log every auth attempt that names an identity the platform does not know

2026-08-06 05:31:10 +00:00
parent b6b9b01aa6
commit 1eb2140f95
6 changed files with 245 additions and 2 deletions
@@ -0,0 +1,170 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import { mkdirSync, statSync, renameSync } from 'node:fs';
+import { appendFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DATA_PATH } from '../data-path';
+import { isKnownIdentity, knownIdentityCount } from './known-users';
+
+// Every attempt to authenticate as somebody this platform has never heard of, written to a file.
+//
+// Officer has exactly one account and is reachable from the public internet, so a request naming any
+// other identity is never a mistyped login — it is somebody working through a list. That is worth a
+// durable record, and a durable record is the point: this is deliberately a FILE, not a table. It has
+// to survive the database being unreachable, has to be readable with `tail` from a terminal at 3am,
+// and has to be one `grep` away from an IP. JSON lines, appended, rotated once at 5 MB.
+//
+// WHAT IS NEVER WRITTEN: the password, or anything else credential-shaped. The attempt is the signal;
+// the secret adds nothing to it and would turn this file into a thing worth stealing. Bodies are
+// recorded as their KEY NAMES plus the identity fields — see safeBody(). Headers are recorded in full
+// except authorization/cookie, which become `[redacted:<length>]`, because how long a bearer somebody
+// forged is occasionally interesting and its bytes never are.
+//
+// The middleware only ever observes. It cannot reject, cannot change a response, and swallows its own
+// failures — a full disk must not be able to lock the owner out of their own platform.
+
+const LOG_DIR = join(DATA_PATH, 'logs');
+const LOG_PATH = join(LOG_DIR, 'auth-attempts.log');
+const ROTATED_PATH = join(LOG_DIR, 'auth-attempts.1.log');
+const MAX_BYTES = 5 * 1024 * 1024;
+
+/** Header names whose VALUE is a credential. Kept as a set of exact lowercase names, not a regex. */
+const SECRET_HEADERS = new Set(['authorization', 'cookie', 'proxy-authorization', 'x-api-key']);
+
+/** Body keys safe to record verbatim. Everything else contributes its name only. */
+const PUBLIC_BODY_KEYS = new Set(['email', 'username', 'name']);
+
+// Appends are chained rather than fired in parallel: two concurrent probes must not interleave halves
+// of two JSON lines into one unparseable one.
+let writeQueue: Promise<void> = Promise.resolve();
+let dirReady = false;
+
+function rotateIfNeeded() {
+  try {
+    if (statSync(LOG_PATH).size < MAX_BYTES) return;
+    renameSync(LOG_PATH, ROTATED_PATH);
+  } catch {
+    /* no file yet, or the rename lost a race — either way the append below still works */
+  }
+}
+
+function writeRecord(record: Record<string, unknown>) {
+  writeQueue = writeQueue
+    .then(async () => {
+      if (!dirReady) {
+        mkdirSync(LOG_DIR, { recursive: true });
+        dirReady = true;
+      }
+      rotateIfNeeded();
+      await appendFile(LOG_PATH, `${JSON.stringify(record)}\n`, 'utf8');
+    })
+    .catch((err) => {
+      console.error('[auth-audit] could not write the attempt log:', String(err));
+    });
+}
+
+const headerSnapshot = (ctx: Context): Record<string, string> => {
+  const out: Record<string, string> = {};
+  for (const [name, value] of Object.entries(ctx.req.header())) {
+    out[name] = SECRET_HEADERS.has(name.toLowerCase()) ? `[redacted:${value.length}]` : value;
+  }
+  return out;
+};
+
+/** Key names always; values only for the fields that identify rather than authenticate. */
+function safeBody(body: Record<string, unknown> | undefined): { keys: string[]; values: Record<string, string> } {
+  const keys = body ? Object.keys(body) : [];
+  const values: Record<string, string> = {};
+  for (const key of keys) {
+    if (!PUBLIC_BODY_KEYS.has(key)) continue;
+    const value = body?.[key];
+    if (typeof value === 'string') values[key] = value.slice(0, 200);
+  }
+  return { keys, values };
+}
+
+/**
+ * The identity a request is claiming. `POST /signin` and friends carry it in the body; the passkey
+ * routes put it in the last path segment (`/passkeys/signin/:email`). Read from the path directly
+ * rather than through `ctx.req.param`, which is not populated for a middleware mounted at the router
+ * root — the value would silently be undefined for exactly the unauthenticated routes that matter.
+ */
+function claimedIdentity(ctx: Context, path: string): string | null {
+  const body = ctx.get('body') as Record<string, unknown> | undefined;
+  for (const field of ['email', 'username'] as const) {
+    const value = body?.[field];
+    if (typeof value === 'string' && value.trim()) return value.trim().slice(0, 320);
+  }
+
+  if (!path.includes('/auth/passkeys/')) return null;
+  const last = decodeURIComponent(path.split('/').pop() ?? '');
+  return last.includes('@') ? last.slice(0, 320) : null;
+}
+
+const clientAddress = (ctx: Context): string =>
+  ctx.req.header('x-forwarded-for')?.split(',')[0]?.trim() || ctx.req.header('x-real-ip') || 'unknown';
+
+/**
+ * Mount on the auth router directly after `bodyParser()` and before everything else, so it wraps origin
+ * validation and the rate limiter too — a probe rejected at the origin check is precisely the one the
+ * owner wants a record of, and it never reaches a handler.
+ */
+export const authAudit: MiddlewareHandler = async (ctx, next) => {
+  const started = Date.now();
+  let failure: unknown = null;
+  try {
+    await next();
+  } catch (err) {
+    failure = err;
+    throw err;
+  } finally {
+    const url = new URL(ctx.req.url);
+    const identity = claimedIdentity(ctx, url.pathname);
+
+    // No name claimed → nothing to classify. Signout, /me and the token routes authenticate with a
+    // bearer, and their failures are the userMiddleware's business, not this file's.
+    if (identity) {
+      // Deliberately after next(): the handler may be slow, and blocking a login on a lookup that only
+      // decides whether to write a log line would be the wrong trade. The set is in memory anyway.
+      void isKnownIdentity(identity)
+        .then((known) => {
+          if (known) return;
+          const body = safeBody(ctx.get('body') as Record<string, unknown> | undefined);
+          const record = {
+            ts: new Date().toISOString(),
+            event: 'auth.unknown-identity',
+            identity,
+            method: ctx.req.method,
+            path: url.pathname,
+            query: url.search || null,
+            status: failure ? 'threw' : ctx.res.status,
+            ms: Date.now() - started,
+            ip: clientAddress(ctx),
+            forwardedFor: ctx.req.header('x-forwarded-for') ?? null,
+            realIp: ctx.req.header('x-real-ip') ?? null,
+            host: ctx.req.header('host') ?? null,
+            origin: ctx.req.header('origin') ?? null,
+            referer: ctx.req.header('referer') ?? null,
+            userAgent: ctx.req.header('user-agent') ?? null,
+            acceptLanguage: ctx.req.header('accept-language') ?? null,
+            contentType: ctx.req.header('content-type') ?? null,
+            bodyKeys: body.keys,
+            bodyValues: body.values,
+            headers: headerSnapshot(ctx),
+            knownIdentities: knownIdentityCount(),
+            error: failure ? String((failure as { message?: unknown })?.message ?? failure).slice(0, 300) : null,
+          };
+          writeRecord(record);
+          // Also to the process log, one line, so it surfaces in `pm2 logs officer` without anyone
+          // having to know this file exists.
+          console.warn(
+            `[auth-audit] unknown identity "${identity}" from ${record.ip} on ${record.method} ${url.pathname}`,
+          );
+        })
+        .catch(() => {
+          /* classification failed; never let it touch the response */
+        });
+    }
+  }
+};
+
+export const AUTH_AUDIT_LOG_PATH = LOG_PATH;