feat: add security audit plugin with brute-force detection#748
Merged
Conversation
Add a new opt-in security audit plugin that: - Logs login attempts (success/failure), registrations, logouts, and permission events - Detects brute-force attacks with configurable per-IP and per-email thresholds - Provides lockout mechanism via KV with sliding-window counters - Includes admin dashboard with stats cards, hourly trend chart, top IPs table - Includes filterable/paginated event log with expandable detail rows - Includes settings page for brute-force thresholds, logging toggles, and retention - Exposes JSON API for events, stats, lockouts, and CSV/JSON export - Adds dynamic plugin menu system via HTML marker injection middleware New files: - security-audit-plugin (types, services, middleware, routes, components, manifest) - plugin-menu middleware for dynamic sidebar injection - Migration 034 for security_events table Modified files: - app.ts: register plugin routes and middleware - schema.ts: add securityEvents Drizzle table - migrations-bundle.ts: include migration 034 - core-plugins/index.ts: export new plugin - admin-plugins.ts: add to AVAILABLE_PLUGINS - admin-layout-catalyst.template.ts: add dynamic menu marker Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Match both /auth/login and /auth/login/form paths - Extract email before next() via request clone so it's available post-response - Detect form login failures by checking auth_token cookie (form returns 200 for both success/failure) - Enforce KV expirationTtl minimum of 60s (Cloudflare requirement) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The rate limiter was silently broken because KV PUT rejected TTLs under 60s. Now that the TTL floor is fixed, the original tight limits (3-5 per minute) cause 429s in e2e tests and are too aggressive for production use. Increase to reasonable values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The test suite makes 30+ auth requests from the same IP within 60s. With KV's 60s minimum TTL, the rate limit window persists at least that long. Increase to 30/min for login and register routes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
packages/core/src/plugins/core-plugins/security-audit-plugin/— Full plugin implementation (types, services, middleware, routes, components, manifest)packages/core/src/middleware/plugin-menu.ts— New middleware for dynamic sidebar menu injectionpackages/core/migrations/034_security_audit_plugin.sql— Migration forsecurity_eventstablepackages/core/src/app.ts— Register plugin routes and middlewarepackages/core/src/db/schema.ts— AddsecurityEventsDrizzle table definitionpackages/core/src/db/migrations-bundle.ts— Include migration 034packages/core/src/plugins/core-plugins/index.ts— Export new pluginpackages/core/src/routes/admin-plugins.ts— Add to AVAILABLE_PLUGINS with install handlerpackages/core/src/templates/layouts/admin-layout-catalyst.template.ts— Add dynamic menu markerTesting
🤖 Generated with Claude Code