@panguard-ai/threat-cloud 0.2.2 → 0.3.0

package/dist/migrations.js

@@ -0,0 +1,116 @@
+/**
+ * Schema migration system for Threat Cloud database
+ * 威脅雲資料庫 schema 遷移系統
+ *
+ * Replaces the fragile try-catch ALTER TABLE pattern with numbered migrations.
+ * Each migration runs exactly once, tracked by a schema_version table.
+ *
+ * @module @panguard-ai/threat-cloud/migrations
+ */
+/**
+ * All migrations in order. New migrations MUST be appended with
+ * the next sequential version number. Never remove or reorder.
+ * 所有遷移按順序排列，新遷移必須追加下一個版本號。
+ */
+export const migrations = [
+    {
+        version: 1,
+        name: 'add_rules_classification_columns',
+        up: (db) => {
+            // These columns may already exist from the original CREATE TABLE.
+            // SQLite does not support IF NOT EXISTS for ADD COLUMN, so we
+            // check the table_info pragma before adding each one.
+            const existing = db
+                .prepare("PRAGMA table_info('rules')")
+                .all();
+            const columnNames = new Set(existing.map((c) => c.name));
+            const columnsToAdd = [
+                { name: 'category', type: 'TEXT' },
+                { name: 'severity', type: 'TEXT' },
+                { name: 'mitre_techniques', type: 'TEXT' },
+                { name: 'tags', type: 'TEXT' },
+            ];
+            for (const col of columnsToAdd) {
+                if (!columnNames.has(col.name)) {
+                    db.exec(`ALTER TABLE rules ADD COLUMN ${col.name} ${col.type}`);
+                }
+            }
+        },
+    },
+    {
+        version: 2,
+        name: 'create_audit_log_table',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS audit_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          timestamp TEXT NOT NULL DEFAULT (datetime('now')),
+          actor TEXT NOT NULL,
+          action TEXT NOT NULL,
+          resource_type TEXT NOT NULL,
+          resource_id TEXT,
+          details TEXT,
+          ip_address TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp);
+        CREATE INDEX IF NOT EXISTS idx_audit_log_actor ON audit_log(actor);
+        CREATE INDEX IF NOT EXISTS idx_audit_log_action ON audit_log(action);
+        CREATE INDEX IF NOT EXISTS idx_audit_log_resource ON audit_log(resource_type);
+      `);
+        },
+    },
+];
+/**
+ * Ensure the schema_version tracking table exists.
+ * 確保 schema_version 追蹤資料表存在。
+ */
+function ensureVersionTable(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS schema_version (
+      version INTEGER NOT NULL
+    )
+  `);
+    // Seed with version 0 if empty (fresh database)
+    const row = db.prepare('SELECT version FROM schema_version').get();
+    if (row === undefined) {
+        db.prepare('INSERT INTO schema_version (version) VALUES (?)').run(0);
+    }
+}
+/**
+ * Get the current schema version from the database.
+ * 取得資料庫目前的 schema 版本。
+ */
+function getCurrentVersion(db) {
+    const row = db.prepare('SELECT version FROM schema_version').get();
+    return row.version;
+}
+/**
+ * Run all pending migrations above the current schema version.
+ * Each migration runs inside a transaction for atomicity.
+ * 執行所有高於目前版本的待處理遷移。每個遷移在交易中執行以確保原子性。
+ *
+ * @returns The number of migrations applied
+ */
+export function runMigrations(db) {
+    ensureVersionTable(db);
+    const currentVersion = getCurrentVersion(db);
+    const pending = migrations.filter((m) => m.version > currentVersion);
+    if (pending.length === 0) {
+        return 0;
+    }
+    let applied = 0;
+    for (const migration of pending) {
+        const runOne = db.transaction(() => {
+            console.log(`[threat-cloud] Running migration v${migration.version}: ${migration.name}`);
+            migration.up(db);
+            db.prepare('UPDATE schema_version SET version = ?').run(migration.version);
+        });
+        runOne();
+        applied++;
+        console.log(`[threat-cloud] Migration v${migration.version} applied successfully`);
+    }
+    console.log(`[threat-cloud] Schema up to date (v${getCurrentVersion(db)}, ${applied} migration(s) applied)`);
+    return applied;
+}
+//# sourceMappingURL=migrations.js.map

package/dist/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,kCAAkC;QACxC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,kEAAkE;YAClE,8DAA8D;YAC9D,sDAAsD;YACtD,MAAM,QAAQ,GAAG,EAAE;iBAChB,OAAO,CAAC,4BAA4B,CAAC;iBACrC,GAAG,EAA6B,CAAC;YACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzD,MAAM,YAAY,GAA0C;gBAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/B,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,EAAE,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;OAgBP,CAAC,CAAC;QACL,CAAC;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAAqB;IAC/C,EAAE,CAAC,IAAI,CAAC;;;;GAIP,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAEnD,CAAC;IACd,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAAqB;IAC9C,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAE/D,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,EAAqB;IACjD,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvB,MAAM,cAAc,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CACT,qCAAqC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAC5E,CAAC;YACF,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6BAA6B,SAAS,CAAC,OAAO,uBAAuB,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,sCAAsC,iBAAiB,CAAC,EAAE,CAAC,KAAK,OAAO,wBAAwB,CAChG,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server.d.ts

@@ -31,8 +31,12 @@ export declare class ThreatCloudServer {
     private readonly llmReviewer;
     private promotionTimer;
     private rateLimits;
+    private rateLimitCleanupTimer;
+    private statsCache;
     /** Promotion interval: 15 minutes / 推廣間隔：15 分鐘 */
     private static readonly PROMOTION_INTERVAL_MS;
+    /** Stats cache TTL: 60 seconds */
+    private static readonly STATS_CACHE_TTL_MS;
     constructor(config: ServerConfig);
     /** Start the server / 啟動伺服器 */
     start(): Promise<void>;
@@ -45,8 +49,14 @@ export declare class ThreatCloudServer {
     private handleGetRules;
     /** POST /api/rules - Publish rules (single or batch) */
     private handlePostRule;
-    /** GET /api/stats */
+    /** GET /api/stats (cached 60s) */
     private handleGetStats;
+    /** GET /api/threats?page=1&limit=50 (admin-only, paginated) */
+    private handleGetThreats;
+    /** GET /api/atr-proposals?status=pending (admin-only) */
+    private handleGetATRProposals;
+    /** GET /api/skill-threats?limit=50 (admin-only) */
+    private handleGetSkillThreats;
     /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
     private handlePostATRProposal;
     /** POST /api/atr-feedback - Submit feedback on an ATR rule */
@@ -71,9 +81,11 @@ export declare class ThreatCloudServer {
      * 取得社群技能黑名單（從技能威脅回報聚合）
      */
     private handleGetSkillBlacklist;
+    /** GET /api/audit-log?page=1&limit=50 (admin-only) */
+    private handleGetAuditLog;
     /** Anonymize IP by zeroing last octet / 匿名化 IP */
     private anonymizeIP;
-    /** Serve admin dashboard HTML (requires admin key or returns login page) */
+    /** Serve admin dashboard HTML -- requires admin auth via query param or header */
     private serveAdminDashboard;
     /** Check admin API key for write-protected endpoints / 檢查管理員 API 金鑰 */
     private checkAdminAuth;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,YAAY,CAAC;AAoBpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAE5D,kDAAkD;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;gBAEnD,MAAM,EAAE,YAAY;IAQhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmD5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAeb,aAAa;IA8K3B,0EAA0E;YAC5D,gBAAgB;IAuC9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IAkBtB,wDAAwD;YAC1C,cAAc;IAoB5B,qBAAqB;IACrB,OAAO,CAAC,cAAc;IAMtB,uEAAuE;YACzD,qBAAqB;IA4CnC,8DAA8D;YAChD,qBAAqB;IAiBnC,+DAA+D;YACjD,qBAAqB;IA+BnC,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAQzB,yDAAyD;IACzD,OAAO,CAAC,kBAAkB;IAQ1B,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IAqBtC,uEAAuE;IACvE,OAAO,CAAC,uBAAuB;IAK/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAU/B,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB;IAQ3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAOtB,gCAAgC;IAChC,OAAO,CAAC,cAAc;IAWtB,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAKhB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAgHxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,YAAY,CAAC;AAkBpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,UAAU,CAAqD;IAEvE,kDAAkD;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;IAC/D,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAExC,MAAM,EAAE,YAAY;IAQhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4D5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAmBb,aAAa;IAmO3B,0EAA0E;YAC5D,gBAAgB;IA0C9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IAmBtB,wDAAwD;YAC1C,cAAc;IAuB5B,kCAAkC;IAClC,OAAO,CAAC,cAAc;IAYtB,+DAA+D;IAC/D,OAAO,CAAC,gBAAgB;IAcxB,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAO7B,mDAAmD;IACnD,OAAO,CAAC,qBAAqB;IAO7B,uEAAuE;YACzD,qBAAqB;IA4CnC,8DAA8D;YAChD,qBAAqB;IAiBnC,+DAA+D;YACjD,qBAAqB;IAmCnC,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IASzB,yDAAyD;IACzD,OAAO,CAAC,kBAAkB;IAS1B,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IAqBtC,uEAAuE;IACvE,OAAO,CAAC,uBAAuB;IAK/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAU/B,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAczB,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAmB3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAOtB,gCAAgC;IAChC,OAAO,CAAC,cAAc;IAWtB,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAShB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAgHxB"}

package/dist/server.js

@@ -23,16 +23,17 @@ import { createServer } from 'node:http';
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, basename, relative, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
 import { ThreatCloudDB } from './database.js';
 import { LLMReviewer } from './llm-reviewer.js';
 import { getAdminHTML } from './admin-dashboard.js';
-/** Simple structured logger for threat-cloud (no core dependency) */
+/** Structured JSON logger for threat-cloud */
 const log = {
-    info: (msg) => {
-        process.stdout.write(`[threat-cloud] ${msg}\n`);
+    info: (msg, extra) => {
+        process.stdout.write(JSON.stringify({ ts: new Date().toISOString(), level: 'info', msg, ...extra }) + '\n');
     },
-    error: (msg, err) => {
-        process.stderr.write(`[threat-cloud] ERROR ${msg}${err ? `: ${err instanceof Error ? err.message : String(err)}` : ''}\n`);
+    error: (msg, err, extra) => {
+        process.stderr.write(JSON.stringify({ ts: new Date().toISOString(), level: 'error', msg, error: err instanceof Error ? err.message : String(err), ...extra }) + '\n');
     },
 };
 /**
@@ -46,8 +47,12 @@ export class ThreatCloudServer {
     llmReviewer;
     promotionTimer = null;
     rateLimits = new Map();
+    rateLimitCleanupTimer = null;
+    statsCache = null;
     /** Promotion interval: 15 minutes / 推廣間隔：15 分鐘 */
     static PROMOTION_INTERVAL_MS = 15 * 60 * 1000;
+    /** Stats cache TTL: 60 seconds */
+    static STATS_CACHE_TTL_MS = 60_000;
     constructor(config) {
         this.config = config;
         this.db = new ThreatCloudDB(config.dbPath);
@@ -103,6 +108,14 @@ export class ThreatCloudServer {
                         log.error('Promotion cycle failed', err);
                     }
                 }, ThreatCloudServer.PROMOTION_INTERVAL_MS);
+                // Rate limiter cleanup (every 60s, purge expired entries)
+                this.rateLimitCleanupTimer = setInterval(() => {
+                    const now = Date.now();
+                    for (const [ip, entry] of this.rateLimits) {
+                        if (now > entry.resetAt)
+                            this.rateLimits.delete(ip);
+                    }
+                }, 60_000);
                 resolve();
             });
         });
@@ -114,6 +127,10 @@ export class ThreatCloudServer {
                 clearInterval(this.promotionTimer);
                 this.promotionTimer = null;
             }
+            if (this.rateLimitCleanupTimer) {
+                clearInterval(this.rateLimitCleanupTimer);
+                this.rateLimitCleanupTimer = null;
+            }
             this.db.close();
             if (this.server) {
                 this.server.close(() => resolve());
@@ -124,24 +141,31 @@ export class ThreatCloudServer {
         });
     }
     async handleRequest(req, res) {
-        // Security headers
+        const startTime = Date.now();
+        const requestId = randomUUID();
+        // Security headers + request ID
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('X-Frame-Options', 'DENY');
         res.setHeader('Content-Type', 'application/json');
+        res.setHeader('X-Request-Id', requestId);
         const clientIP = req.socket.remoteAddress ?? 'unknown';
         // Rate limiting
         if (!this.checkRateLimit(clientIP)) {
-            this.sendJson(res, 429, { ok: false, error: 'Rate limit exceeded' });
+            this.sendJson(res, 429, { ok: false, error: 'Rate limit exceeded', request_id: requestId });
+            log.info('request', { method: req.method, path: req.url, status: 429, duration_ms: Date.now() - startTime, client_ip: clientIP, request_id: requestId });
             return;
         }
         // API key verification (skip for health check)
         const url = req.url ?? '/';
-        const pathname = url.split('?')[0];
+        const rawPathname = url.split('?')[0];
+        // API versioning: strip /v1 prefix for backward compatibility
+        const pathname = rawPathname.startsWith('/v1/') ? rawPathname.slice(3) : rawPathname === '/v1' ? '/' : rawPathname;
         if (pathname !== '/health' && this.config.apiKeyRequired) {
             const authHeader = req.headers.authorization ?? '';
             const token = authHeader.replace('Bearer ', '');
             if (!this.config.apiKeys.includes(token)) {
-                this.sendJson(res, 401, { ok: false, error: 'Invalid API key' });
+                this.sendJson(res, 401, { ok: false, error: 'Invalid API key', request_id: requestId });
+                log.info('request', { method: req.method, path: rawPathname, status: 401, duration_ms: Date.now() - startTime, client_ip: clientIP, request_id: requestId });
                 return;
             }
         }
@@ -157,8 +181,11 @@ export class ThreatCloudServer {
         if (req.method === 'OPTIONS') {
             res.writeHead(204);
             res.end();
+            log.info('request', { method: 'OPTIONS', path: rawPathname, status: 204, duration_ms: Date.now() - startTime, client_ip: clientIP, request_id: requestId });
             return;
         }
+        // Store requestId on response for sendJson to include
+        res._requestId = requestId;
         try {
             switch (pathname) {
                 case '/health':
@@ -171,7 +198,14 @@ export class ThreatCloudServer {
                     this.serveAdminDashboard(req, res);
                     break;
                 case '/api/threats':
-                    if (req.method === 'POST') {
+                    if (req.method === 'GET') {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 403, { ok: false, error: 'Admin API key required' });
+                            break;
+                        }
+                        this.handleGetThreats(url, res);
+                    }
+                    else if (req.method === 'POST') {
                         await this.handlePostThreat(req, res);
                     }
                     else {
@@ -205,7 +239,14 @@ export class ThreatCloudServer {
                     }
                     break;
                 case '/api/atr-proposals':
-                    if (req.method === 'POST') {
+                    if (req.method === 'GET') {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 403, { ok: false, error: 'Admin API key required' });
+                            break;
+                        }
+                        this.handleGetATRProposals(url, res);
+                    }
+                    else if (req.method === 'POST') {
                         await this.handlePostATRProposal(req, res);
                     }
                     else {
@@ -221,7 +262,14 @@ export class ThreatCloudServer {
                     }
                     break;
                 case '/api/skill-threats':
-                    if (req.method === 'POST') {
+                    if (req.method === 'GET') {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 403, { ok: false, error: 'Admin API key required' });
+                            break;
+                        }
+                        this.handleGetSkillThreats(url, res);
+                    }
+                    else if (req.method === 'POST') {
                         await this.handlePostSkillThreat(req, res);
                     }
                     else {
@@ -279,14 +327,35 @@ export class ThreatCloudServer {
                         this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
                     }
                     break;
+                case '/api/audit-log':
+                    if (req.method === 'GET') {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 403, { ok: false, error: 'Admin API key required' });
+                            break;
+                        }
+                        this.handleGetAuditLog(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
                 default:
                     this.sendJson(res, 404, { ok: false, error: 'Not found' });
             }
         }
         catch (err) {
-            log.error('Request failed', err);
-            this.sendJson(res, 500, { ok: false, error: 'Internal server error' });
+            log.error('Request failed', err, { request_id: requestId, path: rawPathname });
+            this.sendJson(res, 500, { ok: false, error: 'Internal server error', request_id: requestId });
         }
+        // Request logging
+        log.info('request', {
+            method: req.method,
+            path: rawPathname,
+            status: res.statusCode,
+            duration_ms: Date.now() - startTime,
+            client_ip: clientIP,
+            request_id: requestId,
+        });
     }
     /** POST /api/threats - Upload anonymized threat data (single or batch) */
     async handlePostThreat(req, res) {
@@ -314,6 +383,8 @@ export class ThreatCloudServer {
             data.attackSourceIP = this.anonymizeIP(data.attackSourceIP);
             this.db.insertThreat(data);
         }
+        const clientIP = req.socket.remoteAddress ?? 'unknown';
+        this.db.audit.logAction('client', 'threat.submit', 'threat', undefined, { count: events.length }, clientIP);
         this.sendJson(res, 201, {
             ok: true,
             data: { message: 'Threat data received', count: events.length },
@@ -333,7 +404,8 @@ export class ThreatCloudServer {
         const rules = since
             ? this.db.getRulesSince(since, filters)
             : this.db.getAllRules(5000, filters);
-        this.sendJson(res, 200, rules);
+        const ruleList = Array.isArray(rules) ? rules : [];
+        this.sendJson(res, 200, { ok: true, data: ruleList, meta: { total: ruleList.length } });
     }
     /** POST /api/rules - Publish rules (single or batch) */
     async handlePostRule(req, res) {
@@ -350,14 +422,50 @@ export class ThreatCloudServer {
             this.db.upsertRule(rule);
             count++;
         }
+        const clientIP = req.socket.remoteAddress ?? 'unknown';
+        this.db.audit.logAction('admin', 'rule.create', 'rule', undefined, { count }, clientIP);
         this.sendJson(res, 201, { ok: true, data: { message: `${count} rule(s) published`, count } });
     }
-    /** GET /api/stats */
+    /** GET /api/stats (cached 60s) */
     handleGetStats(res) {
-        res.setHeader('Cache-Control', 'public, max-age=300, s-maxage=300');
+        res.setHeader('Cache-Control', 'public, max-age=60, s-maxage=60');
+        const now = Date.now();
+        if (this.statsCache && now < this.statsCache.expiresAt) {
+            this.sendJson(res, 200, { ok: true, data: this.statsCache.data });
+            return;
+        }
         const stats = this.db.getStats();
+        this.statsCache = { data: stats, expiresAt: now + ThreatCloudServer.STATS_CACHE_TTL_MS };
         this.sendJson(res, 200, { ok: true, data: stats });
     }
+    /** GET /api/threats?page=1&limit=50 (admin-only, paginated) */
+    handleGetThreats(url, res) {
+        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
+        const page = Math.max(1, parseInt(params.get('page') ?? '1', 10));
+        const limit = Math.min(200, Math.max(1, parseInt(params.get('limit') ?? '50', 10)));
+        const offset = (page - 1) * limit;
+        const threats = this.db.getThreats(limit, offset);
+        const total = this.db.getThreatCount();
+        this.sendJson(res, 200, {
+            ok: true,
+            data: threats,
+            meta: { total, page, limit, pages: Math.ceil(total / limit) },
+        });
+    }
+    /** GET /api/atr-proposals?status=pending (admin-only) */
+    handleGetATRProposals(url, res) {
+        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
+        const status = params.get('status') ?? undefined;
+        const proposals = this.db.getATRProposals(status);
+        this.sendJson(res, 200, { ok: true, data: proposals });
+    }
+    /** GET /api/skill-threats?limit=50 (admin-only) */
+    handleGetSkillThreats(url, res) {
+        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
+        const limit = Math.min(500, Math.max(1, parseInt(params.get('limit') ?? '50', 10)));
+        const threats = this.db.getSkillThreats(limit);
+        this.sendJson(res, 200, { ok: true, data: threats });
+    }
     /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
     async handlePostATRProposal(req, res) {
         const body = await this.readBody(req);
@@ -438,6 +546,8 @@ export class ThreatCloudServer {
             clientId: clientId ?? data.clientId,
         };
         this.db.insertSkillThreat(submission);
+        const clientIP = req.socket.remoteAddress ?? 'unknown';
+        this.db.audit.logAction('client', 'skill_threat.submit', 'skill_threat', submission.skillHash, { skillName: submission.skillName, riskScore: submission.riskScore }, clientIP);
         this.sendJson(res, 201, { ok: true, data: { message: 'Skill threat received' } });
     }
     /** GET /api/atr-rules?since=<ISO> - Fetch confirmed/promoted ATR rules */
@@ -446,7 +556,8 @@ export class ThreatCloudServer {
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
         const since = params.get('since') ?? undefined;
         const rules = this.db.getConfirmedATRRules(since);
-        this.sendJson(res, 200, rules);
+        const ruleList = Array.isArray(rules) ? rules : [];
+        this.sendJson(res, 200, { ok: true, data: ruleList, meta: { total: ruleList.length } });
     }
     /** GET /api/yara-rules?since=<ISO> - Fetch YARA rules */
     handleGetYaraRules(url, res) {
@@ -454,7 +565,8 @@ export class ThreatCloudServer {
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
         const since = params.get('since') ?? undefined;
         const rules = this.db.getRulesBySource('yara', since);
-        this.sendJson(res, 200, rules);
+        const ruleList = Array.isArray(rules) ? rules : [];
+        this.sendJson(res, 200, { ok: true, data: ruleList, meta: { total: ruleList.length } });
     }
     /** GET /api/feeds/ip-blocklist?minReputation=70 - IP blocklist feed (plain text) */
     handleGetIPBlocklist(url, res) {
@@ -510,6 +622,20 @@ export class ThreatCloudServer {
         const blacklist = this.db.getSkillBlacklist(minReports, minAvgRisk);
         this.sendJson(res, 200, { ok: true, data: blacklist });
     }
+    /** GET /api/audit-log?page=1&limit=50 (admin-only) */
+    handleGetAuditLog(url, res) {
+        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
+        const page = Math.max(1, parseInt(params.get('page') ?? '1', 10));
+        const limit = Math.min(200, Math.max(1, parseInt(params.get('limit') ?? '50', 10)));
+        const offset = (page - 1) * limit;
+        const entries = this.db.audit.getAuditLog(limit, offset);
+        const total = this.db.audit.getAuditLogCount();
+        this.sendJson(res, 200, {
+            ok: true,
+            data: entries,
+            meta: { total, page, limit, pages: Math.ceil(total / limit) },
+        });
+    }
     /** Anonymize IP by zeroing last octet / 匿名化 IP */
     anonymizeIP(ip) {
         if (ip.includes('.')) {
@@ -527,8 +653,19 @@ export class ThreatCloudServer {
         }
         return ip;
     }
-    /** Serve admin dashboard HTML (requires admin key or returns login page) */
-    serveAdminDashboard(_req, res) {
+    /** Serve admin dashboard HTML -- requires admin auth via query param or header */
+    serveAdminDashboard(req, res) {
+        // Server-side auth: require admin key via ?key= param or Authorization header
+        if (this.config.adminApiKey) {
+            const url = new URL(req.url ?? '/', `http://localhost:${this.config.port}`);
+            const queryKey = url.searchParams.get('key');
+            const headerKey = (req.headers.authorization ?? '').replace('Bearer ', '');
+            if (queryKey !== this.config.adminApiKey && headerKey !== this.config.adminApiKey) {
+                res.writeHead(401, { 'Content-Type': 'text/plain' });
+                res.end('Unauthorized: admin API key required. Use ?key=YOUR_KEY or Authorization header.');
+                return;
+            }
+        }
         res.setHeader('Content-Type', 'text/html; charset=utf-8');
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('X-Robots-Tag', 'noindex, nofollow');
@@ -559,7 +696,7 @@ export class ThreatCloudServer {
         return new Promise((resolve, reject) => {
             const chunks = [];
             let size = 0;
-            const MAX_BODY = 52_428_800; // 50MB (for batch rule uploads)
+            const MAX_BODY = 5_242_880; // 5MB (reasonable limit for JSON payloads)
             req.on('data', (chunk) => {
                 size += chunk.length;
                 if (size > MAX_BODY) {
@@ -575,8 +712,12 @@ export class ThreatCloudServer {
     }
     /** Send JSON response / 發送 JSON 回應 */
     sendJson(res, status, data) {
+        const requestId = res._requestId;
+        const payload = typeof data === 'object' && data !== null
+            ? { ...data, request_id: requestId }
+            : data;
         res.writeHead(status);
-        res.end(JSON.stringify(data));
+        res.end(JSON.stringify(payload));
     }
     /**
      * Seed rules from bundled config/ directory on first startup.