Login location tracking (country/city/IP)

Login location tracking is the baseline dataset for detecting impossible travel, account sharing, and unauthorized access patterns. Without it, there is no ground truth for anomaly detection — you cannot identify a login from Russia 10 minutes after a login from New York if no location is recorded. PCI-DSS Req 10.2.1 requires that access attempts include origin context. NIST AU-3 mandates that audit records capture location where applicable. ISO 27001:2022 A.8.15 requires traceability of access events. In financial fraud investigations, login location records are often the primary evidence used to distinguish legitimate from unauthorized transactions.

Add geolocation capture to the login handler in src/lib/geoLocation.ts using a local lookup library to avoid external API dependency:

import geoip from 'geoip-lite'; // local MaxMind DB — no external calls

export function trackLoginLocation(req: Request) {
  const ip = getClientIP(req);
  const geo = geoip.lookup(ip);
  return {
    ip,
    country: geo?.country ?? null,
    city: geo?.city ?? null,
    timestamp: new Date()
  };
}

Store the result on the session record at creation time:

const location = trackLoginLocation(req);
await db.sessions.create({
  data: { userId, location, device: parseUserAgent(req), expiresAt }
});

Capture at minimum: IP, country, and city — that is the three-field minimum. Keep geoip-lite's MaxMind database updated monthly to maintain lookup accuracy.