Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/middleware/sessionTimeout.js

@@ -0,0 +1,153 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+
+// In-memory session tracking (in production, use Redis)
+const sessions = new Map();
+
+// Default session timeout (60 minutes)
+const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;
+
+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
+
+// Clean up expired sessions every 5 minutes
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, lastActivity] of sessions.entries()) {
+    if (now - lastActivity > DEFAULT_SESSION_TIMEOUT) {
+      sessions.delete(token);
+    }
+  }
+}, 5 * 60 * 1000);
+
+async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
+  try {
+    const setting = await db('app_settings')
+      .where('setting_key', 'security_session_timeout_minutes')
+      .first()
+      .timeout(5000); // 5 second timeout
+    
+    if (setting && setting.setting_value) {
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
+    }
+  } catch (error) {
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
+  }
+  
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
+}
+
+async function sessionTimeoutMiddleware(req, res, next) {
+  // Skip for non-authenticated routes
+  if (!req.headers.authorization) {
+    return next();
+  }
+  
+  const token = req.headers.authorization.split(' ')[1];
+  if (!token) {
+    return next();
+  }
+  
+  try {
+    // Verify token is valid
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    
+    // Check if this is an admin token
+    if (!decoded.id) {
+      return next();
+    }
+    
+    const now = Date.now();
+    const lastActivity = sessions.get(token);
+    const timeout = await getSessionTimeout();
+    
+    // If session exists, check if it's expired
+    if (lastActivity) {
+      if (now - lastActivity > timeout) {
+        sessions.delete(token);
+        return res.status(401).json({ 
+          error: 'Session expired', 
+          code: 'SESSION_TIMEOUT' 
+        });
+      }
+    }
+    
+    // Update last activity
+    sessions.set(token, now);
+    
+    // Clean up old token if user has a new one
+    // This prevents memory leaks from token renewals
+    const userId = decoded.id;
+    for (const [oldToken, _] of sessions.entries()) {
+      if (oldToken !== token) {
+        try {
+          const oldDecoded = jwt.verify(oldToken, process.env.JWT_SECRET);
+          if (oldDecoded.id === userId) {
+            sessions.delete(oldToken);
+          }
+        } catch (e) {
+          // Token is invalid, remove it
+          sessions.delete(oldToken);
+        }
+      }
+    }
+    
+    next();
+  } catch (error) {
+    // Token is invalid
+    next();
+  }
+}
+
+// Function to end a session
+function endSession(token) {
+  sessions.delete(token);
+}
+
+// Function to get active sessions count
+function getActiveSessions() {
+  const now = Date.now();
+  let active = 0;
+  
+  for (const [_, lastActivity] of sessions.entries()) {
+    if (now - lastActivity <= DEFAULT_SESSION_TIMEOUT) {
+      active++;
+    }
+  }
+  
+  return active;
+}
+
+module.exports = { 
+  sessionTimeoutMiddleware, 
+  endSession,
+  getActiveSessions 
+};