@daemonitor/plugins 1.1.43 → 1.1.45

package/dist/plugins/index.js

@@ -8,9 +8,11 @@ import { createWordpressPlugin } from "./monitoring/WordpressPlugin.js";
 import { createLogWatchPlugin } from "./monitoring/LogWatchPlugin.js";
 import { createNetScanPlugin } from "./monitoring/NetScanPlugin.js";
 import { createSnmpPlugin } from "./monitoring/SnmpPlugin.js";
+import { createSynologyPlugin } from "./monitoring/SynologyPlugin.js";
 import { createThreeCXPlugin } from "./monitoring/ThreeCXPlugin.js";
 import { createTplinkPlugin } from "./monitoring/TplinkPlugin.js";
 import { createPatroniPlugin } from "./monitoring/PatroniPlugin.js";
+import { createAppActivityPlugin } from "./monitoring/AppActivityPlugin.js";
 import { createAdsensePlugin } from "./monitoring/AdsensePlugin.js";
 import { createGa4Plugin } from "./monitoring/Ga4Plugin.js";
 import { createNagiosPlugin } from "./monitoring/NagiosPlugin.js";
@@ -35,9 +37,11 @@ export default {
     Logwatch: createLogWatchPlugin,
     Netscan: createNetScanPlugin,
     Snmp: createSnmpPlugin,
+    Synology: createSynologyPlugin,
     ThreeCX: createThreeCXPlugin,
     Tplink: createTplinkPlugin,
     Patroni: createPatroniPlugin,
+    Appactivity: createAppActivityPlugin,
     Adsense: createAdsensePlugin,
     Ga4: createGa4Plugin,
     Nagios: createNagiosPlugin,

package/dist/plugins/monitoring/AppActivityPlugin.js

@@ -0,0 +1,152 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+const execFileAsync = promisify(execFile);
+const DAY_MS = 86_400_000;
+const RECENT_LIMIT = 10;
+const MAX_USER_PAGES = 20;
+const USER_PAGE_SIZE = 1000;
+export function maskEmail(email) {
+    const s = String(email ?? "");
+    const at = s.indexOf("@");
+    if (at < 1)
+        return "unknown";
+    return `${s[0]}***${s.slice(at)}`;
+}
+// One row per person, action and minute: a Google sign-in writes two audit lines
+// a moment apart. An account made through the admin API names service_role as the
+// actor and the new user in traits.user_id, as in admin_auth_events().
+export const AUDIT_SQL = `
+with e as (
+  select distinct on (person, action, date_trunc('minute', created_at))
+         created_at as at, action, who, provider
+  from (
+    select created_at,
+           payload->>'action' as action,
+           coalesce(payload->'traits'->>'user_id', payload->>'actor_id') as person,
+           coalesce(payload->'traits'->>'user_email', payload->>'actor_username') as who,
+           coalesce(payload->'traits'->>'provider', payload->'traits'->>'provider_type') as provider
+    from auth.audit_log_entries
+    where created_at >= now() - interval '30 days'
+      and payload->>'action' in ('user_signedup', 'login')
+  ) raw
+  order by person, action, date_trunc('minute', created_at), created_at
+)
+select json_build_object(
+  'users', (select count(*) from auth.users where deleted_at is null),
+  'events', coalesce((select json_agg(e) from e), '[]'::json)
+)`;
+const windows = (times, now) => ({
+    d1: times.filter((t) => t >= now - DAY_MS).length,
+    d7: times.filter((t) => t >= now - 7 * DAY_MS).length,
+    d30: times.filter((t) => t >= now - 30 * DAY_MS).length,
+});
+const newestFirst = (events) => [...events].sort((a, b) => Date.parse(b.at) - Date.parse(a.at)).slice(0, RECENT_LIMIT);
+/** Turn audit rows into the report. Exported for the check. */
+export function summariseAudit(users, rows, now = Date.now()) {
+    const events = rows.map((r) => ({
+        at: new Date(r.at).toISOString(),
+        action: r.action === "user_signedup" ? "signup" : "login",
+        who: maskEmail(r.who),
+        ...(r.provider ? { provider: String(r.provider) } : {}),
+    }));
+    const times = (action) => events.filter((e) => e.action === action).map((e) => Date.parse(e.at));
+    return {
+        users,
+        signups: windows(times("signup"), now),
+        logins: windows(times("login"), now),
+        loginsArePeople: false,
+        recent: newestFirst(events),
+    };
+}
+/** Turn GoTrue admin users into the report. Exported for the check. */
+export function summariseUsers(list, now = Date.now()) {
+    const stamp = (v) => {
+        const t = Date.parse(String(v ?? ""));
+        return Number.isFinite(t) ? t : null;
+    };
+    const events = [];
+    const signups = [];
+    const logins = [];
+    for (const u of list) {
+        const who = maskEmail(u?.email);
+        const provider = u?.app_metadata?.provider ? String(u.app_metadata.provider) : undefined;
+        const created = stamp(u?.created_at);
+        const seen = stamp(u?.last_sign_in_at);
+        if (created != null && created >= now - 30 * DAY_MS) {
+            signups.push(created);
+            events.push({ at: new Date(created).toISOString(), action: "signup", who, ...(provider ? { provider } : {}) });
+        }
+        if (seen != null && seen >= now - 30 * DAY_MS) {
+            logins.push(seen);
+            events.push({ at: new Date(seen).toISOString(), action: "login", who, ...(provider ? { provider } : {}) });
+        }
+    }
+    return {
+        users: list.length,
+        signups: windows(signups, now),
+        logins: windows(logins, now),
+        loginsArePeople: true,
+        recent: newestFirst(events),
+    };
+}
+async function collectPostgres(src, timeout) {
+    if (!src.database)
+        throw new Error("source has no database");
+    // ponytail: reads through one local container, so this agent's host going down
+    // silences every source. Move to HAProxy with a read-only role if that bites.
+    const { stdout } = await execFileAsync("docker", ["exec", src.container || "supacluster-patroni-1", "psql", "-U", "postgres", "-d", src.database, "-tAc", AUDIT_SQL], { timeout, killSignal: "SIGKILL", maxBuffer: 8 * 1024 * 1024 });
+    const parsed = JSON.parse(stdout);
+    return summariseAudit(Number(parsed.users) || 0, parsed.events || []);
+}
+async function collectSupabase(src, timeout) {
+    if (!src.url || !src.serviceKey)
+        throw new Error("source needs url and serviceKey");
+    const base = src.url.replace(/\/+$/, "");
+    const list = [];
+    for (let page = 1; page <= MAX_USER_PAGES; page++) {
+        const res = await fetch(`${base}/auth/v1/admin/users?page=${page}&per_page=${USER_PAGE_SIZE}`, {
+            headers: { apikey: src.serviceKey, Authorization: `Bearer ${src.serviceKey}` },
+            signal: AbortSignal.timeout(timeout),
+        });
+        if (!res.ok)
+            throw new Error(`admin users HTTP ${res.status}`);
+        const users = (await res.json())?.users || [];
+        list.push(...users);
+        if (users.length < USER_PAGE_SIZE)
+            break;
+    }
+    return summariseUsers(list);
+}
+export function sourceUid(src) {
+    return src.uniqueId || `activity-${src.name.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+}
+export function createAppActivityPlugin() {
+    let refreshTimer = null;
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const timeout = cfg.requestTimeout || 20000;
+        for (const src of cfg.sources || []) {
+            const uid = sourceUid(src);
+            const head = { kind: "appactivity", name: src.name, source: src.kind || "postgres" };
+            try {
+                const body = src.kind === "supabase" ? await collectSupabase(src, timeout) : await collectPostgres(src, timeout);
+                await plugin.send({ ...head, reachable: true, ...body, timestamp: Date.now() }, uid);
+            }
+            catch (e) {
+                await plugin.send({ ...head, reachable: false, error: String(e?.message || e).slice(0, 200), timestamp: Date.now() }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 300000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("appactivity", "appactivity", "Sign-ups and logins for apps on Supabase, self-hosted or cloud", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createAppActivityPlugin;

package/dist/plugins/monitoring/SynologyPlugin.js

@@ -0,0 +1,174 @@
+import * as https from "node:https";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+const REAUTH_AFTER_MS = 3_600_000;
+const AUTH_ERRORS = {
+    400: "wrong account or password",
+    401: "account disabled",
+    402: "account may not use this service",
+    403: "account has 2FA on, which an agent can't answer",
+    404: "2FA code rejected",
+    407: "this host is blocked by DSM's auto block",
+};
+/** A login DSM refused. Retrying every pass would trip its auto block. */
+export const authErrorText = (code) => AUTH_ERRORS[Number(code)];
+const apiErrorText = (api, code) => Number(code) === 105 ? `${api}: this account lacks permission, it may need to be an administrator` : `${api}: DSM error ${code}`;
+function post(url, form, cfg) {
+    return new Promise((resolve, reject) => {
+        const body = new URLSearchParams(form).toString();
+        const u = new URL("/webapi/entry.cgi", url);
+        const req = https.request({
+            hostname: u.hostname,
+            port: u.port || 443,
+            path: u.pathname,
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Length": Buffer.byteLength(body) },
+            rejectUnauthorized: !cfg.insecure,
+        }, (res) => {
+            let text = "";
+            res.on("data", (c) => { text += c; });
+            res.on("end", () => {
+                try {
+                    resolve(JSON.parse(text));
+                }
+                catch {
+                    reject(new Error(`DSM answered HTTP ${res.statusCode} with something other than JSON`));
+                }
+            });
+        });
+        req.on("error", reject);
+        req.setTimeout(cfg.requestTimeout || 20000, () => req.destroy(new Error("DSM request timed out")));
+        req.end(body);
+    });
+}
+/** Turn DSM's answers into the NAS card's payload. Exported for the check. */
+export function summarise(storage, usb, system, util, cfg = {}) {
+    const tempWarn = cfg.tempWarnC ?? 70;
+    const volWarn = cfg.volumeWarnPct ?? 85;
+    const problems = [];
+    const pct = (used, total) => (total > 0 ? Math.round((used / total) * 100) : 0);
+    const disks = (storage?.disks || []).map((d, i) => ({
+        slot: i + 1,
+        descr: d.name || d.device,
+        model: d.model,
+        tempC: typeof d.temp === "number" ? d.temp : undefined,
+        status: d.status === "normal" ? 0 : 1,
+        smart: Number(d.unc) > 0 ? `${d.unc} uncorrectable` : d.smart_status,
+    }));
+    const volumes = (storage?.volumes || []).map((v) => {
+        const total = Number(v.size?.total) || 0;
+        const used = Number(v.size?.used) || 0;
+        if (v.status !== "normal")
+            problems.push(`${v.vol_path} ${v.status}`);
+        return { mount: v.vol_path, totalGB: Math.round(total / 1e9), usedGB: Math.round(used / 1e9), pct: pct(used, total) };
+    });
+    for (const p of storage?.storagePools || []) {
+        if (p.status !== "normal")
+            problems.push(`pool ${p.device_type || p.id} ${p.status}`);
+    }
+    // DSM states USB sizes in MiB. Its USB disks report no SMART or temperature here.
+    for (const dev of usb?.devices || []) {
+        disks.push({ slot: disks.length + 1, descr: `USB ${dev.dev_id}`, model: dev.product_name, status: dev.status === "normal" ? 0 : 1 });
+        for (const p of dev.partitions || []) {
+            const total = Number(p.total_size_mb) || 0;
+            const used = Number(p.used_size_mb) || 0;
+            if (p.status !== "normal")
+                problems.push(`${p.share_name} ${p.status}`);
+            volumes.push({ mount: p.share_name, totalGB: Math.round((total * 1.048576) / 1000), usedGB: Math.round((used * 1.048576) / 1000), pct: pct(used, total) });
+        }
+    }
+    const mounts = volumes.map((v) => String(v.mount).split("/").pop());
+    for (const want of cfg.expectedVolumes || []) {
+        if (!mounts.includes(want))
+            problems.push(`${want} missing`);
+    }
+    if (!disks.length)
+        problems.push("DSM listed no disks");
+    if (system?.temperature_warning === true)
+        problems.push("DSM reports overheating");
+    const badDisks = disks.filter((d) => d.status !== 0 || (d.smart && d.smart !== "normal") || (d.tempC != null && d.tempC >= tempWarn));
+    const cpu = util?.cpu;
+    const mem = util?.memory;
+    return {
+        kind: "qnap",
+        reachable: true,
+        model: system?.model,
+        cpuPct: cpu ? (Number(cpu.user_load) || 0) + (Number(cpu.system_load) || 0) + (Number(cpu.other_load) || 0) : undefined,
+        sysTempC: typeof system?.sys_temp === "number" ? system.sys_temp : undefined,
+        memPct: typeof mem?.real_usage === "number" ? mem.real_usage : undefined,
+        memTotalMB: mem?.total_real ? Math.round(mem.total_real / 1024) : undefined,
+        disks,
+        diskCount: disks.length,
+        badDisks: badDisks.map(({ slot, descr, model, status, smart, tempC }) => ({ slot, descr, model, status, smart, tempC })),
+        volumes,
+        fullVolumes: volumes.filter((v) => v.pct >= volWarn),
+        tempWarnC: tempWarn,
+        volumeWarnPct: volWarn,
+        ...(problems.length ? { error: problems.join(", ").slice(0, 120) } : {}),
+    };
+}
+async function collect(call, cfg) {
+    const storage = await call("SYNO.Storage.CGI.Storage", "load_info", 1);
+    if (!storage.success)
+        throw new Error(apiErrorText("storage", storage.error?.code));
+    // Extras: the card is still worth drawing without them.
+    const [usb, system, util] = await Promise.all([
+        call("SYNO.Core.ExternalDevice.Storage.USB", "list", 1, { additional: '["all"]' }).catch(() => null),
+        call("SYNO.Core.System", "info", 3).catch(() => null),
+        call("SYNO.Core.System.Utilization", "get", 1).catch(() => null),
+    ]);
+    return summarise(storage.data, usb?.success ? usb.data : null, system?.success ? system.data : null, util?.success ? util.data : null, cfg);
+}
+export function createSynologyPlugin() {
+    let refreshTimer = null;
+    let lockedUntil = 0;
+    let lockedReason = "";
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const name = cfg.name || "synology";
+        let ip = "";
+        const report = (body) => plugin.send({ name, ip, ...body, timestamp: Date.now() }, `synology-${ip}`);
+        try {
+            const u = new URL(String(cfg.url));
+            ip = u.hostname;
+            if (u.protocol !== "https:")
+                throw new Error("url must be https, the password travels in the request");
+            if (!cfg.account || !cfg.password)
+                throw new Error("config needs account and password");
+            if (Date.now() < lockedUntil)
+                throw new Error(lockedReason);
+            const login = await post(cfg.url, { api: "SYNO.API.Auth", version: "6", method: "login", account: cfg.account, passwd: cfg.password, format: "sid" }, cfg);
+            if (!login.success) {
+                const code = login.error?.code;
+                const refused = authErrorText(code);
+                if (refused) {
+                    lockedUntil = Date.now() + REAUTH_AFTER_MS;
+                    lockedReason = `login refused: ${refused}. Next try within the hour, or restart the agent`;
+                    throw new Error(lockedReason);
+                }
+                throw new Error(`login failed: DSM error ${code}`);
+            }
+            const sid = String(login.data?.sid);
+            const call = (api, method, version, extra = {}) => post(cfg.url, { api, method, version: String(version), _sid: sid, ...extra }, cfg);
+            try {
+                await report(await collect(call, cfg));
+            }
+            finally {
+                await call("SYNO.API.Auth", "logout", 6).catch(() => { });
+            }
+        }
+        catch (e) {
+            await report({ kind: "qnap", reachable: false, error: String(e?.message || e).slice(0, 120) });
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 300000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("synology", "snmp", "Synology NAS disks, pools and volumes through the DSM web API", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createSynologyPlugin;

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -68,6 +68,13 @@ function parseJsonSafe(s, fallback) {
         return fallback;
     }
 }
+// WP-CLI prints user_registered as UTC with no zone marker.
+export function registrationCounts(registered, now = Date.now()) {
+    const day = 86_400_000;
+    const times = registered.map((r) => Date.parse(`${String(r).replace(" ", "T")}Z`)).filter(Number.isFinite);
+    const since = (days) => times.filter((t) => t >= now - days * day).length;
+    return { users: registered.length, signups: { d1: since(1), d7: since(7), d30: since(30) } };
+}
 async function collectSite(site) {
     const label = site.name || path.basename(site.path || "") || "wordpress";
     const servicePatterns = (site.servicePatterns || DEFAULT_SERVICE_PATTERNS).map((s) => s.toLowerCase());
@@ -92,6 +99,14 @@ async function collectSite(site) {
     catch (e) {
         out.adminsError = String(e?.message || e).slice(0, 160);
     }
+    // Registrations, for the activity view. Counts only: nothing here names anyone.
+    try {
+        const raw = await wp(site, ["user", "list", "--fields=user_registered", "--format=json"], 30000);
+        out.activity = registrationCounts(parseJsonSafe(raw, []).map((u) => u.user_registered));
+    }
+    catch (e) {
+        out.activityError = String(e?.message || e).slice(0, 160);
+    }
     // 2. WP core version (posture; latest-version comparison is done elsewhere).
     try {
         out.wpVersion = (await wp(site, ["core", "version"])).trim();

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.43",
+  "version": "1.1.45",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",
   "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "prepublishOnly": "npm run build"
+  },
   "files": [
     "dist",
     "types"
@@ -22,6 +27,7 @@
   },
   "author": "",
   "license": "ISC",
+  "packageManager": "pnpm@9.15.9",
   "devDependencies": {
     "@types/node": "^26.1.1",
     "nuxt": "^3.15.4",
@@ -53,9 +59,5 @@
   },
   "engines": {
     "node": ">=18.17"
-  },
-  "scripts": {
-    "build": "tsc",
-    "test": "echo \"Error: no test specified\" && exit 1"
   }
-}
+}