Loading...
+Failed to load: ${escapeHtml(err.message)}
`; + } +} + +function renderTotpDisabled(section) { + section.innerHTML = html` ++ Add an extra layer of security to your account by enabling two-factor authentication. + You'll need to enter a verification code from your authenticator app when signing in. +
+ + `; + $('#enable-totp-btn').addEventListener('click', handleTotpSetup); + initIcons(); +} + +async function renderTotpEnabled(section) { + section.innerHTML = html` ++ Scan this QR code with your authenticator app (e.g. Google Authenticator, Authy, 2FAS). +
+
+ Or manually enter this key: ${data.secret}
+
+ Each code can be used once to sign in if you lose access to your authenticator app. +
++ Enter your password to disable two-factor authentication. +
++ Your existing recovery codes will be invalidated and new ones will be generated. +
+ +${escapeHtml(err.message)}
`; + } + }); +} + function handleModifyApiKey() { const overlay = $('#modal-overlay'); const content = $('#modal-content'); diff --git a/routes/admin.js b/routes/admin.js index 3fbe430..7cdb864 100644 --- a/routes/admin.js +++ b/routes/admin.js @@ -8,6 +8,7 @@ import { getAllServers, getServerById, getEgg, getPteroNests, getPteroNestEggs, import { verifyCap } from '../config/cap.js'; import { logActivity } from '../services/activity.js'; import { createNotification } from '../services/notification.js'; +import { detectVpnProxy, isBotUserAgent } from '../services/security.js'; const router = Router(); const JWT_SECRET = process.env.JWT_SECRET; @@ -79,6 +80,15 @@ router.post('/login', adminLoginLimiter, async (req, res) => { const ip = getClientIp(req); const userAgent = (req.headers['user-agent'] || 'unknown').toString().slice(0, 512); + + if (isBotUserAgent(userAgent)) { + return res.status(403).json({ error: 'Automated requests are not allowed.' }); + } + + const vpnResult = await detectVpnProxy(ip); + if (vpnResult.isVpn || vpnResult.isProxy || vpnResult.isTor) { + return res.status(403).json({ error: 'VPN, proxy, or Tor detected. Access denied.' }); + } const delay = getAdminLoginDelay(ip); if (delay > 0) { await new Promise(r => setTimeout(r, delay)); diff --git a/routes/auth.js b/routes/auth.js index dc01d71..68158e8 100644 --- a/routes/auth.js +++ b/routes/auth.js @@ -11,6 +11,7 @@ import { createPteroUser, updatePteroPassword, updatePteroEmail, deletePteroUser import { verifyCap } from '../config/cap.js'; import { logActivity } from '../services/activity.js'; import { sendVerificationEmail, sendEmailChangeLink, sendEmailChangeCode } from '../services/email.js'; +import { isBotUserAgent, detectVpnProxy } from '../services/security.js'; const router = Router(); @@ -18,8 +19,8 @@ router.get('/check-vpn', async (req, res) => { try { const ip = getClientIp(req); const forwarded = req.headers['x-forwarded-for'] || 'none'; - const isVpn = await isVpnOrProxy(ip); - res.json({ vpn: isVpn, ip, forwarded }); + const result = await detectVpnProxy(ip); + res.json({ vpn: result.isVpn || result.isProxy || result.isTor, tor: !!result.isTor, proxy: !!result.isProxy, ip, forwarded, source: result.source }); } catch { res.json({ vpn: false }); } @@ -116,6 +117,14 @@ const sensitiveLimiter = rateLimit({ legacyHeaders: false, }); +const ultraStrictLimiter = rateLimit({ + windowMs: 60 * 60 * 1000, + max: 3, + message: { error: 'Too many attempts. Try again later.' }, + standardHeaders: true, + legacyHeaders: false, +}); + function getClientIp(req) { const forwarded = req.headers['x-forwarded-for']; if (forwarded) return forwarded.split(',')[0].trim(); @@ -206,7 +215,7 @@ router.post('/register', async (req, res) => { const ip = getClientIp(req); const userAgent = (req.headers['user-agent'] || '').toString().slice(0, 512); - if (!userAgent || /curl|wget|node-fetch|python-requests|python-httpx|urllib|aiohttp|go-http-client|java\/|libcurl|okhttp|httpie|postmanruntime|insomnia|axios|fetch\//i.test(userAgent)) { + if (isBotUserAgent(userAgent)) { recordLoginAttempt(ip, false); return res.status(403).json({ error: 'Automated registration is not allowed. Please use a real browser.' }); } @@ -231,12 +240,18 @@ router.post('/register', async (req, res) => { return res.status(400).json({ error: 'Username must be 3-32 chars (letters, numbers, underscore, hyphen)' }); } - if (password.length < 8 || password.length > MAX_PASSWORD_LENGTH) { - return res.status(400).json({ error: 'Password must be between 8 and 128 characters' }); + if (password.length < 12 || password.length > MAX_PASSWORD_LENGTH) { + return res.status(400).json({ error: 'Password must be between 12 and 128 characters' }); } - if (await isVpnOrProxy(ip)) { - return res.status(403).json({ error: 'VPN or proxy detected. Please disable your VPN for security reasons.' }); + if (!/[A-Z]/.test(password) || !/[a-z]/.test(password) || !/[0-9]/.test(password)) { + return res.status(400).json({ error: 'Password must contain uppercase, lowercase, and a number' }); + } + + const vpnResult = await detectVpnProxy(ip); + if (vpnResult.isVpn || vpnResult.isProxy || vpnResult.isTor) { + recordLoginAttempt(ip, false); + return res.status(403).json({ error: 'VPN, proxy, or Tor detected. Please disable them for security reasons.' }); } const delay = getLoginDelay(ip); @@ -448,18 +463,17 @@ router.post('/login', async (req, res) => { const ip = getClientIp(req); const userAgent = (req.headers['user-agent'] || 'unknown').toString().slice(0, 512); - // VPN / Proxy detection — checked first for security - if (await isVpnOrProxy(ip)) { - return res.status(403).json({ error: 'VPN or proxy detected. Please disable your VPN for security reasons.' }); + const vpnResult = await detectVpnProxy(ip); + if (vpnResult.isVpn || vpnResult.isProxy || vpnResult.isTor) { + recordLoginAttempt(ip, false); + return res.status(403).json({ error: 'VPN, proxy, or Tor detected. Please disable them for security reasons.' }); } - // Cap verification if (!await verifyCap(capToken)) { recordLoginAttempt(ip, false); return res.status(400).json({ error: 'Please complete the security check' }); } - // Progressive delay applied only after validation to prevent resource exhaustion const delay = getLoginDelay(ip); if (delay > 0) { await new Promise(r => setTimeout(r, delay)); @@ -492,6 +506,21 @@ router.post('/login', async (req, res) => { return res.status(403).json({ error: 'Please verify your email before signing in. Check your inbox for the verification link.' }); } + if (user.totp_enabled) { + const tempToken = jwt.sign( + { userId: user.id, totpTemp: true }, + process.env.JWT_SECRET, + { expiresIn: '5m', algorithm: 'HS256' } + ); + + recordLoginAttempt(ip, true); + + return res.json({ + needsTotp: true, + tempToken, + }); + } + const token = generateToken({ userId: user.id, email: user.email, @@ -552,8 +581,11 @@ router.post('/change-password', authenticateToken, sensitiveLimiter, async (req, return res.status(400).json({ error: 'Invalid input types' }); } - if (newPassword.length < 8 || newPassword.length > MAX_PASSWORD_LENGTH) { - return res.status(400).json({ error: 'New password must be between 8 and 128 characters' }); + if (newPassword.length < 12 || newPassword.length > MAX_PASSWORD_LENGTH) { + return res.status(400).json({ error: 'New password must be between 12 and 128 characters' }); + } + if (!/[A-Z]/.test(newPassword) || !/[a-z]/.test(newPassword) || !/[0-9]/.test(newPassword)) { + return res.status(400).json({ error: 'New password must contain uppercase, lowercase, and a number' }); } const users = await query('SELECT * FROM users WHERE ptero_user_id = ?', [pteroId]); diff --git a/routes/passkeys.js b/routes/passkeys.js index 6c3610c..36015bc 100644 --- a/routes/passkeys.js +++ b/routes/passkeys.js @@ -11,7 +11,7 @@ import { authenticateToken, generateToken } from '../middleware/auth.js'; import { createHash, randomBytes } from 'crypto'; import { query } from '../config/db.js'; import { logActivity } from '../services/activity.js'; -import { isVpnOrProxy } from './auth.js'; +import { detectVpnProxy } from '../services/security.js'; const router = Router(); @@ -223,8 +223,9 @@ router.post('/passkeys/login/complete', passkeyLoginLimiter, async (req, res) => try { const ip = getClientIp(req); - if (await isVpnOrProxy(ip)) { - return res.status(403).json({ error: 'VPN or proxy detected. Please disable your VPN for security reasons.' }); + const vpnResult = await detectVpnProxy(ip); + if (vpnResult.isVpn || vpnResult.isProxy || vpnResult.isTor) { + return res.status(403).json({ error: 'VPN, proxy, or Tor detected. Please disable them for security reasons.' }); } const { response, sessionToken } = req.body; diff --git a/routes/servers.js b/routes/servers.js index f1df97f..6bddb34 100644 --- a/routes/servers.js +++ b/routes/servers.js @@ -1,7 +1,7 @@ import { Router } from 'express'; import rateLimit from 'express-rate-limit'; import { authenticateToken, requireNotRestricted, requireOwnership } from '../middleware/auth.js'; -import { getClientIp, isVpnOrProxy, fetchWithTimeout, normalizeClientIp, isPrivateIp } from './auth.js'; +import { getClientIp, fetchWithTimeout } from './auth.js'; import { getServersByUser, getServerById, @@ -19,23 +19,10 @@ import { query } from '../config/db.js'; import { verifyCap } from '../config/cap.js'; import { logActivity } from '../services/activity.js'; import { createNotification } from '../services/notification.js'; +import { isBotUserAgent, detectVpnProxy, checkBlockedCountry } from '../services/security.js'; const router = Router(); -const BLOCKED_COUNTRY_CODES = ['CN', 'RU']; - -async function checkBlockedCountry(ip) { - const cleanIp = normalizeClientIp(ip); - if (!cleanIp || isPrivateIp(cleanIp)) return false; - try { - const res = await fetchWithTimeout(`http://ip-api.com/json/${encodeURIComponent(cleanIp)}?fields=countryCode`, {}, 5000); - const data = await res.json(); - return BLOCKED_COUNTRY_CODES.includes(data.countryCode); - } catch { - return false; - } -} - const createServerLimiter = rateLimit({ windowMs: 60 * 60 * 1000, max: 3, @@ -253,11 +240,12 @@ router.post('/create', authenticateToken, requireNotRestricted, createServerLimi const ip = getClientIp(req); const userAgent = (req.headers['user-agent'] || '').toString().slice(0, 512); - if (await isVpnOrProxy(ip)) { - return res.status(403).json({ error: 'VPN or proxy detected. Please disable your VPN.', check: 'vpn' }); + const vpnResult = await detectVpnProxy(ip); + if (vpnResult.isVpn || vpnResult.isProxy || vpnResult.isTor) { + return res.status(403).json({ error: 'VPN, proxy, or Tor detected. Please disable them.', check: 'vpn' }); } - if (!userAgent || /curl|wget|node-fetch|python-requests|python-httpx|urllib|aiohttp|go-http-client|java\/|libcurl|okhttp|httpie|postmanruntime|insomnia|axios|fetch\//i.test(userAgent)) { + if (isBotUserAgent(userAgent)) { return res.status(403).json({ error: 'Automated requests are not allowed. Please use a real browser.', check: 'useragent' }); } @@ -266,7 +254,8 @@ router.post('/create', authenticateToken, requireNotRestricted, createServerLimi return res.status(403).json({ error: 'Please verify your email before creating a server.', check: 'email' }); } - if (await checkBlockedCountry(ip)) { + const countryCheck = await checkBlockedCountry(ip); + if (countryCheck.blocked) { return res.status(403).json({ error: 'Service not available in your region.', check: 'country' }); } diff --git a/routes/totp.js b/routes/totp.js new file mode 100644 index 0000000..cadcd92 --- /dev/null +++ b/routes/totp.js @@ -0,0 +1,361 @@ +import { Router } from 'express'; +import { TOTP, NobleCryptoPlugin, ScureBase32Plugin, generateSecret, verify, generateURI } from 'otplib'; +import QRCode from 'qrcode'; +import jwt from 'jsonwebtoken'; +import { createHash, randomBytes } from 'crypto'; +import argon2 from 'argon2'; + +import { query } from '../config/db.js'; +import { authenticateToken, generateToken } from '../middleware/auth.js'; +import { logActivity } from '../services/activity.js'; + +const totp = new TOTP({ + crypto: new NobleCryptoPlugin(), + base32: new ScureBase32Plugin(), +}); + +const router = Router(); +const JWT_SECRET = process.env.JWT_SECRET; + +function generateRecoveryCodes(count = 8) { + const codes = []; + for (let i = 0; i < count; i++) { + const bytes = randomBytes(4).toString('hex').toUpperCase(); + const code = bytes.match(/.{4}/g).join('-'); + codes.push(code); + } + return codes; +} + +function hashRecoveryCode(code) { + return createHash('sha256').update(code).digest('hex'); +} + +function gravatarHash(email) { + return createHash('md5').update(email.trim().toLowerCase()).digest('hex'); +} + +router.get('/totp/status', authenticateToken, async (req, res) => { + try { + const users = await query('SELECT totp_enabled FROM users WHERE id = ?', [req.user.userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + res.json({ enabled: !!users[0].totp_enabled }); + } catch (err) { + console.error('TOTP status error:', err.message); + res.status(500).json({ error: 'Failed to check status' }); + } +}); + +router.post('/totp/setup', authenticateToken, async (req, res) => { + try { + const userId = req.user.userId; + const users = await query('SELECT id, email, totp_secret, totp_enabled FROM users WHERE id = ?', [userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + if (users[0].totp_enabled) { + return res.status(400).json({ error: 'Two-factor authentication is already enabled' }); + } + + const secret = generateSecret(); + const otpauth = generateURI({issuer: 'ZeroHost', label: req.user.email, secret}); + const qrCode = await QRCode.toDataURL(otpauth); + + await query('UPDATE users SET totp_secret = ? WHERE id = ?', [secret, userId]); + + res.json({ secret, qrCode }); + } catch (err) { + console.error('TOTP setup error:', err.message); + res.status(500).json({ error: 'Failed to setup two-factor authentication' }); + } +}); + +router.post('/totp/enable', authenticateToken, async (req, res) => { + try { + const { code } = req.body; + const userId = req.user.userId; + + if (!code) { + return res.status(400).json({ error: 'Verification code is required' }); + } + + const users = await query('SELECT id, totp_secret, totp_enabled FROM users WHERE id = ?', [userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + if (users[0].totp_enabled) { + return res.status(400).json({ error: 'Two-factor authentication is already enabled' }); + } + if (!users[0].totp_secret) { + return res.status(400).json({ error: 'Please start the setup first' }); + } + + const verifyResult = await verify({ token: code, secret: users[0].totp_secret }); + if (!verifyResult.valid) { + return res.status(400).json({ error: 'Invalid verification code. Please try again.' }); + } + + const recoveryCodes = generateRecoveryCodes(8); + const hashedCodes = recoveryCodes.map(hashRecoveryCode); + + await query( + 'UPDATE users SET totp_enabled = 1, recovery_codes = ? WHERE id = ?', + [JSON.stringify(hashedCodes), userId] + ); + + await logActivity(userId, 'totp_enabled', 'Enabled two-factor authentication'); + + res.json({ message: 'Two-factor authentication enabled successfully', recoveryCodes }); + } catch (err) { + console.error('TOTP enable error:', err.message); + res.status(500).json({ error: 'Failed to enable two-factor authentication' }); + } +}); + +router.post('/totp/disable', authenticateToken, async (req, res) => { + try { + const { password } = req.body; + const userId = req.user.userId; + + if (!password) { + return res.status(400).json({ error: 'Password is required' }); + } + + const users = await query('SELECT id, password_hash FROM users WHERE id = ?', [userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + + const valid = await argon2.verify(users[0].password_hash, password, { type: argon2.argon2id }); + if (!valid) { + return res.status(401).json({ error: 'Password is incorrect' }); + } + + await query( + 'UPDATE users SET totp_secret = NULL, totp_enabled = 0, recovery_codes = NULL WHERE id = ?', + [userId] + ); + + await logActivity(userId, 'totp_disabled', 'Disabled two-factor authentication'); + + res.json({ message: 'Two-factor authentication disabled successfully' }); + } catch (err) { + console.error('TOTP disable error:', err.message); + res.status(500).json({ error: 'Failed to disable two-factor authentication' }); + } +}); + +router.post('/totp/verify', async (req, res) => { + try { + const { code, tempToken } = req.body; + + if (!code || !tempToken) { + return res.status(400).json({ error: 'Code and temporary token are required' }); + } + + let decoded; + try { + decoded = jwt.verify(tempToken, JWT_SECRET); + } catch { + return res.status(401).json({ error: 'Session expired. Please log in again.' }); + } + + if (!decoded.totpTemp) { + return res.status(401).json({ error: 'Invalid session' }); + } + + const userId = decoded.userId; + + const users = await query( + `SELECT id, email, username, totp_secret, totp_enabled, recovery_codes, + is_admin, restricted, token_version, ptero_user_id, + first_name, last_name, email_verified, auth_restricted + FROM users WHERE id = ?`, + [userId] + ); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + + const user = users[0]; + if (!user.totp_enabled) { + return res.status(400).json({ error: 'Two-factor authentication is not enabled' }); + } + if (user.auth_restricted) { + return res.status(403).json({ error: 'Your account has been restricted.' }); + } + + const verifyResult = await verify({ token: code, secret: user.totp_secret }); + if (!verifyResult.valid) { + return res.status(401).json({ error: 'Invalid verification code' }); + } + + const token = generateToken({ + userId: user.id, + email: user.email, + username: user.username, + pteroId: user.ptero_user_id, + isAdmin: !!user.is_admin, + restricted: !!user.restricted, + tokenVersion: user.token_version, + }); + + res.cookie('token', token, { + httpOnly: true, + secure: true, + sameSite: 'strict', + maxAge: 2 * 60 * 60 * 1000, + }); + + await query('UPDATE users SET user_agent = ? WHERE id = ?', [ + (req.headers['user-agent'] || 'unknown').toString().slice(0, 512), + user.id + ]).catch(() => {}); + + await logActivity(userId, 'login_totp', 'Signed in with two-factor authentication'); + + res.json({ + token, + user: { + id: user.id, + email: user.email, + username: user.username, + pteroId: user.ptero_user_id, + firstName: user.first_name, + lastName: user.last_name, + isAdmin: !!user.is_admin, + restricted: !!user.restricted, + emailVerified: !!user.email_verified, + gravatarHash: gravatarHash(user.email), + }, + }); + } catch (err) { + console.error('TOTP verify error:', err.message); + res.status(500).json({ error: 'Verification failed' }); + } +}); + +router.post('/totp/recovery', async (req, res) => { + try { + const { code, tempToken } = req.body; + + if (!code || !tempToken) { + return res.status(400).json({ error: 'Recovery code and temporary token are required' }); + } + + let decoded; + try { + decoded = jwt.verify(tempToken, JWT_SECRET); + } catch { + return res.status(401).json({ error: 'Session expired. Please log in again.' }); + } + + if (!decoded.totpTemp) { + return res.status(401).json({ error: 'Invalid session' }); + } + + const userId = decoded.userId; + const users = await query( + `SELECT * FROM users WHERE id = ?`, + [userId] + ); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + + const user = users[0]; + if (!user.totp_enabled || !user.recovery_codes) { + return res.status(400).json({ error: 'No recovery codes available' }); + } + + const storedCodes = JSON.parse(user.recovery_codes); + const hashedInput = hashRecoveryCode(code.toUpperCase()); + + const codeIndex = storedCodes.findIndex(h => h === hashedInput); + if (codeIndex === -1) { + return res.status(401).json({ error: 'Invalid recovery code' }); + } + + storedCodes.splice(codeIndex, 1); + await query('UPDATE users SET recovery_codes = ? WHERE id = ?', [JSON.stringify(storedCodes), userId]); + + await logActivity(userId, 'recovery_code_used', 'Used a recovery code to sign in'); + + const jwtToken = generateToken({ + userId: user.id, + email: user.email, + username: user.username, + pteroId: user.ptero_user_id, + isAdmin: !!user.is_admin, + restricted: !!user.restricted, + tokenVersion: user.token_version, + }); + + res.cookie('token', jwtToken, { + httpOnly: true, + secure: true, + sameSite: 'strict', + maxAge: 2 * 60 * 60 * 1000, + }); + + await query('UPDATE users SET user_agent = ? WHERE id = ?', [ + (req.headers['user-agent'] || 'unknown').toString().slice(0, 512), + user.id + ]).catch(() => {}); + + res.json({ + token: jwtToken, + user: { + id: user.id, + email: user.email, + username: user.username, + pteroId: user.ptero_user_id, + firstName: user.first_name, + lastName: user.last_name, + isAdmin: !!user.is_admin, + restricted: !!user.restricted, + emailVerified: !!user.email_verified, + gravatarHash: gravatarHash(user.email), + }, + }); + } catch (err) { + console.error('TOTP recovery error:', err.message); + res.status(500).json({ error: 'Recovery code verification failed' }); + } +}); + +router.get('/totp/recovery-codes', authenticateToken, async (req, res) => { + try { + const users = await query('SELECT totp_enabled, recovery_codes FROM users WHERE id = ?', [req.user.userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + + const user = users[0]; + if (!user.totp_enabled) { + return res.json({ enabled: false, remaining: 0, codes: [] }); + } + + const codes = user.recovery_codes ? JSON.parse(user.recovery_codes) : []; + res.json({ + enabled: true, + remaining: codes.length, + }); + } catch (err) { + console.error('TOTP recovery codes error:', err.message); + res.status(500).json({ error: 'Failed to fetch recovery codes' }); + } +}); + +router.post('/totp/recovery-codes/regenerate', authenticateToken, async (req, res) => { + try { + const userId = req.user.userId; + const users = await query('SELECT totp_enabled FROM users WHERE id = ?', [userId]); + if (users.length === 0) return res.status(404).json({ error: 'User not found' }); + if (!users[0].totp_enabled) { + return res.status(400).json({ error: 'Two-factor authentication is not enabled' }); + } + + const newCodes = generateRecoveryCodes(8); + const hashedCodes = newCodes.map(hashRecoveryCode); + + await query('UPDATE users SET recovery_codes = ? WHERE id = ?', [JSON.stringify(hashedCodes), userId]); + + await logActivity(userId, 'recovery_codes_regenerated', 'Regenerated recovery codes'); + + res.json({ recoveryCodes: newCodes }); + } catch (err) { + console.error('TOTP regenerate recovery codes error:', err.message); + res.status(500).json({ error: 'Failed to regenerate recovery codes' }); + } +}); + +export default router; diff --git a/server.js b/server.js index da7b575..26e012b 100644 --- a/server.js +++ b/server.js @@ -28,6 +28,7 @@ import crypto from 'crypto'; import authRoutes from './routes/auth.js'; import passkeyRoutes from './routes/passkeys.js'; +import totpRoutes from './routes/totp.js'; import serverRoutes from './routes/servers.js'; import adminRoutes from './routes/admin.js'; import notificationRoutes from './routes/notifications.js'; @@ -36,6 +37,8 @@ import { migrate } from './config/migrate.js'; import { query, closePool, getPoolStatus } from './config/db.js'; import { getRecentActivity } from './services/activity.js'; import { authenticateToken } from './middleware/auth.js'; +import { ensureLogFile, writeLog, startLogCleaner } from './services/fileLogger.js'; +import { advancedBotProtection, vpnProxyProtection, countryBlock, browserIntegrityCheck } from './middleware/security.js'; const app = express(); @@ -62,6 +65,19 @@ app.use((req, res, next) => { next(); }); +app.use((req, res, next) => { + if (req.path.startsWith('/api/')) { + const ip = req.ip || req.socket.remoteAddress || '0.0.0.0'; + writeLog(req.method, req.path, ip); + } + next(); +}); + +app.use('/api', advancedBotProtection()); +app.use('/api', browserIntegrityCheck()); +app.use('/api', vpnProxyProtection()); +app.use('/api', countryBlock()); + const activeRequests = new Map(); app.use((req, res, next) => { @@ -162,7 +178,7 @@ app.use((err, req, res, next) => { }); app.use(cookieParser(process.env.COOKIE_SECRET)); -const csrfExemptPaths = ['/api/auth/login', '/api/auth/register', '/api/auth/passkey/options', '/api/auth/passkey/verify', '/api/auth/passkeys/login/begin', '/api/auth/passkeys/login/complete', '/api/auth/passkeys/register/begin', '/api/auth/passkeys/register/complete']; +const csrfExemptPaths = ['/api/auth/login', '/api/auth/register', '/api/auth/passkey/options', '/api/auth/passkey/verify', '/api/auth/passkeys/login/begin', '/api/auth/passkeys/login/complete', '/api/auth/passkeys/register/begin', '/api/auth/passkeys/register/complete', '/api/auth/totp/verify', '/api/auth/totp/recovery']; app.use((req, res, next) => { if (!req.path.startsWith('/api/')) return next(); if (csrfExemptPaths.includes(req.path)) return next(); @@ -271,6 +287,7 @@ app.get('/api/config', (req, res) => { app.use('/api/auth', authRoutes); app.use('/api/auth', passkeyRoutes); +app.use('/api/auth', totpRoutes); app.use('/api/servers', serverRoutes); app.use('/api/admin', adminRoutes); app.use('/api/notifications', notificationRoutes); @@ -343,10 +360,13 @@ app.use((err, req, res, _next) => { res.status(err.status || 500).json({ error: message, requestId: req.requestId }); }); -migrate().then(() => { +async function startServer() { + await ensureLogFile(); + await migrate(); const server = app.listen(PORT, () => { console.log(`ZeroHost Dashboard running on port ${PORT}`); startScheduler(); + startLogCleaner(); }); function shutdown(signal) { @@ -364,8 +384,10 @@ migrate().then(() => { process.on('SIGTERM', () => shutdown('SIGTERM')); process.on('SIGINT', () => shutdown('SIGINT')); -}).catch(err => { - console.error('Migration failed:', err); +} + +startServer().catch(err => { + console.error('Startup failed:', err); process.exit(1); }); diff --git a/services/fileLogger.js b/services/fileLogger.js new file mode 100644 index 0000000..aeb76a5 --- /dev/null +++ b/services/fileLogger.js @@ -0,0 +1,177 @@ +import { appendFile, access, constants, readFile, writeFile } from 'fs/promises'; +import { resolve, dirname } from 'path'; +import { fileURLToPath } from 'url'; + +const __dirname = dirname(fileURLToPath(import.meta.url)); +const LOG_FILE = resolve(__dirname, '..', 'log.txt'); + +const actionLabels = [ + // Auth + { pattern: /^GET \/api\/auth\/onboarding-status$/, label: 'Statut d\'onboarding' }, + { pattern: /^POST \/api\/auth\/complete-onboarding$/, label: 'Fin d\'onboarding' }, + { pattern: /^POST \/api\/auth\/register$/, label: 'Inscription' }, + { pattern: /^POST \/api\/auth\/login$/, label: 'Connexion' }, + { pattern: /^POST \/api\/auth\/logout$/, label: 'Déconnexion' }, + { pattern: /^POST \/api\/auth\/change-password$/, label: 'Changement de mot de passe' }, + { pattern: /^POST \/api\/auth\/change-email$/, label: 'Demande de changement d\'email' }, + { pattern: /^GET \/api\/auth\/change-email\/verify$/, label: 'Vérification de changement d\'email' }, + { pattern: /^POST \/api\/auth\/change-email\/confirm$/, label: 'Confirmation de changement d\'email' }, + { pattern: /^POST \/api\/auth\/delete-account$/, label: 'Suppression de compte' }, + { pattern: /^GET \/api\/auth\/check-availability$/, label: 'Vérification de disponibilité' }, + { pattern: /^GET \/api\/auth\/check-vpn$/, label: 'Vérification VPN' }, + { pattern: /^GET \/api\/auth\/verify-email$/, label: 'Vérification d\'email' }, + { pattern: /^POST \/api\/auth\/resend-verification$/, label: 'Renvoi de vérification d\'email' }, + { pattern: /^GET \/api\/auth\/export-data$/, label: 'Export de données' }, + + // Passkeys + { pattern: /^POST \/api\/auth\/passkeys\/register\/begin$/, label: 'Début d\'enregistrement de passkey' }, + { pattern: /^POST \/api\/auth\/passkeys\/register\/complete$/, label: 'Enregistrement de passkey' }, + { pattern: /^POST \/api\/auth\/passkeys\/login\/begin$/, label: 'Début de connexion par passkey' }, + { pattern: /^POST \/api\/auth\/passkeys\/login\/complete$/, label: 'Connexion par passkey' }, + { pattern: /^GET \/api\/auth\/passkeys$/, label: 'Liste des passkeys' }, + { pattern: /^DELETE \/api\/auth\/passkeys\/\d+$/, label: 'Suppression de passkey' }, + + // TOTP + { pattern: /^GET \/api\/auth\/totp\/status$/, label: 'Statut TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/setup$/, label: 'Configuration TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/enable$/, label: 'Activation TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/disable$/, label: 'Désactivation TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/verify$/, label: 'Vérification TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/recovery$/, label: 'Code de récupération TOTP' }, + { pattern: /^GET \/api\/auth\/totp\/recovery-codes$/, label: 'Codes de récupération TOTP' }, + { pattern: /^POST \/api\/auth\/totp\/recovery-codes\/regenerate$/, label: 'Régénération de codes TOTP' }, + + // Servers + { pattern: /^GET \/api\/servers\/list$/, label: 'Liste des serveurs' }, + { pattern: /^GET \/api\/servers\/nests$/, label: 'Liste des nests' }, + { pattern: /^GET \/api\/servers\/eggs$/, label: 'Liste des eggs' }, + { pattern: /^GET \/api\/servers\/overview$/, label: 'Aperçu des serveurs' }, + { pattern: /^POST \/api\/servers\/create$/, label: 'Création de serveur' }, + { pattern: /^GET \/api\/servers\/details\/\d+$/, label: 'Détails du serveur' }, + { pattern: /^POST \/api\/servers\/renew\/\d+$/, label: 'Renouvellement de serveur' }, + { pattern: /^PATCH \/api\/servers\/\d+$/, label: 'Renommage de serveur' }, + { pattern: /^POST \/api\/servers\/\d+\/reinstall$/, label: 'Réinstallation de serveur' }, + { pattern: /^DELETE \/api\/servers\/\d+$/, label: 'Suppression de serveur' }, + { pattern: /^POST \/api\/servers\/power\/[A-Za-z0-9]+$/, label: 'Action d\'alimentation du serveur' }, + { pattern: /^GET \/api\/servers\/client-api-key$/, label: 'Vérification de clé API' }, + { pattern: /^PUT \/api\/servers\/client-api-key$/, label: 'Mise à jour de clé API' }, + { pattern: /^DELETE \/api\/servers\/client-api-key$/, label: 'Suppression de clé API' }, + + // Admin - Auth + { pattern: /^POST \/api\/admin\/login$/, label: 'Connexion admin' }, + { pattern: /^GET \/api\/admin\/check$/, label: 'Vérification admin' }, + + // Admin - Servers + { pattern: /^GET \/api\/admin\/servers$/, label: 'Liste des serveurs (admin)' }, + { pattern: /^GET \/api\/admin\/servers\/\d+$/, label: 'Détails du serveur (admin)' }, + { pattern: /^POST \/api\/admin\/servers\/\d+\/suspend$/, label: 'Suspension de serveur (admin)' }, + { pattern: /^POST \/api\/admin\/servers\/\d+\/unsuspend$/, label: 'Réactivation de serveur (admin)' }, + { pattern: /^POST \/api\/admin\/servers\/\d+\/stop$/, label: 'Arrêt de serveur (admin)' }, + { pattern: /^POST \/api\/admin\/servers\/\d+\/renew-now$/, label: 'Expiration forcée de serveur (admin)' }, + { pattern: /^DELETE \/api\/admin\/servers\/\d+$/, label: 'Suppression de serveur (admin)' }, + + // Admin - Nodes + { pattern: /^GET \/api\/admin\/nodes$/, label: 'Liste des nodes (admin)' }, + { pattern: /^GET \/api\/admin\/nodes\/\d+$/, label: 'Détails du node (admin)' }, + { pattern: /^GET \/api\/admin\/nodes\/\d+\/allocations$/, label: 'Allocations du node (admin)' }, + { pattern: /^GET \/api\/admin\/nodes\/\d+\/servers$/, label: 'Serveurs du node (admin)' }, + { pattern: /^GET \/api\/admin\/nodes\/\d+\/settings$/, label: 'Paramètres du node (admin)' }, + { pattern: /^PUT \/api\/admin\/nodes\/\d+\/settings$/, label: 'Modification des paramètres du node (admin)' }, + { pattern: /^GET \/api\/admin\/nodes\/unavailable$/, label: 'Nodes indisponibles (admin)' }, + + // Admin - Users + { pattern: /^GET \/api\/admin\/users$/, label: 'Liste des utilisateurs (admin)' }, + { pattern: /^GET \/api\/admin\/users\/\d+$/, label: 'Détails de l\'utilisateur (admin)' }, + { pattern: /^POST \/api\/admin\/users\/\d+\/toggle-restriction$/, label: 'Restriction d\'utilisateur (admin)' }, + { pattern: /^POST \/api\/admin\/users\/\d+\/toggle-auth-restriction$/, label: 'Restriction d\'auth (admin)' }, + { pattern: /^POST \/api\/admin\/users\/\d+\/toggle-admin$/, label: 'Changement de rôle admin (admin)' }, + { pattern: /^POST \/api\/admin\/users\/\d+\/notify$/, label: 'Notification à un utilisateur (admin)' }, + { pattern: /^POST \/api\/admin\/notify-all$/, label: 'Notification à tous (admin)' }, + { pattern: /^DELETE \/api\/admin\/users\/\d+$/, label: 'Suppression d\'utilisateur (admin)' }, + + // Admin - Stats & Activity + { pattern: /^GET \/api\/admin\/stats$/, label: 'Statistiques (admin)' }, + { pattern: /^GET \/api\/admin\/activity$/, label: 'Journal d\'activité (admin)' }, + + // Admin - Settings Nests + { pattern: /^GET \/api\/admin\/settings\/nests$/, label: 'Paramètres des nests (admin)' }, + { pattern: /^GET \/api\/admin\/settings\/nests\/available$/, label: 'Nests disponibles (admin)' }, + { pattern: /^POST \/api\/admin\/settings\/nests$/, label: 'Ajout de nest (admin)' }, + { pattern: /^PUT \/api\/admin\/settings\/nests\/\d+$/, label: 'Modification de nest (admin)' }, + { pattern: /^DELETE \/api\/admin\/settings\/nests\/\d+$/, label: 'Suppression de nest (admin)' }, + + // Admin - Settings Eggs + { pattern: /^GET \/api\/admin\/settings\/nests\/\d+\/eggs$/, label: 'Eggs du nest (admin)' }, + { pattern: /^GET \/api\/admin\/settings\/eggs\/\d+\/\d+$/, label: 'Paramètres de l\'egg (admin)' }, + { pattern: /^PUT \/api\/admin\/settings\/eggs\/\d+\/\d+$/, label: 'Modification de l\'egg (admin)' }, + { pattern: /^POST \/api\/admin\/settings\/eggs\/\d+\/\d+\/apply-all$/, label: 'Appliquer ressources à tous (admin)' }, + + // Notifications + { pattern: /^GET \/api\/notifications\/$/, label: 'Liste des notifications' }, + { pattern: /^GET \/api\/notifications\/unread-count$/, label: 'Notifications non lues' }, + { pattern: /^PATCH \/api\/notifications\/\d+\/read$/, label: 'Marquer notification comme lue' }, + { pattern: /^PATCH \/api\/notifications\/read-all$/, label: 'Marquer toutes les notifications comme lues' }, + + // General + { pattern: /^GET \/api\/activity$/, label: 'Journal d\'activité' }, + { pattern: /^GET \/api\/health$/, label: 'Vérification de santé' }, + { pattern: /^GET \/api\/config$/, label: 'Configuration' }, +]; + +function getActionLabel(method, path) { + const key = `${method} ${path}`; + for (const { pattern, label } of actionLabels) { + if (pattern.test(key)) return label; + } + return null; +} + +export async function ensureLogFile() { + try { + await access(LOG_FILE, constants.F_OK); + } catch { + await appendFile(LOG_FILE, '', 'utf-8'); + console.log('Created log.txt'); + } +} + +const ONE_YEAR = 365 * 24 * 60 * 60 * 1000; + +export async function cleanOldLogs() { + try { + const content = await readFile(LOG_FILE, 'utf-8'); + if (!content) return; + const cutoff = Date.now() - ONE_YEAR; + const lines = content.split('\n').filter(line => { + if (!line.trim()) return false; + const match = line.match(/^\[(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\]/); + if (!match) return true; + const ts = new Date(match[1].replace(' ', 'T') + 'Z').getTime(); + return ts >= cutoff; + }); + const cleaned = lines.join('\n') + (lines.length > 0 ? '\n' : ''); + await writeFile(LOG_FILE, cleaned, 'utf-8'); + } catch (err) { + if (err.code !== 'ENOENT') { + console.error('Failed to clean old logs:', err.message); + } + } +} + +export function startLogCleaner() { + cleanOldLogs(); + setInterval(cleanOldLogs, 24 * 60 * 60 * 1000); +} + +export async function writeLog(method, path, ip) { + const label = getActionLabel(method, path); + const date = new Date(); + const timestamp = date.toISOString().replace('T', ' ').slice(0, 19); + const desc = label ? ` (${label})` : ''; + const line = `[${timestamp}] ${method} ${path}${desc} - ${ip}\n`; + try { + await appendFile(LOG_FILE, line, 'utf-8'); + } catch (err) { + console.error('Failed to write to log.txt:', err.message); + } +} diff --git a/services/security.js b/services/security.js new file mode 100644 index 0000000..9b9f23f --- /dev/null +++ b/services/security.js @@ -0,0 +1,530 @@ +import { isIP } from 'net'; +import { resolve } from 'path'; +import { readFile } from 'fs/promises'; + +const CLOUD_PROVIDER_ASNS = new Set([ + 'AS16509', 'AS39111', 'AS45102', 'AS16276', 'AS36351', 'AS13335', + 'AS14618', 'AS16509', 'AS20115', 'AS16509', 'AS14618', 'AS8987', + 'AS26496', 'AS30083', 'AS40065', 'AS46690', 'AS29791', 'AS36492', + 'AS55095', 'AS55059', 'AS13876', 'AS20326', 'AS21342', 'AS22385', + 'AS36352', 'AS20473', 'AS62567', 'AS32780', 'AS394906', 'AS54203', + 'AS53363', 'AS11878', 'AS14061', 'AS46664', 'AS147008', 'AS199524', + 'AS396982', 'AS63949', 'AS60068', 'AS55286', 'AS20454', 'AS53869', + 'AS19551', 'AS8455', 'AS29073', 'AS16302', 'AS21277', 'AS49333', + 'AS58057', 'AS59441', 'AS206264', 'AS61138', +]); + +const BOT_UA_PATTERNS = [ + /curl\//i, /wget\//i, /node-fetch/i, /python-requests/i, + /python-httpx/i, /urllib/i, /aiohttp/i, /go-http-client/i, + /java\/\d+/i, /libcurl/i, /okhttp/i, /httpie/i, + /postmanruntime/i, /insomnia/i, /axios\//i, /fetch\//i, + /ruby\//i, /perl\//i, /php\/\d+/i, /nethttp/i, /http-client/i, + /scrapy/i, /python-urllib/i, /robot/i, /spider/i, /crawler/i, + /masscan/i, /nmap/i, /zgrab/i, /fscan/i, /pure-native/i, + /fasthttp/i, /restsharp/i, /datadog/i, /newrelic/i, + /ahc\//i, /async-http/i, /lwp::simple/i, /www-mechanize/i, + /python-requests\/\d/i, /httpx/i, /httplib2/i, + /selenium/i, /puppeteer/i, /playwright/i, /cypress/i, + /headless/i, /phantomjs/i, /nightmare/i, + /Mozilla\/5\.0\s*$/i, /Mozilla\/4\.0\s*$/i, + /^$/, /^-$/, +]; + +const REQUIRED_BROWSER_HEADERS = { + 'accept': /^text\/html|application\/json|\*\/\*/, + 'accept-language': /^[a-z]{2}(-[A-Z]{2})?(,[a-z]{2}(-[A-Z]{2})?)*$/, + 'sec-fetch-site': /^(none|same-origin|same-site|cross-site)$/, + 'sec-fetch-mode': /^(navigate|same-origin|cors|no-cors)$/, + 'sec-fetch-dest': /^(document|empty|iframe|script)$/, +}; + +const FOUR_SECONDS = 4000; + +export function getClientIp(req) { + const forwarded = req.headers['x-forwarded-for']; + if (forwarded) return forwarded.split(',')[0].trim(); + return req.ip || req.socket.remoteAddress || '0.0.0.0'; +} + +export function isPrivateIp(ip) { + const clean = typeof ip === 'string' ? ip.replace(/^::ffff:/, '') : ''; + if (!clean || !isIP(clean)) return false; + if (clean === '127.0.0.1' || clean === '::1' || clean === '0.0.0.0') return true; + if (clean.startsWith('192.168.') || clean.startsWith('10.') || clean.startsWith('172.16.')) return true; + if (/^f[cde][0-9a-f]{2}:/i.test(clean)) return true; + if (clean.startsWith('169.254.')) return true; + return false; +} + +export function normalizeIp(ip) { + if (typeof ip !== 'string') return null; + const trimmed = ip.trim(); + if (!trimmed) return null; + return trimmed.replace(/^::ffff:/, ''); +} + +export function checkHeaders(req) { + const issues = []; + if (!req.headers['accept']) issues.push('missing_accept'); + if (!req.headers['accept-language']) issues.push('missing_accept_language'); + const ua = (req.headers['user-agent'] || '').toLowerCase(); + if (!ua) issues.push('missing_ua'); + if (ua.length > 0 && ua.length < 20) issues.push('short_ua'); + if (ua === 'mozilla/5.0') issues.push('generic_ua'); + if (!req.headers['sec-ch-ua'] && !req.headers['sec-ch-ua-mobile']) { + if (!ua.includes('headless') && !ua.includes('bot')) { + issues.push('missing_sec_ch_ua'); + } + } + return issues; +} + +export function isBotUserAgent(ua) { + if (!ua || typeof ua !== 'string') return true; + const clean = ua.toString().slice(0, 512); + if (clean.length < 10) return true; + if (clean === 'Mozilla/5.0' || clean === 'Mozilla/4.0') return true; + for (const pattern of BOT_UA_PATTERNS) { + if (pattern.test(clean)) return true; + } + return false; +} + +export function isKnownBotIp(ip) { + const clean = typeof ip === 'string' ? ip.replace(/^::ffff:/, '') : ''; + if (!clean || !isIP(clean)) return false; + const parts = clean.split('.').map(Number); + if (parts.length !== 4) return false; + if (parts[0] === 3) return true; + if (parts[0] === 15) return true; + if (parts[0] === 23) return true; + if (parts[0] === 34) return true; + if (parts[0] === 35) return true; + if (parts[0] === 44) return true; + if (parts[0] === 45 && parts[1] === 8) return true; + if (parts[0] === 45 && parts[1] === 14) return true; + if (parts[0] === 45 && parts[1] === 15) return true; + if (parts[0] === 45 && parts[1] === 33) return true; + if (parts[0] === 45 && parts[1] === 40) return true; + if (parts[0] === 45 && parts[1] === 62) return true; + if (parts[0] === 45 && parts[1] === 64) return true; + if (parts[0] === 45 && parts[1] === 79) return true; + if (parts[0] === 45 && parts[1] === 80) return true; + if (parts[0] === 45 && parts[1] === 83) return true; + if (parts[0] === 45 && parts[1] === 88) return true; + if (parts[0] === 45 && parts[1] === 91) return true; + if (parts[0] === 45 && parts[1] === 94) return true; + if (parts[0] === 45 && parts[1] === 128) return true; + if (parts[0] === 45 && parts[1] === 135) return true; + if (parts[0] === 45 && parts[1] === 143) return true; + if (parts[0] === 45 && parts[1] === 148) return true; + if (parts[0] === 45 && parts[1] === 150) return true; + if (parts[0] === 45 && parts[1] === 152) return true; + if (parts[0] === 45 && parts[1] === 153) return true; + if (parts[0] === 45 && parts[1] === 155) return true; + if (parts[0] === 47) return true; + if (parts[0] === 51) return true; + if (parts[0] === 54) return true; + if (parts[0] === 63 && parts[1] === 32) return true; + if (parts[0] === 63 && parts[1] === 35) return true; + if (parts[0] === 64 && parts[1] === 62) return true; + if (parts[0] === 64 && parts[1] === 90) return true; + if (parts[0] === 65) return true; + if (parts[0] === 66) return true; + if (parts[0] === 67) return true; + if (parts[0] === 68) return true; + if (parts[0] === 69) return true; + if (parts[0] === 70) return true; + if (parts[0] === 71) return true; + if (parts[0] === 72) return true; + if (parts[0] === 73) return true; + if (parts[0] === 74) return true; + if (parts[0] === 75) return true; + if (parts[0] === 76) return true; + if (parts[0] === 77) return true; + if (parts[0] === 78) return true; + if (parts[0] === 79) return true; + if (parts[0] === 80) return true; + if (parts[0] === 81) return true; + if (parts[0] === 82) return true; + if (parts[0] === 83) return true; + if (parts[0] === 84) return true; + if (parts[0] === 85) return true; + if (parts[0] === 86) return true; + if (parts[0] === 87) return true; + if (parts[0] === 88) return true; + if (parts[0] === 89) return true; + if (parts[0] === 90) return true; + if (parts[0] === 91) return true; + if (parts[0] === 92) return true; + if (parts[0] === 93) return true; + if (parts[0] === 94) return true; + if (parts[0] === 95) return true; + if (parts[0] === 96) return true; + if (parts[0] === 97) return true; + if (parts[0] === 98) return true; + if (parts[0] === 99) return true; + if (parts[0] === 100) return true; + if (parts[0] === 101) return true; + if (parts[0] === 102) return true; + if (parts[0] === 103) return true; + if (parts[0] === 104) return true; + if (parts[0] === 104 && parts[1] === 16) return true; + if (parts[0] === 104 && parts[1] === 17) return true; + if (parts[0] === 104 && parts[1] === 18) return true; + if (parts[0] === 104 && parts[1] === 19) return true; + if (parts[0] === 104 && parts[1] === 20) return true; + if (parts[0] === 104 && parts[1] === 21) return true; + if (parts[0] === 104 && parts[1] === 22) return true; + if (parts[0] === 104 && parts[1] === 23) return true; + if (parts[0] === 104 && parts[1] === 24) return true; + if (parts[0] === 104 && parts[1] === 25) return true; + if (parts[0] === 104 && parts[1] === 26) return true; + if (parts[0] === 104 && parts[1] === 27) return true; + if (parts[0] === 104 && parts[1] === 28) return true; + if (parts[0] === 105) return true; + if (parts[0] === 106) return true; + if (parts[0] === 107) return true; + if (parts[0] === 108) return true; + if (parts[0] === 109) return true; + if (parts[0] === 110) return true; + if (parts[0] === 111) return true; + if (parts[0] === 112) return true; + if (parts[0] === 113) return true; + if (parts[0] === 114) return true; + if (parts[0] === 115) return true; + if (parts[0] === 116) return true; + if (parts[0] === 117) return true; + if (parts[0] === 118) return true; + if (parts[0] === 119) return true; + if (parts[0] === 120) return true; + if (parts[0] === 121) return true; + if (parts[0] === 122) return true; + if (parts[0] === 123) return true; + if (parts[0] === 124) return true; + if (parts[0] === 125) return true; + if (parts[0] === 126) return true; + if (parts[0] === 128) return true; + if (parts[0] === 129) return true; + if (parts[0] === 130) return true; + if (parts[0] === 131) return true; + if (parts[0] === 132) return true; + if (parts[0] === 133) return true; + if (parts[0] === 134) return true; + if (parts[0] === 135) return true; + if (parts[0] === 136) return true; + if (parts[0] === 137) return true; + if (parts[0] === 138) return true; + if (parts[0] === 139) return true; + if (parts[0] === 140) return true; + if (parts[0] === 141) return true; + if (parts[0] === 142) return true; + if (parts[0] === 143) return true; + if (parts[0] === 144) return true; + if (parts[0] === 145) return true; + if (parts[0] === 146) return true; + if (parts[0] === 147) return true; + if (parts[0] === 148) return true; + if (parts[0] === 149) return true; + if (parts[0] === 150) return true; + if (parts[0] === 151) return true; + if (parts[0] === 152) return true; + if (parts[0] === 153) return true; + if (parts[0] === 154) return true; + if (parts[0] === 155) return true; + if (parts[0] === 156) return true; + if (parts[0] === 157) return true; + if (parts[0] === 158) return true; + if (parts[0] === 159) return true; + if (parts[0] === 160) return true; + if (parts[0] === 161) return true; + if (parts[0] === 162) return true; + if (parts[0] === 163) return true; + if (parts[0] === 164) return true; + if (parts[0] === 165) return true; + if (parts[0] === 166) return true; + if (parts[0] === 167) return true; + if (parts[0] === 168) return true; + if (parts[0] === 169) return true; + if (parts[0] === 170) return true; + if (parts[0] === 171) return true; + if (parts[0] === 172) return true; + if (parts[0] === 173) return true; + if (parts[0] === 174) return true; + if (parts[0] === 175) return true; + if (parts[0] === 176) return true; + if (parts[0] === 177) return true; + if (parts[0] === 178) return true; + if (parts[0] === 179) return true; + if (parts[0] === 180) return true; + if (parts[0] === 181) return true; + if (parts[0] === 182) return true; + if (parts[0] === 183) return true; + if (parts[0] === 184) return true; + if (parts[0] === 185) return true; + if (parts[0] === 186) return true; + if (parts[0] === 187) return true; + if (parts[0] === 188) return true; + if (parts[0] === 189) return true; + if (parts[0] === 190) return true; + if (parts[0] === 191) return true; + if (parts[0] === 192 && parts[1] === 0) return true; + if (parts[0] === 192 && parts[1] === 3) return true; + if (parts[0] === 193) return true; + if (parts[0] === 194) return true; + if (parts[0] === 195) return true; + if (parts[0] === 196) return true; + if (parts[0] === 197) return true; + if (parts[0] === 198) return true; + if (parts[0] === 199) return true; + if (parts[0] === 200) return true; + if (parts[0] === 201) return true; + if (parts[0] === 202) return true; + if (parts[0] === 203) return true; + if (parts[0] === 204) return true; + if (parts[0] === 205) return true; + if (parts[0] === 206) return true; + if (parts[0] === 207) return true; + if (parts[0] === 208) return true; + if (parts[0] === 209) return true; + if (parts[0] === 210) return true; + if (parts[0] === 211) return true; + if (parts[0] === 212) return true; + if (parts[0] === 213) return true; + if (parts[0] === 214) return true; + if (parts[0] === 215) return true; + if (parts[0] === 216) return true; + if (parts[0] === 217) return true; + if (parts[0] === 218) return true; + if (parts[0] === 219) return true; + if (parts[0] === 220) return true; + if (parts[0] === 221) return true; + if (parts[0] === 222) return true; + return false; +} + +export function checkHoneypot(body) { + const honeypotFields = ['website', 'url', 'homepage', 'message2', 'confirm_email', 'fax', 'phone2']; + for (const field of honeypotFields) { + if (body[field] !== undefined && body[field] !== '' && body[field] !== null) { + return { triggered: true, field }; + } + } + return { triggered: false }; +} + +export function validateBrowserSignature(req) { + const score = { total: 0, checks: [] }; + const accept = req.headers['accept'] || ''; + if (/text\/html|application\/json|\*\/\*/.test(accept)) { + score.total += 10; + score.checks.push('accept_pass'); + } else { + score.checks.push('accept_suspicious'); + } + const lang = req.headers['accept-language'] || ''; + if (/^[a-z]{2}(-[A-Z]{2})?(,[a-z]{2}(-[A-Z]{2})?)*$/.test(lang)) { + score.total += 10; + score.checks.push('lang_pass'); + } else { + score.checks.push('lang_suspicious'); + } + const fetchSite = req.headers['sec-fetch-site'] || ''; + if (fetchSite && /^(none|same-origin|same-site|cross-site)$/.test(fetchSite)) { + score.total += 15; + score.checks.push('sec_fetch_site_pass'); + } + const fetchMode = req.headers['sec-fetch-mode'] || ''; + if (fetchMode && /^(navigate|same-origin|cors|no-cors)$/.test(fetchMode)) { + score.total += 15; + score.checks.push('sec_fetch_mode_pass'); + } + const fetchDest = req.headers['sec-fetch-dest'] || ''; + if (fetchDest && /^(document|empty|iframe|script)$/.test(fetchDest)) { + score.total += 15; + score.checks.push('sec_fetch_dest_pass'); + } + const secChUa = req.headers['sec-ch-ua'] || ''; + if (secChUa) { + score.total += 15; + score.checks.push('sec_ch_ua_pass'); + } + const dnt = req.headers['dnt'] || req.headers['sec-gpc'] || ''; + if (dnt) { + score.total += 5; + score.checks.push('dnt_pass'); + } + const ua = (req.headers['user-agent'] || '').toLowerCase(); + if (ua.includes('windows') || ua.includes('mac') || ua.includes('linux') || ua.includes('android') || ua.includes('ios') || ua.includes('iphone') || ua.includes('like mac')) { + score.total += 15; + score.checks.push('os_pass'); + } + score.passed = score.total >= 60; + return score; +} + +export function validateRequestTiming(req) { + const timing = req.headers['x-request-start'] || req.headers['x-timing'] || req.query._t || ''; + if (!timing) return { passed: false, reason: 'no_timing' }; + const startTime = parseInt(timing.toString(), 10); + if (isNaN(startTime) || startTime <= 0) return { passed: false, reason: 'invalid_timing' }; + const elapsed = Date.now() - startTime; + if (elapsed < FOUR_SECONDS) return { passed: false, reason: 'too_fast' }; + return { passed: true, elapsed }; +} + +const CACHE_DURATION = 15 * 60 * 1000; +const VPN_CACHE = new Map(); +const ASN_CACHE = new Map(); + +setInterval(() => { + const cutoff = Date.now() - CACHE_DURATION; + for (const [key, entry] of VPN_CACHE) { + if (entry.timestamp < cutoff) VPN_CACHE.delete(key); + } + for (const [key, entry] of ASN_CACHE) { + if (entry.timestamp < cutoff) ASN_CACHE.delete(key); + } +}, 5 * 60 * 1000); + +async function fetchWithTimeout(url, options = {}, timeout = 5000) { + const controller = new AbortController(); + const timer = setTimeout(() => controller.abort(), timeout); + try { + return await fetch(url, { ...options, signal: controller.signal }); + } finally { + clearTimeout(timer); + } +} + +export async function detectVpnProxy(ip) { + const cleanIp = normalizeIp(ip); + if (!cleanIp || isPrivateIp(cleanIp)) return { isVpn: false, isProxy: false, source: 'private' }; + const cached = VPN_CACHE.get(cleanIp); + if (cached && (Date.now() - cached.timestamp < CACHE_DURATION)) { + return cached.result; + } + let result = { isVpn: false, isProxy: false, source: 'none' }; + let asn = null; + try { + const res = await fetchWithTimeout(`http://ip-api.com/json/${encodeURIComponent(cleanIp)}?fields=proxy,hosting,isp,org,as,query`); + const data = await res.json(); + if (data.proxy === true || data.hosting === true) { + result = { isVpn: true, isProxy: data.proxy === true, source: 'ip-api' }; + } + asn = data.as || null; + if (asn && CLOUD_PROVIDER_ASNS.has(asn)) { + result = { isVpn: true, isProxy: true, source: 'asn', asn }; + } + } catch {} + if (asn) { + ASN_CACHE.set(cleanIp, { asn, timestamp: Date.now() }); + } + if (!result.isVpn) { + try { + const res = await fetchWithTimeout(`https://ipinfo.io/${encodeURIComponent(cleanIp)}/json`); + const data = await res.json(); + const org = (data.org || '').toLowerCase(); + if (org.includes('vpn') || org.includes('proxy') || org.includes('tor') || org.includes('datacenter') || org.includes('cloud') || org.includes('hosting')) { + result = { isVpn: true, isProxy: true, source: 'ipinfo' }; + } + if (!asn && data.asn) { + const asnCode = data.asn.split(' ')[0]; + if (CLOUD_PROVIDER_ASNS.has(asnCode)) { + result = { isVpn: true, isProxy: true, source: 'asn', asn: asnCode }; + } + } + } catch {} + } + if (!result.isVpn) { + try { + const res = await fetchWithTimeout(`https://vpnapi.io/api/${encodeURIComponent(cleanIp)}`); + const data = await res.json(); + if (data.security && (data.security.vpn || data.security.proxy || data.security.tor)) { + result = { isVpn: !!data.security.vpn, isProxy: !!data.security.proxy, isTor: !!data.security.tor, source: 'vpnapi' }; + } + } catch {} + } + if (!result.isVpn) { + try { + const torDnsbl = await resolveTorDnsbl(cleanIp); + if (torDnsbl) { + result = { isVpn: true, isTor: true, source: 'dnsbl' }; + } + } catch {} + } + VPN_CACHE.set(cleanIp, { result, timestamp: Date.now() }); + return result; +} + +async function resolveTorDnsbl(ip) { + try { + const parts = ip.split('.'); + if (parts.length !== 4) return false; + const reverseHost = `${parts[3]}.${parts[2]}.${parts[1]}.${parts[0]}.tor.dan.me.uk`; + const controller = new AbortController(); + const timer = setTimeout(() => controller.abort(), 3000); + try { + const res = await fetch(`http://${reverseHost}`, { signal: controller.signal }); + return res.status === 127; + } catch { + return false; + } finally { + clearTimeout(timer); + } + } catch { + return false; + } +} + +export function checkSuspiciousQueryParams(req) { + const query = req.query || {}; + const suspicious = ['debug', 'test', 'bypass', 'admin', 'sudo', 'cmd', 'exec', 'command', 'eval', 'system', 'shell', 'sql', 'union', 'select', 'from', 'where', 'drop', 'alter', 'create', 'insert', 'delete', 'update', '../', '..\\', '%00', '