Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

Adds a layered set of protections around the admin login and the app edge.

Trust proxy (server/src/utils/trustProxy.js)
- Configurable via TRUST_PROXY; pin to the newt agent ("ptero") LAN IP so
  X-Forwarded-For is trusted ONLY from that peer. A blanket "true" is
  rejected (coerced to 1) to prevent XFF spoofing that would dodge every
  IP-based control. DEBUG_TRUST_PROXY logs peer/XFF/req.ip to re-verify the
  proxy IP without a redeploy. Documents the Omada static-reservation
  assumption.

Login throttling (server/src/middleware/loginProtection.js, rateLimit.js)
- express-slow-down progressive delay + the existing hard rate cap + a
  separate per-IP exponential backoff that persists across the rate window.
  All failures return one generic message (no user/pass disclosure).

Honeypot (login form + auth.controller)
- Hidden, plausibly-named field ("company"); a filled value fails
  generically and is scored as an unambiguous bot.

Optional per-user TOTP 2FA (speakeasy/qrcode)
- totp_secret/totp_enabled columns (+ idempotent migration). Self-service
  Account page: enroll via QR, confirm a code to enable, code-gated disable.
- Login is two-step for enrolled users: after the password, a short-lived
  signed challenge (stage:'totp', not a session) is required before the
  real session is issued.

Bot / scanner scoring + IP ban (server/src/middleware/botScore.js)
- Weighted CMS-scanner paths (this app uses none). Junk paths 404 FIRST,
  unconditionally — independent of score/ban state, so a scanner rotating
  through fresh Cloudflare IPs gets no free pass. /wp-admin/install.php is
  the top-weighted near-1-hit ban (worst offender in prod logs). Per-IP
  score with quiet-period decay temp-bans an IP from ALL routes once past a
  (deliberately low) threshold, to protect /admin from credential stuffing.
  Failed logins and honeypot hits feed the same score.
- Periodic sweep evicts stale, unbanned, quiet entries so the in-memory
  store can't grow unbounded; the interval is unref'd and cleared on
  graceful shutdown.

Tests: node --test suite (40) covering trust-proxy parsing + live req.ip
(incl. pinned-IP), rate limiter + exponential backoff, honeypot rejection,
TOTP verify (enabled/disabled) + challenge-isn't-a-session, bot-score
threshold/decay/ban + junk-404-independence + install.php + store sweep.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/src/routes/admin/AdminLogin.jsx

@@ -6,17 +6,36 @@ import { useAuth } from '../../contexts/AuthContext.jsx'
 const BG =
   "linear-gradient(180deg,rgba(11,15,20,0.72),rgba(11,15,20,0.9)),url('/assets/img/uomysticmoon-main-hero.png')"
 
+// Hidden anti-bot field. Off-screen via CSS (NOT display:none/hidden, which bots
+// skip) so real users never fill it but naive scripted bots do. Name must match
+// the server's HONEYPOT_FIELD ('company').
+const honeypotStyle = {
+  position: 'absolute',
+  left: '-9999px',
+  top: 'auto',
+  width: '1px',
+  height: '1px',
+  opacity: 0,
+  pointerEvents: 'none',
+}
+
 export default function AdminLogin() {
-  const { user, login } = useAuth()
+  const { user, login, loginTotp } = useAuth()
   const navigate = useNavigate()
   const location = useLocation()
   const dest = location.state?.from?.pathname || '/admin'
 
   const [username, setUsername] = useState('')
   const [password, setPassword] = useState('')
+  const [company, setCompany] = useState('') // honeypot — must stay empty
   const [error, setError] = useState('')
   const [busy, setBusy] = useState(false)
 
+  // Two-factor step state.
+  const [stage, setStage] = useState('creds') // 'creds' | 'totp'
+  const [challenge, setChallenge] = useState('')
+  const [code, setCode] = useState('')
+
   // Already signed in → go straight to the panel.
   useEffect(() => {
     if (user) navigate(dest, { replace: true })
@@ -27,7 +46,13 @@ export default function AdminLogin() {
     setError('')
     setBusy(true)
     try {
-      await login(username, password)
+      const data = await login(username, password, { company })
+      if (data.totpRequired) {
+        setChallenge(data.challenge)
+        setStage('totp')
+        setBusy(false)
+        return
+      }
       navigate(dest, { replace: true })
     } catch (err) {
       setError(err.status === 401 ? 'Incorrect username or password.' : 'Could not sign in right now.')
@@ -35,6 +60,24 @@ export default function AdminLogin() {
     }
   }
 
+  async function onSubmitTotp(e) {
+    e.preventDefault()
+    setError('')
+    setBusy(true)
+    try {
+      await loginTotp(challenge, code)
+      navigate(dest, { replace: true })
+    } catch (err) {
+      setError(
+        err.status === 401 && /expired/i.test(err.message)
+          ? 'Your verification session expired. Please sign in again.'
+          : 'Invalid verification code.',
+      )
+      setBusy(false)
+      if (err.status === 401 && /expired/i.test(err.message)) setStage('creds')
+    }
+  }
+
   return (
     <main
       style={{
@@ -63,7 +106,7 @@ export default function AdminLogin() {
         </div>
 
         <form
-          onSubmit={onSubmit}
+          onSubmit={stage === 'totp' ? onSubmitTotp : onSubmit}
           style={{
             border: '1px solid var(--line)',
             borderRadius: 12,
@@ -73,27 +116,63 @@ export default function AdminLogin() {
             boxShadow: '0 24px 60px rgba(0,0,0,0.5)',
           }}
         >
-          <label style={{ display: 'block', marginBottom: 16 }}>
-            <span className="field-label">Username</span>
-            <input
-              type="text"
-              autoComplete="username"
-              autoFocus
-              value={username}
-              onChange={(e) => setUsername(e.target.value)}
-              className="input"
-            />
-          </label>
-          <label style={{ display: 'block', marginBottom: 22 }}>
-            <span className="field-label">Password</span>
-            <input
-              type="password"
-              autoComplete="current-password"
-              value={password}
-              onChange={(e) => setPassword(e.target.value)}
-              className="input"
-            />
-          </label>
+          {stage === 'creds' ? (
+            <>
+              <label style={{ display: 'block', marginBottom: 16 }}>
+                <span className="field-label">Username</span>
+                <input
+                  type="text"
+                  autoComplete="username"
+                  autoFocus
+                  value={username}
+                  onChange={(e) => setUsername(e.target.value)}
+                  className="input"
+                />
+              </label>
+              <label style={{ display: 'block', marginBottom: 22 }}>
+                <span className="field-label">Password</span>
+                <input
+                  type="password"
+                  autoComplete="current-password"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                  className="input"
+                />
+              </label>
+
+              {/* Honeypot: hidden from humans, left empty; bots that fill it are rejected. */}
+              <div style={honeypotStyle} aria-hidden="true">
+                <label>
+                  Company
+                  <input
+                    type="text"
+                    name="company"
+                    tabIndex={-1}
+                    autoComplete="off"
+                    value={company}
+                    onChange={(e) => setCompany(e.target.value)}
+                  />
+                </label>
+              </div>
+            </>
+          ) : (
+            <label style={{ display: 'block', marginBottom: 22 }}>
+              <span className="field-label">Authentication code</span>
+              <input
+                type="text"
+                inputMode="numeric"
+                autoComplete="one-time-code"
+                autoFocus
+                placeholder="6-digit code"
+                value={code}
+                onChange={(e) => setCode(e.target.value)}
+                className="input"
+              />
+              <span className="sans" style={{ display: 'block', marginTop: 8, color: 'var(--dim)', fontSize: '0.76rem' }}>
+                Enter the code from your authenticator app.
+              </span>
+            </label>
+          )}
 
           {error && (
             <p className="sans" style={{ margin: '0 0 14px', color: '#d98b84', fontSize: '0.85rem', textAlign: 'center' }}>
@@ -107,7 +186,7 @@ export default function AdminLogin() {
             className="btn btn-primary"
             style={{ display: 'block', width: '100%', borderRadius: 8, padding: 12, textAlign: 'center' }}
           >
-            {busy ? 'Signing in…' : 'Sign in'}
+            {busy ? 'Signing in…' : stage === 'totp' ? 'Verify' : 'Sign in'}
           </button>
           <p className="sans" style={{ margin: '16px 0 0', textAlign: 'center', color: 'var(--dim)', fontSize: '0.76rem' }}>
             Protected area — not indexed. Sessions expire after 1 day.