feat(middleware): add separate access log middleware with config option

db500188d87ab9fe376b7bb7aaff7d0b5baea267

KevinSun <paver.mails+github@gmail.com>

Signed

Parents: aadae85a2a2f5e5fa9e34a2cb9815c1d2a0c066a

default/config.yaml+5 -0 Viewed

 disableCsrfProtection: false
 # Disable startup security checks - NOT RECOMMENDED
 securityOverride: false
 +# -- LOGGING CONFIGURATION --
 +logging:
 +  # Enable access logging to access.log file
 +  # Records new connections with timestamp, IP address and user agent
 +  enableAccessLog: true
 # -- RATE LIMITING CONFIGURATION --
 rateLimiting:
   # Use X-Real-IP header instead of socket IP for rate limiting

server.js+4 -2 Viewed

 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';
 import basicAuthMiddleware from './src/middleware/basicAuth.js';
 import whitelistMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/whitelist.js';
 +import accessLoggerMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/accessLogger.js';
 import multerMonkeyPatch from './src/middleware/multerMonkeyPatch.js';
 import initRequestProxy from './src/request-proxy.js';
 import getCacheBusterMiddleware from './src/middleware/cacheBuster.js';

 if (listen && basicAuthMode) app.use(basicAuthMiddleware);
 app.use(whitelistMiddleware(enableWhitelist, listen));
 +app.use(accessLoggerMiddleware());
 if (enableCorsProxy) {
     app.use(bodyParser.json({

src/middleware/accessLogger.js+59 -0 Viewed

 +import path from 'node:path';
 +import fs from 'node:fs';
 +import { getRealIpFromHeader } from '../express-common.js';
 +import { color, getConfigValue } from '../util.js';
++
 +const enableAccessLog = getConfigValue('logging.enableAccessLog', true);
++
 +const knownIPs = new Set();
++
 +export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
++
 +export function migrateAccessLog() {
 +    try {
 +        if (!fs.existsSync('access.log')) {
 +            return;
 +        }
 +        const logPath = getAccessLogPath();
 +        if (fs.existsSync(logPath)) {
 +            return;
 +        }
 +        fs.renameSync('access.log', logPath);
 +        console.log(color.yellow('Migrated access.log to new location:'), logPath);
 +    } catch (e) {
 +        console.error('Failed to migrate access log:', e);
 +        console.info('Please move access.log to the data directory manually.');
 +    }
 +}
++
 +/**
 + * Creates middleware for logging access and new connections
 + * @returns {import('express').RequestHandler}
 + */
 +export default function accessLoggerMiddleware() {
 +    return function (req, res, next) {
 +        const clientIp = getRealIpFromHeader(req);
 +        const userAgent = req.headers['user-agent'];
++
 +        if (!knownIPs.has(clientIp)) {
 +            // Log new connection
 +            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
 +            knownIPs.add(clientIp);
++
 +            // Write to access log if enabled
 +            if (enableAccessLog) {
 +                const logPath = getAccessLogPath();
 +                const timestamp = new Date().toISOString();
 +                const log = `${timestamp} ${clientIp} ${userAgent}\n`;
++
 +                fs.appendFile(logPath, log, (err) => {
 +                    if (err) {
 +                        console.error('Failed to write access log:', err);
 +                    }
 +                });
 +            }
 +        }
++
 +        next();
 +    };
 +}

src/middleware/whitelist.js+1 -37 Viewed

 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
 const enableForwardedWhitelist = getConfigValue('enableForwardedWhitelist', false);
 let whitelist = getConfigValue('whitelist', []);
 -let knownIPs = new Set();
+-
 -export const getAccessLogPath = () => path.join(globalThis.DATA_ROOT, 'access.log');
 if (fs.existsSync(whitelistPath)) {
     try {

     return undefined;
+}
 -export function migrateAccessLog() {
 -    try {
 -        if (!fs.existsSync('access.log')) {
 -            return;
 -        }
 -        const logPath = getAccessLogPath();
 -        if (fs.existsSync(logPath)) {
 -            return;
 -        }
 -        fs.renameSync('access.log', logPath);
 -        console.log(color.yellow('Migrated access.log to new location:'), logPath);
 -    } catch (e) {
 -        console.error('Failed to migrate access log:', e);
 -        console.info('Please move access.log to the data directory manually.');
 -    }
 -}
+-
 /**
  * Returns a middleware function that checks if the client IP is in the whitelist.
  * @param {boolean} whitelistMode If whitelist mode is enabled via config or command line
 - * @param {boolean} listen If listen mode is enabled via config or command line
  * @returns {import('express').RequestHandler} The middleware function
  */
 export default function whitelistMiddleware(whitelistMode, listen) {
     const forbiddenWebpage = Handlebars.compile(
         safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
     );

         const forwardedIp = getForwardedIp(req);
         const userAgent = req.headers['user-agent'];
 -        if (listen && !knownIPs.has(clientIp)) {
 -            console.info(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
 -            knownIPs.add(clientIp);
+-
 -            // Write access log
 -            const logPath = getAccessLogPath();
 -            const timestamp = new Date().toISOString();
 -            const log = `${timestamp} ${clientIp} ${userAgent}\n`;
 -            fs.appendFile(logPath, log, (err) => {
 -                if (err) {
 -                    console.error('Failed to write access log:', err);
 -                }
 -            });
 -        }
+-
         //clientIp = req.connection.remoteAddress.split(':').pop();
         if (whitelistMode === true && !whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
             || forwardedIp && whitelistMode === true && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))