auth: log evicted-account auth attempts with source IP

Emit a greppable EVICTED_AUTH line (username + cf-connecting-ip) when an
evicted account's JWT is used, so the real-time auto-banner can block the
source IP at the edge immediately rather than waiting for the hourly scan.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

1 files changed, 7 insertions, 1 deletions

diff --git a/lib/auth.ts b/lib/auth.ts
index cae73a46..b299715b 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -65,8 +65,14 @@ export const jwtStrategy = new jwt.Strategy(
       user &&
       ((await db.sIsMember("evicted", user.id)) ||
         (await db.sIsMember("evicted", user.username?.toLowerCase?.().trim())))
-    )
+    ) {
+      // Distinctive, greppable line carrying the real source IP so the realtime
+      // auto-banner (scripts/atk-autoban.sh) can insta-ban it at Cloudflare.
+      console.error(
+        `EVICTED_AUTH ${user.username} ${req.headers["cf-connecting-ip"] || req.ip}`,
+      );
       return next(null, false);
+    }
 
     next(null, user);
   },