@daemonitor/plugins 1.1.42 → 1.1.44

package/dist/plugins/index.js

@@ -11,6 +11,7 @@ import { createSnmpPlugin } from "./monitoring/SnmpPlugin.js";
 import { createThreeCXPlugin } from "./monitoring/ThreeCXPlugin.js";
 import { createTplinkPlugin } from "./monitoring/TplinkPlugin.js";
 import { createPatroniPlugin } from "./monitoring/PatroniPlugin.js";
+import { createAppActivityPlugin } from "./monitoring/AppActivityPlugin.js";
 import { createAdsensePlugin } from "./monitoring/AdsensePlugin.js";
 import { createGa4Plugin } from "./monitoring/Ga4Plugin.js";
 import { createNagiosPlugin } from "./monitoring/NagiosPlugin.js";
@@ -38,6 +39,7 @@ export default {
     ThreeCX: createThreeCXPlugin,
     Tplink: createTplinkPlugin,
     Patroni: createPatroniPlugin,
+    Appactivity: createAppActivityPlugin,
     Adsense: createAdsensePlugin,
     Ga4: createGa4Plugin,
     Nagios: createNagiosPlugin,

package/dist/plugins/monitoring/AdsensePlugin.js

@@ -32,8 +32,8 @@ export function reportStart(today) {
 }
 export function reportUrl(account, start, end, bySite = false) {
     const q = new URLSearchParams({ dateRange: "CUSTOM", reportingTimeZone: "ACCOUNT_TIME_ZONE", dimensions: "DATE" });
-    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (archpaper.com
-    // contains www.archpaper.com and jobs.archpaper.com), so they double count.
+    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (example.com
+    // contains www.example.com and jobs.example.com), so they double count.
     if (bySite)
         q.append("dimensions", "DOMAIN_NAME");
     for (const [k, v] of [["startDate", start], ["endDate", end]]) {
@@ -183,7 +183,7 @@ export function createAdsensePlugin() {
         }
         catch { /* totals only */ }
         return {
-            // The account's own name ("The Architect's Newspaper") labels the service.
+            // The account's own name labels the service.
             // It overrides the plugin's instance name, which only says "AdSense".
             ...(account.displayName ? { name: account.displayName } : {}),
             accountId: account.name,

package/dist/plugins/monitoring/AppActivityPlugin.js

@@ -0,0 +1,152 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+const execFileAsync = promisify(execFile);
+const DAY_MS = 86_400_000;
+const RECENT_LIMIT = 10;
+const MAX_USER_PAGES = 20;
+const USER_PAGE_SIZE = 1000;
+export function maskEmail(email) {
+    const s = String(email ?? "");
+    const at = s.indexOf("@");
+    if (at < 1)
+        return "unknown";
+    return `${s[0]}***${s.slice(at)}`;
+}
+// One row per person, action and minute: a Google sign-in writes two audit lines
+// a moment apart. An account made through the admin API names service_role as the
+// actor and the new user in traits.user_id, as in admin_auth_events().
+export const AUDIT_SQL = `
+with e as (
+  select distinct on (person, action, date_trunc('minute', created_at))
+         created_at as at, action, who, provider
+  from (
+    select created_at,
+           payload->>'action' as action,
+           coalesce(payload->'traits'->>'user_id', payload->>'actor_id') as person,
+           coalesce(payload->'traits'->>'user_email', payload->>'actor_username') as who,
+           coalesce(payload->'traits'->>'provider', payload->'traits'->>'provider_type') as provider
+    from auth.audit_log_entries
+    where created_at >= now() - interval '30 days'
+      and payload->>'action' in ('user_signedup', 'login')
+  ) raw
+  order by person, action, date_trunc('minute', created_at), created_at
+)
+select json_build_object(
+  'users', (select count(*) from auth.users where deleted_at is null),
+  'events', coalesce((select json_agg(e) from e), '[]'::json)
+)`;
+const windows = (times, now) => ({
+    d1: times.filter((t) => t >= now - DAY_MS).length,
+    d7: times.filter((t) => t >= now - 7 * DAY_MS).length,
+    d30: times.filter((t) => t >= now - 30 * DAY_MS).length,
+});
+const newestFirst = (events) => [...events].sort((a, b) => Date.parse(b.at) - Date.parse(a.at)).slice(0, RECENT_LIMIT);
+/** Turn audit rows into the report. Exported for the check. */
+export function summariseAudit(users, rows, now = Date.now()) {
+    const events = rows.map((r) => ({
+        at: new Date(r.at).toISOString(),
+        action: r.action === "user_signedup" ? "signup" : "login",
+        who: maskEmail(r.who),
+        ...(r.provider ? { provider: String(r.provider) } : {}),
+    }));
+    const times = (action) => events.filter((e) => e.action === action).map((e) => Date.parse(e.at));
+    return {
+        users,
+        signups: windows(times("signup"), now),
+        logins: windows(times("login"), now),
+        loginsArePeople: false,
+        recent: newestFirst(events),
+    };
+}
+/** Turn GoTrue admin users into the report. Exported for the check. */
+export function summariseUsers(list, now = Date.now()) {
+    const stamp = (v) => {
+        const t = Date.parse(String(v ?? ""));
+        return Number.isFinite(t) ? t : null;
+    };
+    const events = [];
+    const signups = [];
+    const logins = [];
+    for (const u of list) {
+        const who = maskEmail(u?.email);
+        const provider = u?.app_metadata?.provider ? String(u.app_metadata.provider) : undefined;
+        const created = stamp(u?.created_at);
+        const seen = stamp(u?.last_sign_in_at);
+        if (created != null && created >= now - 30 * DAY_MS) {
+            signups.push(created);
+            events.push({ at: new Date(created).toISOString(), action: "signup", who, ...(provider ? { provider } : {}) });
+        }
+        if (seen != null && seen >= now - 30 * DAY_MS) {
+            logins.push(seen);
+            events.push({ at: new Date(seen).toISOString(), action: "login", who, ...(provider ? { provider } : {}) });
+        }
+    }
+    return {
+        users: list.length,
+        signups: windows(signups, now),
+        logins: windows(logins, now),
+        loginsArePeople: true,
+        recent: newestFirst(events),
+    };
+}
+async function collectPostgres(src, timeout) {
+    if (!src.database)
+        throw new Error("source has no database");
+    // ponytail: reads through one local container, so this agent's host going down
+    // silences every source. Move to HAProxy with a read-only role if that bites.
+    const { stdout } = await execFileAsync("docker", ["exec", src.container || "supacluster-patroni-1", "psql", "-U", "postgres", "-d", src.database, "-tAc", AUDIT_SQL], { timeout, killSignal: "SIGKILL", maxBuffer: 8 * 1024 * 1024 });
+    const parsed = JSON.parse(stdout);
+    return summariseAudit(Number(parsed.users) || 0, parsed.events || []);
+}
+async function collectSupabase(src, timeout) {
+    if (!src.url || !src.serviceKey)
+        throw new Error("source needs url and serviceKey");
+    const base = src.url.replace(/\/+$/, "");
+    const list = [];
+    for (let page = 1; page <= MAX_USER_PAGES; page++) {
+        const res = await fetch(`${base}/auth/v1/admin/users?page=${page}&per_page=${USER_PAGE_SIZE}`, {
+            headers: { apikey: src.serviceKey, Authorization: `Bearer ${src.serviceKey}` },
+            signal: AbortSignal.timeout(timeout),
+        });
+        if (!res.ok)
+            throw new Error(`admin users HTTP ${res.status}`);
+        const users = (await res.json())?.users || [];
+        list.push(...users);
+        if (users.length < USER_PAGE_SIZE)
+            break;
+    }
+    return summariseUsers(list);
+}
+export function sourceUid(src) {
+    return src.uniqueId || `activity-${src.name.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+}
+export function createAppActivityPlugin() {
+    let refreshTimer = null;
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const timeout = cfg.requestTimeout || 20000;
+        for (const src of cfg.sources || []) {
+            const uid = sourceUid(src);
+            const head = { kind: "appactivity", name: src.name, source: src.kind || "postgres" };
+            try {
+                const body = src.kind === "supabase" ? await collectSupabase(src, timeout) : await collectPostgres(src, timeout);
+                await plugin.send({ ...head, reachable: true, ...body, timestamp: Date.now() }, uid);
+            }
+            catch (e) {
+                await plugin.send({ ...head, reachable: false, error: String(e?.message || e).slice(0, 200), timestamp: Date.now() }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 300000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("appactivity", "appactivity", "Sign-ups and logins for apps on Supabase, self-hosted or cloud", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createAppActivityPlugin;

package/dist/plugins/monitoring/Ga4Plugin.js

@@ -102,7 +102,7 @@ export function pagesRequest(startDate, exclude = []) {
 const bareHost = (h) => h.trim().toLowerCase().replace(/^www\./, "");
 /**
  * A pages report -> the most viewed pages per host. `/a` and `/a/` add up, and a
- * site name most titles end in (" | The Architect's Newspaper") comes off.
+ * site name most titles end in (" | Example Site") comes off.
  */
 export function parsePages(report) {
     const rows = (report?.rows || []).map((r) => ({

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -28,7 +28,7 @@ function parseLine(line) {
     const ips = tokens.filter((t) => IP_TOKEN.test(t));
     const ip = ips.length ? ips[ips.length - 1] : (tokens[0] || "");
     // A host in the leading field is what lets a SHARED access log (one file for
-    // every vhost, as on the misc box) still say WHICH site was hit. A plain
+    // every vhost) still say WHICH site was hit. A plain
     // combined line leads with the client IP instead, so only a non-IP first
     // token counts. When $host is itself an IP — a request made straight to the
     // origin address — there is no site name to report and "" is correct.
@@ -196,7 +196,7 @@ export function analyze(lines, cfg, windowSec, st, rules = []) {
     // batch/v1 finding so it leads.
     // Only call it a takeover when the login status is trustworthy for this site
     // AND the IP went on to load an admin screen successfully. Either half alone
-    // produced a false "account takeover" page on archpaper.com, 2026-08-23.
+    // would page a false "account takeover".
     const authed = (ip) => !st?.hideLogin && loginOkIps.has(ip) && adminOkIps.has(ip);
     for (const [ip, count] of batchIps) {
         if (authed(ip)) {

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -4,7 +4,7 @@ import { readdir } from "node:fs/promises";
 import * as path from "node:path";
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // WordPress security-posture plugin. Runs on the WP host (where the daemonitor
-// client already runs) and polls the state that the Archpaper intrusions moved
+// client already runs) and polls the state that WordPress intrusions tend to move
 // through: admin accounts, page statuses, must-use plugins, and the web user's
 // crontab. It emits raw observations only — severity and the new-admin /
 // admin-demotion DIFFS are decided server-side in the ingest handler
@@ -16,11 +16,11 @@ import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // is best-effort and isolated: one failing (e.g. crontab needs root) degrades
 // that one field to null, it never kills the poll.
 const pexec = promisify(execFile);
-// Service-account naming patterns seen in the Archpaper intrusions. Any admin
+// Service-account naming patterns common in WordPress intrusions. Any admin
 // whose login/email contains one of these (case-insensitive substring) is
 // flagged for escalation even before the new-admin diff fires.
 const DEFAULT_SERVICE_PATTERNS = [
-    "wpsvc", "wpengine", "bot", "svc", "researchlabs", "wordpress-svc",
+    "wpsvc", "wpengine", "bot", "svc", "wordpress-svc",
 ];
 const DEFAULT_CRITICAL_PAGES = ["login", "home", "index", "front-page"];
 function slug(s) {
@@ -68,6 +68,13 @@ function parseJsonSafe(s, fallback) {
         return fallback;
     }
 }
+// WP-CLI prints user_registered as UTC with no zone marker.
+export function registrationCounts(registered, now = Date.now()) {
+    const day = 86_400_000;
+    const times = registered.map((r) => Date.parse(`${String(r).replace(" ", "T")}Z`)).filter(Number.isFinite);
+    const since = (days) => times.filter((t) => t >= now - days * day).length;
+    return { users: registered.length, signups: { d1: since(1), d7: since(7), d30: since(30) } };
+}
 async function collectSite(site) {
     const label = site.name || path.basename(site.path || "") || "wordpress";
     const servicePatterns = (site.servicePatterns || DEFAULT_SERVICE_PATTERNS).map((s) => s.toLowerCase());
@@ -92,6 +99,14 @@ async function collectSite(site) {
     catch (e) {
         out.adminsError = String(e?.message || e).slice(0, 160);
     }
+    // Registrations, for the activity view. Counts only: nothing here names anyone.
+    try {
+        const raw = await wp(site, ["user", "list", "--fields=user_registered", "--format=json"], 30000);
+        out.activity = registrationCounts(parseJsonSafe(raw, []).map((u) => u.user_registered));
+    }
+    catch (e) {
+        out.activityError = String(e?.message || e).slice(0, 160);
+    }
     // 2. WP core version (posture; latest-version comparison is done elsewhere).
     try {
         out.wpVersion = (await wp(site, ["core", "version"])).trim();

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.42",
+  "version": "1.1.44",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",
   "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "prepublishOnly": "npm run build"
+  },
   "files": [
     "dist",
     "types"
@@ -22,6 +27,7 @@
   },
   "author": "",
   "license": "ISC",
+  "packageManager": "pnpm@9.15.9",
   "devDependencies": {
     "@types/node": "^26.1.1",
     "nuxt": "^3.15.4",
@@ -53,9 +59,5 @@
   },
   "engines": {
     "node": ">=18.17"
-  },
-  "scripts": {
-    "build": "tsc",
-    "test": "echo \"Error: no test specified\" && exit 1"
   }
-}
+}