Implement per-IP gallery lockouts and UI controls (#42)

backend/src/routes/adminSettings.js

@@ -19,6 +19,7 @@ const {
 } = require('../services/publicSiteService');
 const { sanitizeCss } = require('../utils/cssSanitizer');
 const { clearShareLinkSettingsCache } = require('../services/shareLinkService');
+const { resetSecurityConfigCache } = require('../utils/authSecurity');
 const router = express.Router();
 const { clearMaxFilesPerUploadCache, MAX_ALLOWED_FILES_PER_UPLOAD } = require('../services/uploadSettings');
 
@@ -590,6 +591,8 @@ router.put('/security', adminAuth, async (req, res) => {
         });
     }
 
+    resetSecurityConfigCache();
+
     // Log activity
     await db('activity_logs').insert({
       activity_type: 'security_settings_updated',

backend/src/routes/auth-enhanced-v2.js

@@ -12,13 +12,14 @@ const {
   checkSuspiciousActivity,
   getGenericAuthError
 } = require('../utils/authSecurity');
-const { 
+const {
   validatePasswordInContext,
   getBcryptRounds,
   logPasswordValidationFailure
 } = require('../utils/passwordValidation');
 const { endSession } = require('../middleware/sessionTimeout');
 const logger = require('../utils/logger');
+const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -33,7 +34,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -175,7 +176,7 @@ router.post('/admin/change-password', [
     logger.info('Admin password changed', {
       userId: adminId,
       username: admin.username,
-      ip: req.ip
+      ip: ipAddress
     });
     
     res.json({ 
@@ -229,14 +230,14 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     const event = await db('events').where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) }).first();
     const requiresPassword = !(event && (event.require_password === false || event.require_password === 0 || event.require_password === '0'));
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 

backend/src/routes/auth-enhanced.js

@@ -23,6 +23,7 @@ const {
   getGalleryTokenFromRequest,
 } = require('../utils/tokenUtils');
 const { getEventShareToken, resolveShareIdentifier } = require('../services/shareLinkService');
+const { getClientIp } = require('../utils/requestIp');
 const router = express.Router();
 
 // Admin login with enhanced security
@@ -37,7 +38,7 @@ router.post('/admin/login', [
     }
     
     const { username, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     
     // Check account lockout first
@@ -172,7 +173,7 @@ router.post('/gallery/verify', [
     }
     
     const { slug, password, recaptchaToken } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
     const event = await db('events')
       .where({ slug, is_active: formatBoolean(true), is_archived: formatBoolean(false) })
@@ -186,7 +187,7 @@ router.post('/gallery/verify', [
     const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
 
     if (requiresPassword) {
-      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+      const lockoutStatus = await checkAccountLockout(`gallery:${slug}`, ipAddress);
       if (lockoutStatus.isLocked) {
         logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
         return res.status(423).json({ 
@@ -282,7 +283,7 @@ router.post('/gallery/share-login', [
     }
 
     const { slug, token } = req.body;
-    const ipAddress = req.ip || req.connection.remoteAddress;
+    const ipAddress = getClientIp(req);
     const userAgent = req.headers['user-agent'] || '';
 
     let event = await db('events')