Merge pull request #3526 from Zhen-Bo/feature/access-log-middleware Add Separate Access Logging Middleware with Configuration Option

7188060ac8d2e6c5f4e529f480d444d301d37911

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 3a25550f5b8d4bffe67462cdf5ccebff53c394cd 3e26b93971afaf4d8cb166cbd2428585165d98fe

default/config.yaml+7 -2 Viewed

 # the username and passwords for basic auth are the same as those
 # for the individual accounts
 perUserBasicAuth: false
 -# Minimum log level to display in the terminal (DEBUG = 0, INFO = 1, WARN = 2, ERROR = 3)
 -minLogLevel: 0
 # User session timeout *in seconds* (defaults to 24 hours).
 ## Set to a positive number to expire session after a certain time of inactivity

 disableCsrfProtection: false
 # Disable startup security checks - NOT RECOMMENDED
 securityOverride: false
 +# -- LOGGING CONFIGURATION --
 +logging:
 +  # Enable access logging to access.log file
 +  # Records new connections with timestamp, IP address and user agent
 +  enableAccessLog: true
 +  # Minimum log level to display in the terminal (DEBUG = 0, INFO = 1, WARN = 2, ERROR = 3)
 +  minLogLevel: 0
 # -- RATE LIMITING CONFIGURATION --
 rateLimiting:
   # Use X-Real-IP header instead of socket IP for rate limiting

post-install.js+5 -0 Viewed

         newKey: 'extensions.models.textToSpeech',
         migrate: (value) => value,
     },
 +    {
 +        oldKey: 'minLogLevel',
 +        newKey: 'logging.minLogLevel',
 +        migrate: (value) => value,
 +    },
 ];
 /**

server.js+12 -3 Viewed

 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';
 import basicAuthMiddleware from './src/middleware/basicAuth.js';
 import whitelistMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/whitelist.js';
 +import accessLoggerMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/accessLogWriter.js';
 import multerMonkeyPatch from './src/middleware/multerMonkeyPatch.js';
 import initRequestProxy from './src/request-proxy.js';
 import getCacheBusterMiddleware from './src/middleware/cacheBuster.js';

 app.use(CORS);
 if (listen && basicAuthMode) app.use(basicAuthMiddleware);{
 +    app.use(basicAuthMiddleware);
 +}
++
 +if (enableWhitelist) {
 +    app.use(whitelistMiddleware());
 +}
 -app.use(whitelistMiddleware(enableWhitelist, listen));
 +if (listen) {
 +    app.use(accessLoggerMiddleware());
 +}
 if (enableCorsProxy) {
     app.use(bodyParser.json({

src/middleware/accessLogWriter.js+59 -0 Viewed

 +import path from 'node:path';
 +import fs from 'node:fs';
 +import { getRealIpFromHeader } from '../express-common.js';
 +import { color, getConfigValue } from '../util.js';
++
 +const enableAccessLog = getConfigValue('logging.enableAccessLog', true);
++
 +const knownIPs = new Set();
++
 +export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
++
 +export function migrateAccessLog() {
 +    try {
 +        if (!fs.existsSync('access.log')) {
 +            return;
 +        }
 +        const logPath = getAccessLogPath();
 +        if (fs.existsSync(logPath)) {
 +            return;
 +        }
 +        fs.renameSync('access.log', logPath);
 +        console.log(color.yellow('Migrated access.log to new location:'), logPath);
 +    } catch (e) {
 +        console.error('Failed to migrate access log:', e);
 +        console.info('Please move access.log to the data directory manually.');
 +    }
 +}
++
 +/**
 + * Creates middleware for logging access and new connections
 + * @returns {import('express').RequestHandler}
 + */
 +export default function accessLoggerMiddleware() {
 +    return function (req, res, next) {
 +        const clientIp = getRealIpFromHeader(req);
 +        const userAgent = req.headers['user-agent'];
++
 +        if (!knownIPs.has(clientIp)) {
 +            // Log new connection
 +            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
 +            knownIPs.add(clientIp);
++
 +            // Write to access log if enabled
 +            if (enableAccessLog) {
 +                const logPath = getAccessLogPath();
 +                const timestamp = new Date().toISOString();
 +                const log = `${timestamp} ${clientIp} ${userAgent}\n`;
++
 +                fs.appendFile(logPath, log, (err) => {
 +                    if (err) {
 +                        console.error('Failed to write access log:', err);
 +                    }
 +                });
 +            }
 +        }
++
 +        next();
 +    };
 +}

src/middleware/whitelist.js+16 -45 Viewed

 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
 const enableForwardedWhitelist = getConfigValue('enableForwardedWhitelist', false);
 let whitelist = getConfigValue('whitelist', []);
 -let knownIPs = new Set();
+-
 -export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
 if (fs.existsSync(whitelistPath)) {
     try {

     return undefined;
+}
 -export function migrateAccessLog() {
 -    try {
 -        if (!fs.existsSync('access.log')) {
 -            return;
 -        }
 -        const logPath = getAccessLogPath();
 -        if (fs.existsSync(logPath)) {
 -            return;
 -        }
 -        fs.renameSync('access.log', logPath);
 -        console.log(color.yellow('Migrated access.log to new location:'), logPath);
 -    } catch (e) {
 -        console.error('Failed to migrate access log:', e);
 -        console.info('Please move access.log to the data directory manually.');
 -    }
 -}
+-
 /**
  * Returns a middleware function that checks if the client IP is in the whitelist.
 - * @param {boolean} whitelistMode If whitelist mode is enabled via config or command line
 - * @param {boolean} listen If listen mode is enabled via config or command line
  * @returns {import('express').RequestHandler} The middleware function
  */
 export default function whitelistMiddleware(whitelistMode, listen) {
     const forbiddenWebpage = Handlebars.compile(
         safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
     );
 +    const noLogPaths = [
 +        '/favicon.ico',
 +    ];
++
     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIp(req);
         const userAgent = req.headers['user-agent'];
 -        if (listen && !knownIPs.has(clientIp)) {
 -            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
 -            knownIPs.add(clientIp);
+-
 -            // Write access log
 -            const logPath = getAccessLogPath();
 -            const timestamp = new Date().toISOString();
 -            const log = `${timestamp} ${clientIp} ${userAgent}\n`;
 -            fs.appendFile(logPath, log, (err) => {
 -                if (err) {
 -                    console.error('Failed to write access log:', err);
 -                }
 -            });
 -        }
+-
         //clientIp = req.connection.remoteAddress.split(':').pop();
         if (whitelistMode === true && !whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
             || forwardedIp && whitelistMode === true && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))
         ) {
             // Log the connection attempt with real IP address
             const ipDetails = forwardedIp
                 ? `${clientIp} (forwarded from ${forwardedIp})`
                 : clientIp;
 -            console.warn(
++
 -                color.red(
 +            if (!noLogPaths.includes(req.path)) {
 -                    `Blocked connection from ${clientIp}; User Agent: ${userAgent}\n\tTo allow this connection, add its IP address to the whitelist or disable whitelist mode by editing config.yaml in the root directory of your SillyTavern installation.\n`,
 +                console.warn(
 -                ),
 +                    color.red(
 -            );
 +                        `Blocked connection from ${clientIp}; User Agent: ${userAgent}\n\tTo allow this connection, add its IP address to the whitelist or disable whitelist mode by editing config.yaml in the root directory of your SillyTavern installation.\n`,
 +                    ),
 +                );
 +            }
++
             return res.status(403).send(forbiddenWebpage({ ipDetails }));
+        }
         next();

src/util.js+1 -1 Viewed

  * Setup the minimum log level
  */
 export function setupLogLevel() {
     const logLevel = getConfigValue('logging.minLogLevel', LOG_LEVELS.DEBUG);
     globalThis.console.debug = logLevel <= LOG_LEVELS.DEBUG ? console.debug : () => {};
     globalThis.console.info = logLevel <= LOG_LEVELS.INFO ? console.info : () => {};