Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked

- Add comprehensive logging for rate limit blocks with full request details
  - IP address (with proper proxy detection), user agent, headers, timestamps
  - Rate limit info (current count, limit, remaining, reset time)
  - Separate tracking for auth vs general endpoints

- Enhance authentication failure logging
  - JWT validation failures with detailed error info
  - Admin auth attempts without token
  - Failed token validation with user context
  - All events include IP, path, method, user agent

- Improve Winston logger configuration for production
  - Add automatic log rotation (10MB errors, 50MB combined)
  - Create separate security.log for auth/rate limit events
  - Ensure logs directory exists automatically
  - Add structured JSON format for log aggregation
  - Support container logging with LOG_TO_CONSOLE env var

- Create comprehensive documentation
  - Security logging guide with examples
  - Monitoring recommendations
  - Configuration reference

- Add test script to verify logging functionality

All rate limit settings remain configurable via admin panel:
- Window duration, max requests, auth limits
- Skip authenticated requests option
- Public endpoints only option

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/adminAuth.js

@@ -0,0 +1,99 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const { body, validationResult } = require('express-validator');
+const { db, logActivity } = require('../database/db');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
+const { endSession } = require('../middleware/sessionTimeout');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
+const router = express.Router();
+
+// Change password
+router.post('/change-password', [
+  adminAuth,
+  body('currentPassword').notEmpty().withMessage('Current password is required'),
+  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+
+    const { currentPassword, newPassword } = req.body;
+    const userId = req.admin.id; // Changed from req.user.id to req.admin.id
+
+    // Validate new password strength
+    const passwordValidation = validatePasswordStrength(newPassword);
+    if (!passwordValidation.isValid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.messages
+      });
+    }
+
+    // Get user from database
+    const user = await db('admin_users')
+      .where('id', userId)
+      .first();
+
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    // Verify current password
+    const validPassword = await bcrypt.compare(currentPassword, user.password_hash);
+    if (!validPassword) {
+      return res.status(400).json({ error: 'Current password is incorrect' });
+    }
+
+    // Hash new password with more rounds
+    const newPasswordHash = await bcrypt.hash(newPassword, 12);
+
+    // Update password and clear must_change_password flag
+    await db('admin_users')
+      .where('id', userId)
+      .update({
+        password_hash: newPasswordHash,
+        must_change_password: false,
+        updated_at: new Date()
+      });
+
+    // Log activity
+    await logActivity('password_changed', 
+      { admin_id: userId }, 
+      null,
+      { type: 'admin', id: userId, name: user.username }
+    );
+
+    res.json({ message: 'Password changed successfully' });
+  } catch (error) {
+    console.error('Password change error:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// Logout
+router.post('/logout', adminAuth, async (req, res) => {
+  try {
+    // Get token from header
+    const token = req.headers.authorization?.split(' ')[1];
+    if (token) {
+      // End the session
+      endSession(token);
+    }
+    
+    // Log activity
+    await logActivity('admin_logout', 
+      { admin_id: req.admin.id }, 
+      null,
+      { type: 'admin', id: req.admin.id, name: req.admin.username }
+    );
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    console.error('Logout error:', error);
+    res.status(500).json({ error: 'Failed to logout' });
+  }
+});
+
+module.exports = router;