log every auth attempt that names an identity the platform does not know

src/servers/api/auth/auth.ts

@@ -1,5 +1,6 @@
 import { createRouter } from '../../create-router';
 import {
+  authAudit,
   originMiddleware,
   originValidationMiddleware,
   userMiddleware,
@@ -23,6 +24,9 @@ import { passkeyRouter } from './passkey-router';
 export const authRouter = createRouter();
 
 authRouter.use(bodyParser());
+// After the body parser (it reads the claimed identity out of the body) and before everything else, so
+// that a probe rejected by origin validation or the rate limiter is recorded too. Observes only.
+authRouter.use(authAudit);
 authRouter.use(originMiddleware);
 authRouter.use(originValidationMiddleware);
 

src/servers/api/auth/bootstrap.ts

@@ -2,6 +2,7 @@ import type { Handler } from 'hono';
 import { getUserCount, createUser } from 'officerdb';
 import argon2 from 'argon2';
 import * as errors from '@@/custom-errors';
+import { rememberUser } from '@@/_middlewares';
 import { validatePassword } from './validate-password';
 import { validateUsername } from './validate-username';
 
@@ -43,5 +44,9 @@ export const bootstrapHandler: Handler = async function (ctx) {
     role: 'Super Admin',
   });
 
+  // The launch-time snapshot was taken while the user table was still empty. Without this the owner's
+  // very first sign-in would be filed as an unknown identity.
+  rememberUser(user);
+
   return ctx.json({ ok: true });
 };