Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/secureStatic.js

@@ -0,0 +1,46 @@
+const path = require('path');
+const express = require('express');
+const { safePathJoin, isPathSafe } = require('../utils/fileSecurityUtils');
+
+/**
+ * Create a secure static file serving middleware that prevents path traversal attacks
+ * @param {string} basePath - The base directory to serve files from
+ * @param {Object} options - Express static options
+ * @returns {Function} - Express middleware
+ */
+function secureStatic(basePath, options = {}) {
+  const normalizedBase = path.resolve(basePath);
+  
+  return (req, res, next) => {
+    // Get the requested file path - remove leading slash for validation
+    const requestedPath = req.path.startsWith('/') ? req.path.substring(1) : req.path;
+    
+    // Validate the path doesn't contain dangerous patterns
+    if (!isPathSafe(requestedPath)) {
+      console.warn(`Potential path traversal attempt blocked: ${requestedPath}`);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+    
+    try {
+      // Validate the full path is within the base directory
+      const fullPath = safePathJoin(normalizedBase, requestedPath);
+      
+      // If validation passes, use express.static
+      const staticMiddleware = express.static(normalizedBase, {
+        ...options,
+        // Disable directory listing for security
+        index: false,
+        // Don't allow dotfiles
+        dotfiles: 'deny'
+      });
+      
+      return staticMiddleware(req, res, next);
+    } catch (error) {
+      // Path traversal detected
+      console.error(`Path traversal blocked: ${requestedPath}`, error.message);
+      return res.status(403).json({ error: 'Access denied' });
+    }
+  };
+}
+
+module.exports = secureStatic;