BUG: Login audit POST returns 422: additional_data list vs dict mismatch

[plouka13]

Summary

When ENABLE_AUDIT_LOGS.login: true and PUSH_AUDIT_LOGS_CONFIG.type: api are enabled against 2026.10 audit-service, every successful login callback fails at the audit POST with 422 Unprocessable Entity. Fence catches the error and returns the response to the user anyway, so this is silent from the outside — but no login rows land in audit-service.login and each login writes a full stacktrace to fence logs.

Environment

• quay.io/cdis/fence:2026.10
• quay.io/cdis/audit-service:2026.10
• gen3-helm chart, Auth0 as the IdP, type: api audit transport

Reproduction

1. Deploy fence + audit-service.
2. In fence config, set:

ENABLE_AUDIT_LOGS: { login: true }
PUSH_AUDIT_LOGS_CONFIG: { type: api, aws_sqs_config: {} }

3. Log in via Auth0. Fence logs:

[fence][ERROR] Unable to POST audit log `{... 'additional_data': [
   'X-Forwarded-For:...', 'X-Userid:...', 'X-Reqid:...',
   'X-Sessionid:...', 'X-Visitorid:...',
   'X-Cloud-Trace-Context:...', 'X-Forwarded-Proto:https'
], ...}`. Status code: 422 - Details:
{'detail': [{'type': 'dict_type', 'loc': ['body','additional_data'],
    'msg': 'Input should be a valid dictionary',
    'input': [ ... same list ... ]}]}

Root Cause

From a quick search, Fence builds additional_data as a list[str] in fence/blueprints/login/base.py L316–325 See Code Here.

Meanwhile, audit-service's Pydantic input model requires a dict in src/audit/models.py L67 See Code Here