@serve.zone/dcrouter 18.1.0 → 18.2.0

package/ts/monitoring/classes.metricsmanager.ts

@@ -4,7 +4,15 @@ import { MetricsCache } from './classes.metricscache.js';
 import { SecurityLogger, SecurityEventType } from '../security/classes.securitylogger.js';
 import { logger } from '../logger.js';
 import type { IAsnActivity, IProtocolConnectionHistoryPoint } from '../../ts_interfaces/data/stats.js';
-
+import {
+  EmailTrafficBucketDoc,
+  type IEmailTrafficBucketSnapshot,
+} from '../db/documents/classes.email-traffic-bucket.doc.js';
+
+const EMAIL_TRAFFIC_WINDOW_MINUTES = 24 * 60;
+const EMAIL_TRAFFIC_FLUSH_INTERVAL_MS = 5_000;
+const EMAIL_TRAFFIC_PRUNE_INTERVAL_MS = 60 * 60 * 1000;
+const AUTHENTICATION_EVENT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
 const NETWORK_STATS_CACHE_TTL_MS = 3_000;
 const ASN_INTELLIGENCE_CACHE_TTL_MS = 60_000;
 const ACTIVE_CONNECTION_SNAPSHOT_CACHE_TTL_MS = 3_000;
@@ -20,6 +28,12 @@ export class MetricsManager {
   private dcRouter: DcRouter;
   private resetInterval?: NodeJS.Timeout;
   private observedIpSamplerInterval?: NodeJS.Timeout;
+  private emailTrafficFlushInterval?: NodeJS.Timeout;
+  private persistedMetricsPruneInterval?: NodeJS.Timeout;
+  private emailTrafficFlushChain: Promise<void> = Promise.resolve();
+  private persistedMetricsFlushInFlight?: Promise<void>;
+  private persistedMetricsPruneInFlight?: Promise<void>;
+  private emailDirtyBuckets = new Map<number, number>();
   private metricsCache: MetricsCache;
   
   // Constants
@@ -32,7 +46,7 @@ export class MetricsManager {
     failedToday: 0,
     bouncedToday: 0,
     queueSize: 0,
-    lastResetDate: new Date().toDateString(),
+    lastResetDate: new Date().toISOString().slice(0, 10),
     deliveryTimes: [] as number[], // Track delivery times in ms
     recipients: new Map<string, number>(), // Track email count by recipient
     recentActivity: [] as Array<{ timestamp: number; type: string; details: string }>,
@@ -54,7 +68,9 @@ export class MetricsManager {
   };
   
   // Per-minute time-series buckets for charts
-  private emailMinuteBuckets = new Map<number, { sent: number; received: number; failed: number }>();
+  private emailMinuteBuckets = new Map<number, {
+    sent: number; received: number; failed: number; revision: number;
+  }>();
   private dnsMinuteBuckets = new Map<number, { queries: number }>();
 
   // Track security-specific metrics
@@ -84,23 +100,18 @@ export class MetricsManager {
   }
   
   public async start(): Promise<void> {
+    if (this.canPersistEmailTraffic()) {
+      await this.loadEmailTrafficBuckets();
+      await this.prunePersistedMetrics();
+    }
+
     // Start SmartMetrics collection
     this.smartMetrics.start();
     
-    // Reset daily counters at midnight
+    // Maintain UTC daily ancillary counters and bounded in-memory windows.
     this.resetInterval = setInterval(() => {
       const currentDate = new Date().toDateString();
-      
-      if (currentDate !== this.emailMetrics.lastResetDate) {
-        this.emailMetrics.sentToday = 0;
-        this.emailMetrics.receivedToday = 0;
-        this.emailMetrics.failedToday = 0;
-        this.emailMetrics.bouncedToday = 0;
-        this.emailMetrics.deliveryTimes = [];
-        this.emailMetrics.recipients.clear();
-        this.emailMetrics.recentActivity = [];
-        this.emailMetrics.lastResetDate = currentDate;
-      }
+      this.ensureEmailDailyState();
       
       if (currentDate !== this.dnsMetrics.lastResetDate) {
         this.dnsMetrics.totalQueries = 0;
@@ -128,17 +139,33 @@ export class MetricsManager {
       // Prune old time-series buckets every minute (don't wait for lazy query)
       this.pruneOldBuckets();
     }, 60000); // Check every minute
+    this.resetInterval.unref();
 
     this.observedIpSamplerInterval = setInterval(() => {
       this.sampleObservedIps();
     }, OBSERVED_IP_SAMPLE_INTERVAL_MS);
     this.observedIpSamplerInterval.unref();
+
+    if (this.canPersistEmailTraffic()) {
+      this.emailTrafficFlushInterval = setInterval(() => {
+        void this.flushPersistedMetrics().catch((error) => {
+          logger.log('warn', `Metrics persistence flush failed: ${(error as Error).message}`);
+        });
+      }, EMAIL_TRAFFIC_FLUSH_INTERVAL_MS);
+      this.emailTrafficFlushInterval.unref();
+
+      this.persistedMetricsPruneInterval = setInterval(() => {
+        void this.prunePersistedMetrics().catch((error) => {
+          logger.log('warn', `Metrics persistence pruning failed: ${(error as Error).message}`);
+        });
+      }, EMAIL_TRAFFIC_PRUNE_INTERVAL_MS);
+      this.persistedMetricsPruneInterval.unref();
+    }
     
     logger.log('info', 'MetricsManager started');
   }
 
   public async stop(): Promise<void> {
-    // Clear the reset interval
     if (this.resetInterval) {
       clearInterval(this.resetInterval);
       this.resetInterval = undefined;
@@ -147,12 +174,60 @@ export class MetricsManager {
       clearInterval(this.observedIpSamplerInterval);
       this.observedIpSamplerInterval = undefined;
     }
+    if (this.emailTrafficFlushInterval) {
+      clearInterval(this.emailTrafficFlushInterval);
+      this.emailTrafficFlushInterval = undefined;
+    }
+    if (this.persistedMetricsPruneInterval) {
+      clearInterval(this.persistedMetricsPruneInterval);
+      this.persistedMetricsPruneInterval = undefined;
+    }
+
+    if (this.persistedMetricsPruneInFlight) {
+      try {
+        await this.persistedMetricsPruneInFlight;
+      } catch (error) {
+        logger.log('warn', `Final metrics pruning wait failed: ${(error as Error).message}`);
+      }
+    }
+
+    let finalFlushError: Error | undefined;
+    if (this.canPersistEmailTraffic()) {
+      const activeFlush = this.persistedMetricsFlushInFlight;
+      if (activeFlush) {
+        try {
+          await activeFlush;
+        } catch (error) {
+          logger.log(
+            'warn',
+            `Active metrics persistence flush failed before final drain: ${(error as Error).message}`,
+          );
+        }
+      }
+
+      // OpsServer and EmailServer have stopped by this point. Run a fresh,
+      // non-coalesced pass so events added after an earlier flush snapshot are
+      // included in the final durable drain.
+      for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+          await this.flushPersistedMetricsUnlocked();
+          finalFlushError = undefined;
+          break;
+        } catch (error) {
+          finalFlushError = error as Error;
+        }
+      }
+    }
 
     this.smartMetrics.stop();
 
-    // Clear caches and time-series buckets on shutdown
+    if (finalFlushError) {
+      throw new Error(`Final metrics persistence flush failed: ${finalFlushError.message}`);
+    }
+
     this.metricsCache.clear();
     this.emailMinuteBuckets.clear();
+    this.emailDirtyBuckets.clear();
     this.dnsMinuteBuckets.clear();
 
     logger.log('info', 'MetricsManager stopped');
@@ -199,30 +274,31 @@ export class MetricsManager {
   // Get email metrics
   public async getEmailStats() {
     return this.metricsCache.get('emailStats', () => {
-      // Calculate average delivery time
+      this.ensureEmailDailyState();
+      const totals = this.getUtcTodayEmailTotals();
+      const deliveryAttempts = totals.sent + totals.failed;
       const avgDeliveryTime = this.emailMetrics.deliveryTimes.length > 0
         ? this.emailMetrics.deliveryTimes.reduce((a, b) => a + b, 0) / this.emailMetrics.deliveryTimes.length
         : 0;
-      
-      // Get top recipients
+
       const topRecipients = Array.from(this.emailMetrics.recipients.entries())
         .sort((a, b) => b[1] - a[1])
         .slice(0, 10)
         .map(([email, count]) => ({ email, count }));
-      
-      // Get recent activity (last 50 entries)
+
       const recentActivity = this.emailMetrics.recentActivity.slice(-50);
-      
+
       return {
-        sentToday: this.emailMetrics.sentToday,
-        receivedToday: this.emailMetrics.receivedToday,
-        failedToday: this.emailMetrics.failedToday,
-        bounceRate: this.emailMetrics.bouncedToday > 0 
-          ? (this.emailMetrics.bouncedToday / this.emailMetrics.sentToday) * 100 
+        sentToday: totals.sent,
+        receivedToday: totals.received,
+        failedToday: totals.failed,
+        bouncedToday: this.emailMetrics.bouncedToday,
+        bounceRate: deliveryAttempts > 0
+          ? Math.min(1, Math.max(0, this.emailMetrics.bouncedToday / deliveryAttempts))
           : 0,
-        deliveryRate: this.emailMetrics.sentToday > 0 
-          ? ((this.emailMetrics.sentToday - this.emailMetrics.failedToday) / this.emailMetrics.sentToday) * 100 
-          : 100,
+        deliveryRate: deliveryAttempts > 0
+          ? Math.min(1, Math.max(0, totals.sent / deliveryAttempts))
+          : 1,
         queueSize: this.emailMetrics.queueSize,
         averageDeliveryTime: Math.round(avgDeliveryTime),
         topRecipients,
@@ -278,8 +354,13 @@ export class MetricsManager {
       this.securityMetrics.spamDetected = summary.byType[SecurityEventType.SPAM] || 0;
       this.securityMetrics.malwareDetected = summary.byType[SecurityEventType.MALWARE] || 0;
       this.securityMetrics.phishingDetected = summary.byType[SecurityEventType.DMARC] || 0; // phishing via DMARC
-      this.securityMetrics.authFailures =
-        summary.byType[SecurityEventType.AUTHENTICATION] || 0;
+      this.securityMetrics.authFailures = securityLogger
+        .getRecentEvents(10_000, {
+          type: SecurityEventType.AUTHENTICATION,
+          fromTimestamp: Date.now() - 86_400_000,
+        })
+        .filter((event) => event.success === false)
+        .length;
       this.securityMetrics.blockedIPs =
         (summary.byType[SecurityEventType.IP_REPUTATION] || 0) +
         (summary.byType[SecurityEventType.REJECTED_CONNECTION] || 0);
@@ -377,7 +458,7 @@ export class MetricsManager {
   
   // Email event tracking methods
   public trackEmailSent(recipient?: string, deliveryTimeMs?: number): void {
-    this.emailMetrics.sentToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('sent');
     
     if (recipient) {
@@ -414,7 +495,7 @@ export class MetricsManager {
   }
   
   public trackEmailReceived(sender?: string): void {
-    this.emailMetrics.receivedToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('received');
     
     this.emailMetrics.recentActivity.push({
@@ -430,7 +511,7 @@ export class MetricsManager {
   }
   
   public trackEmailFailed(recipient?: string, reason?: string): void {
-    this.emailMetrics.failedToday++;
+    this.ensureEmailDailyState();
     this.incrementEmailBucket('failed');
     
     this.emailMetrics.recentActivity.push({
@@ -446,6 +527,7 @@ export class MetricsManager {
   }
   
   public trackEmailBounced(recipient?: string): void {
+    this.ensureEmailDailyState();
     this.emailMetrics.bouncedToday++;
     
     this.emailMetrics.recentActivity.push({
@@ -1087,14 +1169,164 @@ export class MetricsManager {
     return Math.floor(ts / 60000) * 60000;
   }
 
+  private static firstMinuteForHours(hoursArg: number, nowArg = Date.now()): number {
+    const pointCount = Math.max(1, Math.floor(hoursArg * 60));
+    return MetricsManager.minuteKey(nowArg) - (pointCount - 1) * 60_000;
+  }
+
+  private isEmailTrafficPersistenceConfigured(): boolean {
+    return this.dcRouter.options.dbConfig?.enabled !== false;
+  }
+
+  private canPersistEmailTraffic(): boolean {
+    return this.isEmailTrafficPersistenceConfigured()
+      && Boolean(this.dcRouter.dcRouterDb?.isReady());
+  }
+
+  private ensureEmailDailyState(nowArg = Date.now()): void {
+    const currentUtcDate = new Date(nowArg).toISOString().slice(0, 10);
+    if (currentUtcDate === this.emailMetrics.lastResetDate) return;
+
+    this.emailMetrics.sentToday = 0;
+    this.emailMetrics.receivedToday = 0;
+    this.emailMetrics.failedToday = 0;
+    this.emailMetrics.bouncedToday = 0;
+    this.emailMetrics.deliveryTimes = [];
+    this.emailMetrics.recipients.clear();
+    this.emailMetrics.recentActivity = [];
+    this.emailMetrics.lastResetDate = currentUtcDate;
+  }
+
+  private getUtcTodayEmailTotals(nowArg = Date.now()): {
+    sent: number;
+    received: number;
+    failed: number;
+  } {
+    const now = new Date(nowArg);
+    const utcMidnight = Date.UTC(
+      now.getUTCFullYear(),
+      now.getUTCMonth(),
+      now.getUTCDate(),
+    );
+    const totals = { sent: 0, received: 0, failed: 0 };
+    for (const [bucketStart, bucket] of this.emailMinuteBuckets) {
+      if (bucketStart < utcMidnight || bucketStart > nowArg) continue;
+      totals.sent += bucket.sent;
+      totals.received += bucket.received;
+      totals.failed += bucket.failed;
+    }
+    return totals;
+  }
+
+  private async loadEmailTrafficBuckets(): Promise<void> {
+    const snapshots = await EmailTrafficBucketDoc.loadSince(
+      MetricsManager.firstMinuteForHours(24),
+    );
+    for (const snapshot of snapshots) {
+      this.emailMinuteBuckets.set(snapshot.bucketStart, {
+        sent: snapshot.sent,
+        received: snapshot.received,
+        failed: snapshot.failed,
+        revision: 0,
+      });
+    }
+  }
+
+  private flushPersistedMetrics(): Promise<void> {
+    if (this.persistedMetricsFlushInFlight) return this.persistedMetricsFlushInFlight;
+    const run = this.flushPersistedMetricsUnlocked();
+    this.persistedMetricsFlushInFlight = run;
+    run.then(
+      () => { if (this.persistedMetricsFlushInFlight === run) this.persistedMetricsFlushInFlight = undefined; },
+      () => { if (this.persistedMetricsFlushInFlight === run) this.persistedMetricsFlushInFlight = undefined; },
+    );
+    return run;
+  }
+
+  private async flushPersistedMetricsUnlocked(): Promise<void> {
+    const results = await Promise.allSettled([
+      this.flushEmailTrafficBuckets(),
+      this.dcRouter.authenticationEventManager.flushBuffered(),
+    ]);
+    const failure = results.find((result) => result.status === 'rejected');
+    if (failure?.status === 'rejected') {
+      throw failure.reason;
+    }
+  }
+
+  private flushEmailTrafficBuckets(): Promise<void> {
+    const run = this.emailTrafficFlushChain.then(
+      () => this.flushEmailTrafficBucketsUnlocked(),
+      () => this.flushEmailTrafficBucketsUnlocked(),
+    );
+    this.emailTrafficFlushChain = run.then(() => undefined, () => undefined);
+    return run;
+  }
+
+  private async flushEmailTrafficBucketsUnlocked(): Promise<void> {
+    if (!this.canPersistEmailTraffic() || this.emailDirtyBuckets.size === 0) return;
+
+    const snapshots: Array<IEmailTrafficBucketSnapshot & { revision: number }> = [];
+    for (const [bucketStart, revision] of this.emailDirtyBuckets) {
+      const bucket = this.emailMinuteBuckets.get(bucketStart);
+      if (!bucket) continue;
+      snapshots.push({
+        bucketStart,
+        sent: bucket.sent,
+        received: bucket.received,
+        failed: bucket.failed,
+        revision,
+      });
+    }
+
+    for (let offset = 0; offset < snapshots.length; offset += 500) {
+      const batch = snapshots.slice(offset, offset + 500);
+      await EmailTrafficBucketDoc.persistAbsolute(batch);
+      for (const snapshot of batch) {
+        const current = this.emailMinuteBuckets.get(snapshot.bucketStart);
+        if (
+          current?.revision === snapshot.revision
+          && this.emailDirtyBuckets.get(snapshot.bucketStart) === snapshot.revision
+        ) {
+          this.emailDirtyBuckets.delete(snapshot.bucketStart);
+        }
+      }
+    }
+  }
+
+  private prunePersistedMetrics(): Promise<void> {
+    if (this.persistedMetricsPruneInFlight) return this.persistedMetricsPruneInFlight;
+    const run = this.prunePersistedMetricsUnlocked();
+    this.persistedMetricsPruneInFlight = run;
+    run.then(
+      () => { if (this.persistedMetricsPruneInFlight === run) this.persistedMetricsPruneInFlight = undefined; },
+      () => { if (this.persistedMetricsPruneInFlight === run) this.persistedMetricsPruneInFlight = undefined; },
+    );
+    return run;
+  }
+
+  private async prunePersistedMetricsUnlocked(): Promise<void> {
+    if (!this.canPersistEmailTraffic()) return;
+    await Promise.all([
+      EmailTrafficBucketDoc.pruneBefore(MetricsManager.firstMinuteForHours(24)),
+      this.dcRouter.authenticationEventManager.pruneBefore(
+        Date.now() - AUTHENTICATION_EVENT_RETENTION_MS,
+      ),
+    ]);
+  }
+
   private incrementEmailBucket(field: 'sent' | 'received' | 'failed'): void {
     const key = MetricsManager.minuteKey();
     let bucket = this.emailMinuteBuckets.get(key);
     if (!bucket) {
-      bucket = { sent: 0, received: 0, failed: 0 };
+      bucket = { sent: 0, received: 0, failed: 0, revision: 0 };
       this.emailMinuteBuckets.set(key, bucket);
     }
     bucket[field]++;
+    bucket.revision++;
+    if (this.isEmailTrafficPersistenceConfigured()) {
+      this.emailDirtyBuckets.set(key, bucket.revision);
+    }
   }
 
   private incrementDnsBucket(): void {
@@ -1165,12 +1397,16 @@ export class MetricsManager {
   }
 
   private pruneOldBuckets(): void {
-    const cutoff = Date.now() - 86400000; // 24h
+    const emailCutoff = MetricsManager.firstMinuteForHours(24);
     for (const key of this.emailMinuteBuckets.keys()) {
-      if (key < cutoff) this.emailMinuteBuckets.delete(key);
+      if (key < emailCutoff) {
+        this.emailMinuteBuckets.delete(key);
+        this.emailDirtyBuckets.delete(key);
+      }
     }
+    const dnsCutoff = Date.now() - 86400000;
     for (const key of this.dnsMinuteBuckets.keys()) {
-      if (key < cutoff) this.dnsMinuteBuckets.delete(key);
+      if (key < dnsCutoff) this.dnsMinuteBuckets.delete(key);
     }
   }
 
@@ -1183,20 +1419,21 @@ export class MetricsManager {
     failed: Array<{ timestamp: number; value: number }>;
   } {
     this.pruneOldBuckets();
-    const cutoff = Date.now() - hours * 3600000;
+    const pointCount = Math.max(
+      1,
+      Math.min(EMAIL_TRAFFIC_WINDOW_MINUTES, Math.floor(hours * 60)),
+    );
+    const end = MetricsManager.minuteKey();
+    const start = end - (pointCount - 1) * 60_000;
     const sent: Array<{ timestamp: number; value: number }> = [];
     const received: Array<{ timestamp: number; value: number }> = [];
     const failed: Array<{ timestamp: number; value: number }> = [];
 
-    const sortedKeys = Array.from(this.emailMinuteBuckets.keys())
-      .filter((k) => k >= cutoff)
-      .sort((a, b) => a - b);
-
-    for (const key of sortedKeys) {
-      const bucket = this.emailMinuteBuckets.get(key)!;
-      sent.push({ timestamp: key, value: bucket.sent });
-      received.push({ timestamp: key, value: bucket.received });
-      failed.push({ timestamp: key, value: bucket.failed });
+    for (let timestamp = start; timestamp <= end; timestamp += 60_000) {
+      const bucket = this.emailMinuteBuckets.get(timestamp);
+      sent.push({ timestamp, value: bucket?.sent || 0 });
+      received.push({ timestamp, value: bucket?.received || 0 });
+      failed.push({ timestamp, value: bucket?.failed || 0 });
     }
 
     return { sent, received, failed };

package/ts/opsserver/handlers/admin.handler.ts

@@ -18,6 +18,11 @@ type TAdminUser = {
   authSources?: Array<'local' | 'idp.global'>;
 };
 
+type TAuthenticatedAdmin = {
+  user: TAdminUser;
+  authSource: 'local' | 'idp.global';
+};
+
 export class AdminHandler {
   public typedrouter = new plugins.typedrequest.TypedRouter();
   
@@ -330,25 +335,59 @@ export class AdminHandler {
       new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_AdminLoginWithUsernameAndPassword>(
         'adminLoginWithUsernameAndPassword',
         async (dataArg) => {
+          const requestedAuthSource = dataArg.authSource || 'auto';
+          let authenticatedAdmin: TAuthenticatedAdmin | null;
           try {
-            const user = await this.authenticateUser({
+            authenticatedAdmin = await this.authenticateUser({
               username: dataArg.username,
               password: dataArg.password,
-              authSource: dataArg.authSource,
+              authSource: requestedAuthSource,
             });
-            if (!user) {
-              throw new plugins.typedrequest.TypedResponseError('login failed');
-            }
-
-            return {
-              identity: await this.createIdentityForUser(user),
-            };
           } catch (error) {
-            if (error instanceof plugins.typedrequest.TypedResponseError) {
-              throw error;
-            }
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              success: false,
+              requestedAuthSource,
+              failureReason: String((error as Error).message || '').includes('database is not ready')
+                ? 'serviceUnavailable'
+                : 'internalError',
+            });
             throw new plugins.typedrequest.TypedResponseError('login failed');
           }
+
+          if (!authenticatedAdmin) {
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              success: false,
+              requestedAuthSource,
+              failureReason: 'invalidCredentials',
+            });
+            throw new plugins.typedrequest.TypedResponseError('login failed');
+          }
+
+          let identity: interfaces.data.IIdentity;
+          try {
+            identity = await this.createIdentityForUser(authenticatedAdmin.user);
+          } catch {
+            await this.recordAuthenticationAttempt({
+              username: dataArg.username,
+              userId: authenticatedAdmin.user.id,
+              success: false,
+              requestedAuthSource,
+              resolvedAuthSource: authenticatedAdmin.authSource,
+              failureReason: 'identityIssuanceFailed',
+            });
+            throw new plugins.typedrequest.TypedResponseError('login failed');
+          }
+
+          await this.recordAuthenticationAttempt({
+            username: dataArg.username,
+            userId: authenticatedAdmin.user.id,
+            success: true,
+            requestedAuthSource,
+            resolvedAuthSource: authenticatedAdmin.authSource,
+          });
+          return { identity };
         }
       )
     );
@@ -492,7 +531,7 @@ export class AdminHandler {
     username: string;
     password: string;
     authSource?: interfaces.requests.TAdminLoginAuthSource;
-  }): Promise<TAdminUser | null> {
+  }): Promise<TAuthenticatedAdmin | null> {
     const accountState = await this.getPersistentAccountState();
     if (accountState.dbEnabled && !accountState.dbReady) {
       throw new plugins.typedrequest.TypedResponseError('database is not ready');
@@ -508,17 +547,37 @@ export class AdminHandler {
         password: optionsArg.password,
         authSource: optionsArg.authSource || 'auto',
       });
-      return result ? this.accountToUser(result.account) : null;
+      return result
+        ? { user: this.accountToUser(result.account), authSource: result.authSource }
+        : null;
     }
 
     for (const [_, userData] of this.users) {
       if (userData.username === optionsArg.username && userData.password === optionsArg.password) {
-        return userData;
+        return { user: userData, authSource: 'local' };
       }
     }
     return null;
   }
 
+  private async recordAuthenticationAttempt(optionsArg: {
+    username: string;
+    userId?: string;
+    success: boolean;
+    requestedAuthSource: interfaces.requests.TAdminLoginAuthSource;
+    resolvedAuthSource?: 'local' | 'idp.global';
+    failureReason?: interfaces.data.TAuthenticationFailureReason;
+  }): Promise<void> {
+    const eventManager = this.opsServerRef.dcRouterRef.authenticationEventManager;
+    if (!eventManager) return;
+    try {
+      await eventManager.recordAttempt(optionsArg);
+    } catch (error) {
+      // Authentication availability must not depend on telemetry persistence.
+      console.warn(`Authentication event recording unavailable: ${(error as Error).message}`);
+    }
+  }
+
   private async resolveUser(userIdArg: string): Promise<TAdminUser | null> {
     const accountState = await this.getPersistentAccountState();
     if (accountState.dbEnabled && !accountState.dbReady) {

package/ts/opsserver/handlers/security.handler.ts

@@ -27,6 +27,9 @@ export class SecurityHandler {
               malwareDetected: metrics.malwareDetected,
               phishingDetected: metrics.phishingDetected,
               authenticationFailures: metrics.authFailures,
+              authenticationSuccesses: metrics.authSuccesses,
+              authenticationWindowStart: metrics.authWindowStart,
+              authenticationEvents: metrics.authEvents,
               suspiciousActivities: metrics.suspiciousActivities,
             },
             trends: dataArg.includeDetails ? {
@@ -309,6 +312,9 @@ export class SecurityHandler {
     malwareDetected: number;
     phishingDetected: number;
     authFailures: number;
+    authSuccesses: number;
+    authWindowStart: number;
+    authEvents: interfaces.data.IAuthenticationEvent[];
     suspiciousActivities: number;
     trends: {
       spam: Array<{ timestamp: number; value: number }>;
@@ -316,6 +322,15 @@ export class SecurityHandler {
       phishing: Array<{ timestamp: number; value: number }>;
     };
   }> {
+    const authenticationEventManager = this.opsServerRef.dcRouterRef.authenticationEventManager;
+    const authentication = authenticationEventManager
+      ? await authenticationEventManager.getWindowStats()
+      : {
+          windowStart: Date.now() - 86_400_000,
+          successes: 0,
+          failures: 0,
+          events: [],
+        };
     // Get metrics from MetricsManager if available
     if (this.opsServerRef.dcRouterRef.metricsManager) {
       const securityStats = await this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats();
@@ -328,7 +343,10 @@ export class SecurityHandler {
         },
         malwareDetected: securityStats.malwareDetected,
         phishingDetected: securityStats.phishingDetected,
-        authFailures: securityStats.authFailures,
+        authFailures: authentication.failures,
+        authSuccesses: authentication.successes,
+        authWindowStart: authentication.windowStart,
+        authEvents: authentication.events,
         suspiciousActivities: 0,
         trends: {
           spam: [],
@@ -348,7 +366,10 @@ export class SecurityHandler {
       },
       malwareDetected: 0,
       phishingDetected: 0,
-      authFailures: 0,
+      authFailures: authentication.failures,
+      authSuccesses: authentication.successes,
+      authWindowStart: authentication.windowStart,
+      authEvents: authentication.events,
       suspiciousActivities: 0,
       trends: {
         spam: [],