feat: capture User-Agent on register/login and display hashed password + UA in admin panel

Author: ddrayko

config/migrate.js

@@ -25,6 +25,7 @@ const tables = {
       { name: 'email_change_token', def: 'VARCHAR(64) DEFAULT NULL' },
       { name: 'email_change_code', def: 'VARCHAR(10) DEFAULT NULL' },
       { name: 'email_change_expires', def: 'DATETIME DEFAULT NULL' },
+      { name: 'user_agent', def: 'VARCHAR(512) DEFAULT NULL' },
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
     ],
   },
@@ -45,6 +46,7 @@ const tables = {
       { name: 'id', def: 'INT AUTO_INCREMENT PRIMARY KEY' },
       { name: 'user_id', def: 'INT NOT NULL' },
       { name: 'ip_address', def: 'VARCHAR(45) NOT NULL' },
+      { name: 'user_agent', def: 'VARCHAR(512) DEFAULT NULL' },
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
     ],
   },

public/js/admin.js

@@ -1265,13 +1265,21 @@ async function renderAdminUserDetail(userId) {
               <div class="detail-item"><span class="detail-label">Ptero ID</span><span class="detail-value" style="font-family:monospace">${u.ptero_user_id || 'N/A'}</span></div>
               <div class="detail-item"><span class="detail-label">API Key Set</span><span class="detail-value">${u.ptero_client_api_key ? 'Yes' : 'No'}</span></div>
               <div class="detail-item"><span class="detail-label">Created</span><span class="detail-value">${formatDateWithTooltip(u.created_at)}</span></div>
+              <div class="detail-item"><span class="detail-label">Password Hash</span><span class="detail-value" style="font-family:monospace;word-break:break-all;font-size:0.8rem">${u.password_hash ? escapeHtml(u.password_hash) : 'N/A'}</span></div>
+              <div class="detail-item"><span class="detail-label">User-Agent</span><span class="detail-value" style="word-break:break-all;font-size:0.8rem">${u.user_agent ? escapeHtml(u.user_agent) : 'N/A'}</span></div>
             </div>
           </div>
           <div class="card">
             <h2 class="card-title" style="margin-bottom:16px">IP Addresses</h2>
             ${data.ips && data.ips.length > 0 ? ahtml`
-              <div style="display:flex;flex-wrap:wrap;gap:8px">
-                ${data.ips.map(ip => ahtml`<span class="server-detail-tag" style="font-family:monospace">${ip.ip_address}</span>`).join('')}
+              <div style="display:flex;flex-direction:column;gap:10px">
+                ${data.ips.map(ip => ahtml`
+                  <div style="border:1px solid var(--border);border-radius:8px;padding:10px 12px;background:var(--bg-secondary)">
+                    <div style="font-family:monospace;font-size:0.9rem">${escapeHtml(ip.ip_address)}</div>
+                    <div style="color:var(--text-secondary);font-size:0.75rem;margin-top:4px">${formatDateWithTooltip(ip.created_at)}</div>
+                    <div style="color:var(--text-secondary);font-size:0.78rem;margin-top:4px;word-break:break-all">${ip.user_agent ? escapeHtml(ip.user_agent) : 'N/A'}</div>
+                  </div>
+                `).join('')}
               </div>
             ` : '<p style="color:var(--text-secondary)">No IPs recorded.</p>'}
           </div>

routes/admin.js

@@ -78,6 +78,7 @@ router.post('/login', adminLoginLimiter, async (req, res) => {
     }
 
     const ip = getClientIp(req);
+    const userAgent = (req.headers['user-agent'] || 'unknown').toString().slice(0, 512);
     const delay = getAdminLoginDelay(ip);
     if (delay > 0) {
       await new Promise(r => setTimeout(r, delay));
@@ -112,6 +113,10 @@ router.post('/login', adminLoginLimiter, async (req, res) => {
 
     recordAdminLoginAttempt(ip, true);
 
+    await query('UPDATE users SET user_agent = ? WHERE id = ?', [userAgent, user.id]).catch(err => {
+      console.error('Failed to update user_agent:', err.message);
+    });
+
     const token = jwt.sign(
       { userId: user.id, email: user.email, username: user.username, pteroId: user.ptero_user_id, isAdmin: true, restricted: false, tokenVersion: user.token_version },
       JWT_SECRET,
@@ -457,7 +462,7 @@ router.get('/users/:id', authenticateToken, requireAdmin, async (req, res) => {
     }
 
     const users = await query(
-      'SELECT id, email, username, is_admin, restricted, auth_restricted, ptero_user_id, ptero_client_api_key, created_at FROM users WHERE id = ?',
+      'SELECT id, email, username, is_admin, restricted, auth_restricted, ptero_user_id, ptero_client_api_key, password_hash, user_agent, created_at FROM users WHERE id = ?',
       [userId]
     );
     if (users.length === 0) {
@@ -484,7 +489,7 @@ router.get('/users/:id', authenticateToken, requireAdmin, async (req, res) => {
     }
 
     const ips = await query(
-      'SELECT ip_address, created_at FROM user_ips WHERE user_id = ? ORDER BY created_at DESC',
+      'SELECT ip_address, user_agent, created_at FROM user_ips WHERE user_id = ? ORDER BY created_at DESC',
       [userId]
     );
 

routes/auth.js

@@ -151,6 +151,7 @@ router.post('/register', async (req, res) => {
     const { email, username, password, capToken, rgpdConsent } = req.body;
 
     const ip = getClientIp(req);
+    const userAgent = (req.headers['user-agent'] || 'unknown').toString().slice(0, 512);
 
     if (!email || !username || !password) {
       return res.status(400).json({ error: 'Email, username and password are required' });
@@ -219,12 +220,12 @@ router.post('/register', async (req, res) => {
     createdPteroUserId = pteroUser.id;
 
     const insertResult = await query(
-      'INSERT INTO users (email, username, password_hash, ptero_user_id, ptero_uuid, first_name, last_name, password_set) VALUES (?, ?, ?, ?, ?, ?, ?, 1)',
-      [email, username, passwordHash, pteroUser.id, pteroUser.uuid, username, 'User']
+      'INSERT INTO users (email, username, password_hash, ptero_user_id, ptero_uuid, first_name, last_name, password_set, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?)',
+      [email, username, passwordHash, pteroUser.id, pteroUser.uuid, username, 'User', userAgent]
     );
     const localUserId = insertResult.insertId;
 
-    await query('INSERT INTO user_ips (user_id, ip_address) VALUES (?, ?)', [localUserId, ip]).catch(err => {
+    await query('INSERT INTO user_ips (user_id, ip_address, user_agent) VALUES (?, ?, ?)', [localUserId, ip, userAgent]).catch(err => {
       console.error('Failed to log IP:', err.message);
     });
 
@@ -387,6 +388,7 @@ router.post('/login', async (req, res) => {
     }
 
     const ip = getClientIp(req);
+    const userAgent = (req.headers['user-agent'] || 'unknown').toString().slice(0, 512);
 
     // VPN / Proxy detection — checked first for security
     if (await isVpnOrProxy(ip)) {
@@ -451,6 +453,13 @@ router.post('/login', async (req, res) => {
 
     recordLoginAttempt(ip, true);
 
+    await query('UPDATE users SET user_agent = ? WHERE id = ?', [userAgent, user.id]).catch(err => {
+      console.error('Failed to update user_agent:', err.message);
+    });
+    await query('INSERT INTO user_ips (user_id, ip_address, user_agent) VALUES (?, ?, ?)', [user.id, ip, userAgent]).catch(err => {
+      console.error('Failed to log login IP:', err.message);
+    });
+
     res.json({
       token,
       user: {