paul
f6e5a454ae
Mirror to GitHub / mirror (push) Successful in 31s
Test and Lint / backend-test (push) Successful in 1m27s
continuous-integration/drone/push Build is passing
Test and Lint / frontend-test (push) Successful in 2m22s
Version and Release / version-bump (push) Successful in 38s
Version and Release / trigger-drone (push) Successful in 3s
- Add comprehensive logging for rate limit blocks with full request details - IP address (with proper proxy detection), user agent, headers, timestamps - Rate limit info (current count, limit, remaining, reset time) - Separate tracking for auth vs general endpoints - Enhance authentication failure logging - JWT validation failures with detailed error info - Admin auth attempts without token - Failed token validation with user context - All events include IP, path, method, user agent - Improve Winston logger configuration for production - Add automatic log rotation (10MB errors, 50MB combined) - Create separate security.log for auth/rate limit events - Ensure logs directory exists automatically - Add structured JSON format for log aggregation - Support container logging with LOG_TO_CONSOLE env var - Create comprehensive documentation - Security logging guide with examples - Monitoring recommendations - Configuration reference - Add test script to verify logging functionality All rate limit settings remain configurable via admin panel: - Window duration, max requests, auth limits - Skip authenticated requests option - Public endpoints only option 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
86 lines
2.7 KiB
JavaScript
86 lines
2.7 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const { db } = require('../database/db');
|
|
const { formatBoolean } = require('../utils/dbCompat');
|
|
const logger = require('../utils/logger');
|
|
|
|
async function adminAuth(req, res, next) {
|
|
try {
|
|
const token = req.headers.authorization?.split(' ')[1];
|
|
if (!token) {
|
|
const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
|
|
req.headers['x-real-ip'] ||
|
|
req.connection.remoteAddress ||
|
|
req.ip;
|
|
logger.warn('Admin auth attempt without token', {
|
|
ip: clientIp,
|
|
path: req.path,
|
|
method: req.method,
|
|
userAgent: req.headers['user-agent']
|
|
});
|
|
return res.status(401).json({ error: 'No token provided' });
|
|
}
|
|
|
|
let decoded;
|
|
try {
|
|
decoded = jwt.verify(token, process.env.JWT_SECRET);
|
|
} catch (jwtError) {
|
|
const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
|
|
req.headers['x-real-ip'] ||
|
|
req.connection.remoteAddress ||
|
|
req.ip;
|
|
|
|
logger.warn('JWT validation failed', {
|
|
ip: clientIp,
|
|
path: req.path,
|
|
method: req.method,
|
|
userAgent: req.headers['user-agent'],
|
|
error: jwtError.name,
|
|
message: jwtError.message,
|
|
timestamp: new Date().toISOString()
|
|
});
|
|
|
|
if (jwtError.name === 'TokenExpiredError') {
|
|
return res.status(401).json({ error: 'Token expired' });
|
|
}
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
|
|
const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
|
|
|
|
if (!admin) {
|
|
const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
|
|
req.headers['x-real-ip'] ||
|
|
req.connection.remoteAddress ||
|
|
req.ip;
|
|
|
|
logger.warn('Admin auth failed - user not found or inactive', {
|
|
ip: clientIp,
|
|
userId: decoded.id,
|
|
path: req.path,
|
|
method: req.method,
|
|
timestamp: new Date().toISOString()
|
|
});
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
|
|
req.admin = admin;
|
|
next();
|
|
} catch (error) {
|
|
const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
|
|
req.headers['x-real-ip'] ||
|
|
req.connection.remoteAddress ||
|
|
req.ip;
|
|
|
|
logger.error('Admin auth middleware error', {
|
|
ip: clientIp,
|
|
path: req.path,
|
|
error: error.message,
|
|
stack: error.stack,
|
|
timestamp: new Date().toISOString()
|
|
});
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
}
|
|
|
|
module.exports = { adminAuth };
|