7188060a · permissionBRICK/SillyTavern

default/config.yaml+7 -2 Viewed

 # the username and passwords for basic auth are the same as those
 # for the individual accounts
 perUserBasicAuth: false
-# Minimum log level to display in the terminal (DEBUG = 0, INFO = 1, WARN = 2, ERROR = 3)
-minLogLevel: 0
 # User session timeout *in seconds* (defaults to 24 hours).
 ## Set to a positive number to expire session after a certain time of inactivity

 disableCsrfProtection: false
 # Disable startup security checks - NOT RECOMMENDED
 securityOverride: false
+# -- LOGGING CONFIGURATION --
+logging:
+  # Enable access logging to access.log file
+  # Records new connections with timestamp, IP address and user agent
+  enableAccessLog: true
+  # Minimum log level to display in the terminal (DEBUG = 0, INFO = 1, WARN = 2, ERROR = 3)
+  minLogLevel: 0
 # -- RATE LIMITING CONFIGURATION --
 rateLimiting:
   # Use X-Real-IP header instead of socket IP for rate limiting

post-install.js+5 -0 Viewed

         newKey: 'extensions.models.textToSpeech',
         migrate: (value) => value,
     },
+    {
+        oldKey: 'minLogLevel',
+        newKey: 'logging.minLogLevel',
+        migrate: (value) => value,
+    },
 ];
 /**

server.js+12 -3 Viewed

 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';
 import basicAuthMiddleware from './src/middleware/basicAuth.js';
-import whitelistMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/whitelist.js';
+import whitelistMiddleware from './src/middleware/whitelist.js';
+import accessLoggerMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/accessLogWriter.js';
 import multerMonkeyPatch from './src/middleware/multerMonkeyPatch.js';
 import initRequestProxy from './src/request-proxy.js';
 import getCacheBusterMiddleware from './src/middleware/cacheBuster.js';

 app.use(CORS);
-if (listen && basicAuthMode) app.use(basicAuthMiddleware);
+if (listen && basicAuthMode) {
+    app.use(basicAuthMiddleware);
+}
+if (enableWhitelist) {
+    app.use(whitelistMiddleware());
+}
-app.use(whitelistMiddleware(enableWhitelist, listen));
+if (listen) {
+    app.use(accessLoggerMiddleware());
+}
 if (enableCorsProxy) {
     app.use(bodyParser.json({

src/middleware/accessLogWriter.js+59 -0 Viewed

+import path from 'node:path';
+import fs from 'node:fs';
+import { getRealIpFromHeader } from '../express-common.js';
+import { color, getConfigValue } from '../util.js';
+const enableAccessLog = getConfigValue('logging.enableAccessLog', true);
+const knownIPs = new Set();
+export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
+export function migrateAccessLog() {
+    try {
+        if (!fs.existsSync('access.log')) {
+            return;
+        }
+        const logPath = getAccessLogPath();
+        if (fs.existsSync(logPath)) {
+            return;
+        }
+        fs.renameSync('access.log', logPath);
+        console.log(color.yellow('Migrated access.log to new location:'), logPath);
+    } catch (e) {
+        console.error('Failed to migrate access log:', e);
+        console.info('Please move access.log to the data directory manually.');
+    }
+}
+/**
+ * Creates middleware for logging access and new connections
+ * @returns {import('express').RequestHandler}
+ */
+export default function accessLoggerMiddleware() {
+    return function (req, res, next) {
+        const clientIp = getRealIpFromHeader(req);
+        const userAgent = req.headers['user-agent'];
+        if (!knownIPs.has(clientIp)) {
+            // Log new connection
+            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
+            knownIPs.add(clientIp);
+            // Write to access log if enabled
+            if (enableAccessLog) {
+                const logPath = getAccessLogPath();
+                const timestamp = new Date().toISOString();
+                const log = `${timestamp} ${clientIp} ${userAgent}\n`;
+                fs.appendFile(logPath, log, (err) => {
+                    if (err) {
+                        console.error('Failed to write access log:', err);
+                    }
+                });
+            }
+        }
+        next();
+    };
+}

src/middleware/whitelist.js+16 -45 Viewed

 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
 const enableForwardedWhitelist = getConfigValue('enableForwardedWhitelist', false);
 let whitelist = getConfigValue('whitelist', []);
-let knownIPs = new Set();
-export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
 if (fs.existsSync(whitelistPath)) {
     try {

     return undefined;
+}
-export function migrateAccessLog() {
-    try {
-        if (!fs.existsSync('access.log')) {
-            return;
-        }
-        const logPath = getAccessLogPath();
-        if (fs.existsSync(logPath)) {
-            return;
-        }
-        fs.renameSync('access.log', logPath);
-        console.log(color.yellow('Migrated access.log to new location:'), logPath);
-    } catch (e) {
-        console.error('Failed to migrate access log:', e);
-        console.info('Please move access.log to the data directory manually.');
-    }
-}
 /**
  * Returns a middleware function that checks if the client IP is in the whitelist.
- * @param {boolean} whitelistMode If whitelist mode is enabled via config or command line
- * @param {boolean} listen If listen mode is enabled via config or command line
  * @returns {import('express').RequestHandler} The middleware function
  */
-export default function whitelistMiddleware(whitelistMode, listen) {
+export default function whitelistMiddleware() {
     const forbiddenWebpage = Handlebars.compile(
         safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
     );
+    const noLogPaths = [
+        '/favicon.ico',
+    ];
     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIp(req);
         const userAgent = req.headers['user-agent'];
-        if (listen && !knownIPs.has(clientIp)) {
-            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
-            knownIPs.add(clientIp);
-            // Write access log
-            const logPath = getAccessLogPath();
-            const timestamp = new Date().toISOString();
-            const log = `${timestamp} ${clientIp} ${userAgent}\n`;
-            fs.appendFile(logPath, log, (err) => {
-                if (err) {
-                    console.error('Failed to write access log:', err);
-                }
-            });
-        }
         //clientIp = req.connection.remoteAddress.split(':').pop();
-        if (whitelistMode === true && !whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
+        if (!whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
-            || forwardedIp && whitelistMode === true && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))
+            || forwardedIp && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))
         ) {
             // Log the connection attempt with real IP address
             const ipDetails = forwardedIp
                 ? `${clientIp} (forwarded from ${forwardedIp})`
                 : clientIp;
-            console.warn(
-                color.red(
+            if (!noLogPaths.includes(req.path)) {
-                    `Blocked connection from ${clientIp}; User Agent: ${userAgent}\n\tTo allow this connection, add its IP address to the whitelist or disable whitelist mode by editing config.yaml in the root directory of your SillyTavern installation.\n`,
+                console.warn(
-                ),
+                    color.red(
-            );
+                        `Blocked connection from ${clientIp}; User Agent: ${userAgent}\n\tTo allow this connection, add its IP address to the whitelist or disable whitelist mode by editing config.yaml in the root directory of your SillyTavern installation.\n`,
+                    ),
+                );
+            }
             return res.status(403).send(forbiddenWebpage({ ipDetails }));
+        }
         next();

src/util.js+1 -1 Viewed

  * Setup the minimum log level
  */
 export function setupLogLevel() {
-    const logLevel = getConfigValue('minLogLevel', LOG_LEVELS.DEBUG);
+    const logLevel = getConfigValue('logging.minLogLevel', LOG_LEVELS.DEBUG);
     globalThis.console.debug = logLevel <= LOG_LEVELS.DEBUG ? console.debug : () => {};
     globalThis.console.info = logLevel <= LOG_LEVELS.INFO ? console.info : () => {};

Merge pull request #3526 from Zhen-Bo/feature/access-log-middleware Add Separate Access Logging Middleware with Configuration Option