Expose the botScore middleware's in-memory scoring/ban state to admins.
Previously state lived only in the store Map with no persistence or API — the
only visibility was tailing container logs.
- botScore: bounded ring buffer (300) recording scan/login-fail/honeypot and
ban events (most-recent-first); listState() snapshot of all scored IPs;
unban() to clear a single IP.
- New admin-only endpoints GET /admin/bot-activity and
POST /admin/bot-activity/unban (RBAC admin gate, IP validated). Unban is
activity-logged with the admin username.
- Bot Activity tab: currently-banned table with Unban, plus a recent-events
feed, following the existing admin table patterns.
- Tests for the buffer, listState, and unban (guard lets an unbanned IP back
through). README updated.
Read + emergency-unban only — no ban-add or weight-editing surface. Buffer is
in-memory, matching the store; not persisted.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Several changes merged today were not reflected in the README. Bring it
back in sync with main:
- Security section: rewrite into Session/authorization, Login hardening,
Uploads/input, and Platform groups — documents DB re-validation of the
JWT per request (#12), role-based authorization (#10), optional TOTP
2FA (#9), login throttling + per-IP backoff, honeypot, bot-scoring/IP
ban, and mimetype-derived upload extensions (#11) + username
uniqueness checks on update (#13).
- Environment variables: add TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER,
TOTP_CHALLENGE_TTL, and UPLOAD_DIR.
- Routes/API tables: add /admin/account and the account/totp endpoints
plus the login/totp second-factor step.
- Tech stack + project structure: note TOTP (speakeasy/qrcode), the
loginProtection/botScore middleware, the totp util, and the Account view.
Docs-only; no code changes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- README rewritten for the completed frontend: full setup/run instructions
(Docker Compose, local dev with hot reload, prod build), pages/routes,
API endpoints, and a consolidated environment-variable reference
- Vite dev proxy now targets 127.0.0.1 (avoids the Windows IPv6-localhost
pitfall where the SPA could not reach the IPv4-bound API)
- Remove server/_setup.ps1 (a scratch script accidentally committed in the
previous frontend commit) and gitignore _*.ps1 scratch files
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
