetByUserCode(ctx, code.Code)
         if err != nil {
                 a.Logger.Errorf("No auth session exists")
+                loginError.With(prometheus.Labels{"type": "no_session_for_code"}).Inc()
                 return c.NoContent(http.StatusUnauthorized)
         }
 
         if authSession.AccessCode != "" {
                 a.Logger.Errorf("Session is already authenticated")
+                loginError.With(prometheus.Labels{"type": "already_authenticated"}).Inc()
                 return c.NoContent(http.StatusUnauthorized)
         }
 
@@ -113,5 +132,6 @@ func (a *LoginController[T]) HandleFinish(c echo.Context) error {
                 return c.NoContent(http.StatusInternalServerError)
         }
 
+        loginSuccess.Inc()
         return c.NoContent(http.StatusOK)
 }