mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-01 04:42:10 +03:00
ea678daad6
* fix(auth): tag internal/loopback-origin failed logins in the audit log Failed dashboard logins (`auth.login.failed`) are emitted only after a submitted, non-empty password fails verification, and the recorded IP is accurate. On a single-process deployment with no reverse proxy, a loopback / private source IP therefore means the attempt genuinely originated on the box or the LAN (someone browsing http://localhost and mistyping, or a browser autofill replaying a stale password) — but the Audit Log had no way to distinguish those from an external intrusion attempt, so they read as suspicious noise. Add `classifyIpScope()` to `ipUtils` (loopback / private / public / unknown, using bounded string-prefix checks — ReDoS-safe) and stamp `sourceScope` + `internalOrigin` onto the `auth.login.failed` audit metadata so the audit view can label internal-origin failures distinctly. No change to which events are written or to IP attribution. Closes #8336 * test(auth): assert the new origin tags on the failed-login audit event This PR tags failed logins with sourceScope/internalOrigin, but the pre-existing admin-audit-events assertion still deepEqual'd the old two-field metadata shape and broke. The request under test carries a public x-forwarded-for, so the expected tags are sourceScope: "public" and internalOrigin: false — the assertion stays strict, it just covers the fields this PR introduces. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>