Record usernames for manual provisioning requests

src/lib/server/auth/guard.ts

@@ -2,6 +2,7 @@ import { error, json, redirect, type Handle } from '@sveltejs/kit';
 import { readSession, readSessionHash, recordAudit, setupRequired } from './index.js';
 import { authBody, authError, requireSameOrigin, requireUserTransport, sessionCookie } from './http.js';
 import { roleAllows, routePermission, type RoutePermission } from './access.js';
+import { withRequestUsername } from './request-context.js';
 
 function publicAsset(routeId: string | null, path: string, method: string) {
     return routeId === null && ['GET','HEAD'].includes(method) &&
@@ -94,7 +95,7 @@ export const authenticationHandle: Handle = async ({ event, resolve }) => {
         if (routeId==='/login'&&setup) redirect(303,'/setup');
     }
 
-    let response = await resolve(event);
+    let response = await withRequestUsername(session?.user.username ?? null, () => resolve(event));
     if (session && !['GET','HEAD','OPTIONS'].includes(method) && response.status < 400) {
         recordAudit(session.user.id,'request',routeId,{method,status:response.status,path:event.url.pathname});
     }