mfa fixing

internal/webui/webmail_webauthn.go

@@ -140,6 +140,7 @@ func (a *App) webmailPasskeyRegisterFinish(w http.ResponseWriter, r *http.Reques
 		writeJSON(w, http.StatusInternalServerError, M{"error": "Could not save passkey"})
 		return
 	}
+	_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "Passkey added: "+name)
 	writeJSON(w, http.StatusOK, M{"success": true})
 }
 
@@ -148,6 +149,7 @@ func (a *App) webmailPasskeyRemove(w http.ResponseWriter, r *http.Request) {
 	if err := a.DB.DeleteMailboxWebAuthnCredential(pathID(r), mbox.ID); err != nil {
 		setFlash(w, "error", "Could not remove passkey")
 	} else {
+		_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "Passkey removed")
 		setFlash(w, "success", "Passkey removed")
 	}
 	http.Redirect(w, r, MailboxPrefix+"/", http.StatusFound)
@@ -216,6 +218,7 @@ func (a *App) webmailPasskeyLoginFinish(w http.ResponseWriter, r *http.Request)
 	}
 	if _, err := wa.FinishLogin(wu, *session, r); err != nil {
 		clearMailboxWebauthnSession(w)
+		_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, requestIP(r), false, "Passkey verification failed")
 		writeJSON(w, http.StatusUnauthorized, M{"error": "Passkey verification failed"})
 		return
 	}
@@ -226,6 +229,7 @@ func (a *App) webmailPasskeyLoginFinish(w http.ResponseWriter, r *http.Request)
 		writeJSON(w, http.StatusInternalServerError, M{"error": "Could not start session"})
 		return
 	}
+	_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, requestIP(r), true, "Login successful (passkey)")
 	clearMailboxPendingMFACookie(w)
 	setMailboxSessionCookie(w, token, r.TLS != nil)
 	writeJSON(w, http.StatusOK, M{"success": true})