Repository: ClickHouse/ClickHouse
File: src/Interpreters/Session.cpp (C++)

Code before:
    AuthResult auth_result;
    try
    {
        auth_result = global_context->getAccessControl().authenticate(credentials_, address.host(), getClientInfo());
        user_id = auth_result.user_id;
        user_authenticated_with = auth_result.authentication_data;
        settings_from_auth_server = auth_result.settings;
        LOG_DEBUG(log, "{} Authenticated with global context as user {}",
                toString(auth_id), toString(*user_id));

        if (!external_roles_.empty() && global_context->getSettingsRef()[Setting::push_external_roles_in_interserver_queries])
        {
            external_roles = global_context->getAccessControl().find<Role>(external_roles_);

            LOG_DEBUG(log, "User {} has external_roles applied: [{}] ({})",
                      toString(*user_id), fmt::join(external_roles_, ", "), external_roles_.size());
        }
    }
    catch (const Exception & e)
    {
        onAuthenticationFailure(credentials_.getUserName(), address, e);
        throw;
    }

    prepared_client_info->current_user = auth_result.user_name;
    prepared_client_info->authenticated_user = auth_result.user_name;
    prepared_client_info->current_address = std::make_shared<Poco::Net::SocketAddress>(address);
}

void Session::checkIfUserIsStillValid()
{
    if (const auto valid_until = user_authenticated_with.getValidUntil())
    {
        const time_t now = std::chrono::system_clock::to_time_t(std::chrono::system_clock::now());

        if (now > valid_until)
            throw Exception(ErrorCodes::USER_EXPIRED, "Authentication method used has expired");
    }
}

void Session::onAuthenticationFailure(const std::optional<String> & user_name, const Poco::Net::SocketAddress & address_, const Exception & e)
{
    LOG_DEBUG(log, "Authentication failed with error: {}", e.what());
    if (auto session_log = getSessionLog())
    {
        /// Add source address to the log
        auto info_for_log = *prepared_client_info;
        info_for_log.current_address = std::make_shared<Poco::Net::SocketAddress>(address_);
        session_log->addLoginFailure(auth_id, info_for_log, user_name, e);
    }
}

Review comment (security):
let's add 
```
chassert(!auth_result.user_name.empty())
```

Code after:
    AuthResult auth_result;
    try
    {
        auth_result = global_context->getAccessControl().authenticate(credentials_, address.host(), getClientInfo());
        user_id = auth_result.user_id;
        user_authenticated_with = auth_result.authentication_data;
        settings_from_auth_server = auth_result.settings;
        LOG_DEBUG(log, "{} Authenticated with global context as user {}",
                toString(auth_id), toString(*user_id));

        if (!external_roles_.empty() && global_context->getSettingsRef()[Setting::push_external_roles_in_interserver_queries])
        {
            external_roles = global_context->getAccessControl().find<Role>(external_roles_);

            LOG_DEBUG(log, "User {} has external_roles applied: [{}] ({})",
                      toString(*user_id), fmt::join(external_roles_, ", "), external_roles_.size());
        }
    }
    catch (const Exception & e)
    {
        onAuthenticationFailure(credentials_.getUserName(), address, e);
        throw;
    }

    chassert(!auth_result.user_name.empty());
    prepared_client_info->current_user = auth_result.user_name;
    prepared_client_info->authenticated_user = auth_result.user_name;
    prepared_client_info->current_address = std::make_shared<Poco::Net::SocketAddress>(address);
}

void Session::checkIfUserIsStillValid()
{
    if (const auto valid_until = user_authenticated_with.getValidUntil())
    {
        const time_t now = std::chrono::system_clock::to_time_t(std::chrono::system_clock::now());

        if (now > valid_until)
            throw Exception(ErrorCodes::USER_EXPIRED, "Authentication method used has expired");
    }
}

void Session::onAuthenticationFailure(const std::optional<String> & user_name, const Poco::Net::SocketAddress & address_, const Exception & e)
{
    LOG_DEBUG(log, "Authentication failed with error: {}", e.what());
    if (auto session_log = getSessionLog())
    {
        /// Add source address to the log
        auto info_for_log = *prepared_client_info;
        info_for_log.current_address = std::make_shared<Poco::Net::SocketAddress>(address_);
        session_log->addLoginFailure(auth_id, info_for_log, user_name, e);
    }