@serve.zone/dcrouter 18.1.0 → 18.1.1

package/ts/opsserver/handlers/stats.handler.ts

@@ -66,10 +66,10 @@ export class StatsHandler {
             stats: {
               sent: stats.sentToday,
               received: stats.receivedToday,
-              bounced: Math.floor(stats.sentToday * stats.bounceRate / 100),
+              bounced: stats.bouncedToday,
               queued: stats.queueSize,
-              failed: 0,
-              averageDeliveryTime: 0,
+              failed: stats.failedToday,
+              averageDeliveryTime: stats.averageDeliveryTime,
               deliveryRate: stats.deliveryRate,
               bounceRate: stats.bounceRate,
             },
@@ -219,10 +219,10 @@ export class StatsHandler {
                 metrics.email = {
                   sent: stats.sentToday,
                   received: stats.receivedToday,
-                  bounced: Math.floor(stats.sentToday * stats.bounceRate / 100),
+                  bounced: stats.bouncedToday,
                   queued: stats.queueSize,
-                  failed: 0,
-                  averageDeliveryTime: 0,
+                  failed: stats.failedToday,
+                  averageDeliveryTime: stats.averageDeliveryTime,
                   deliveryRate: stats.deliveryRate,
                   bounceRate: stats.bounceRate,
                   timeSeries,
@@ -256,7 +256,15 @@ export class StatsHandler {
           
           if (sections.security && this.opsServerRef.dcRouterRef.metricsManager) {
             promises.push(
-              this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats().then(stats => {
+              Promise.all([
+                this.opsServerRef.dcRouterRef.metricsManager.getSecurityStats(),
+                this.opsServerRef.dcRouterRef.authenticationEventManager
+                  ? this.opsServerRef.dcRouterRef.authenticationEventManager.getWindowStats()
+                  : Promise.resolve({
+                      windowStart: Date.now() - 86_400_000,
+                      successes: 0, failures: 0, events: [],
+                    }),
+              ]).then(([stats, authentication]) => {
                 // Get recent events from the SecurityLogger singleton
                 const securityLogger = SecurityLogger.getInstance();
                 const recentEvents = securityLogger.getRecentEvents(50).map((evt) => ({
@@ -276,7 +284,10 @@ export class StatsHandler {
                   spamDetected: stats.spamDetected,
                   malwareDetected: stats.malwareDetected,
                   phishingDetected: stats.phishingDetected,
-                  authenticationFailures: stats.authFailures,
+                  authenticationFailures: authentication.failures,
+                  authenticationSuccesses: authentication.successes,
+                  authenticationWindowStart: authentication.windowStart,
+                  authenticationEvents: authentication.events,
                   suspiciousActivities: stats.totalThreatsBlocked,
                   recentEvents,
                 };
@@ -463,9 +474,12 @@ export class StatsHandler {
     sentToday: number;
     receivedToday: number;
     bounceRate: number;
+    failedToday: number;
+    bouncedToday: number;
     deliveryRate: number;
     queueSize: number;
     domainBreakdown?: { [domain: string]: interfaces.data.IEmailStats };
+    averageDeliveryTime: number;
   }> {
     // Get metrics from MetricsManager if available
     if (this.opsServerRef.dcRouterRef.metricsManager) {
@@ -474,8 +488,11 @@ export class StatsHandler {
         sentToday: emailStats.sentToday,
         receivedToday: emailStats.receivedToday,
         bounceRate: emailStats.bounceRate,
+        failedToday: emailStats.failedToday,
+        bouncedToday: emailStats.bouncedToday,
         deliveryRate: emailStats.deliveryRate,
         queueSize: emailStats.queueSize,
+        averageDeliveryTime: emailStats.averageDeliveryTime,
       };
     }
     
@@ -484,8 +501,11 @@ export class StatsHandler {
       sentToday: 0,
       receivedToday: 0,
       bounceRate: 0,
-      deliveryRate: 100,
+      deliveryRate: 1,
+      failedToday: 0,
+      bouncedToday: 0,
       queueSize: 0,
+      averageDeliveryTime: 0,
     };
   }
   

package/ts/security/classes.authentication-event-manager.ts

@@ -0,0 +1,221 @@
+import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
+import type { DcRouter } from '../classes.dcrouter.js';
+import { AuthenticationEventDoc } from '../db/documents/classes.authentication-event.doc.js';
+import type {
+  IAuthenticationEvent,
+  TAuthenticationFailureReason,
+  TAuthenticationSource,
+  TResolvedAuthenticationSource,
+} from '../../ts_interfaces/data/stats.js';
+import {
+  SecurityEventType,
+  SecurityLogLevel,
+  SecurityLogger,
+} from './classes.securitylogger.js';
+
+const MAX_IN_MEMORY_EVENTS = 10_000;
+const MAX_PERSIST_BATCH_SIZE = 500;
+
+export interface IAuthenticationWindowStats {
+  windowStart: number;
+  successes: number;
+  failures: number;
+  events: IAuthenticationEvent[];
+}
+
+export class AuthenticationEventManager {
+  private pendingEvents = new Map<string, IAuthenticationEvent>();
+  private recentEvents = new Map<string, IAuthenticationEvent>();
+  private flushInFlight?: Promise<void>;
+  private pruneInFlight?: Promise<number>;
+  private windowStatsInFlight = new Map<string, Promise<IAuthenticationWindowStats>>();
+
+  constructor(private dcRouterRef: DcRouter) {}
+
+  private canPersist(): boolean {
+    return this.dcRouterRef.options.dbConfig?.enabled !== false
+      && Boolean(this.dcRouterRef.dcRouterDb?.isReady());
+  }
+
+  private rememberEvent(eventArg: IAuthenticationEvent): void {
+    this.pendingEvents.set(eventArg.id, eventArg);
+    this.recentEvents.set(eventArg.id, eventArg);
+    while (this.pendingEvents.size > MAX_IN_MEMORY_EVENTS) {
+      const oldestId = this.pendingEvents.keys().next().value as string | undefined;
+      if (!oldestId) break;
+      this.pendingEvents.delete(oldestId);
+      logger.log('error', 'Authentication event persistence buffer reached its limit; oldest event dropped');
+    }
+    while (this.recentEvents.size > MAX_IN_MEMORY_EVENTS) {
+      const oldestId = this.recentEvents.keys().next().value as string | undefined;
+      if (!oldestId) break;
+      this.recentEvents.delete(oldestId);
+    }
+  }
+
+  private async flushBufferedUnlocked(): Promise<void> {
+    if (!this.canPersist() || this.pendingEvents.size === 0) return;
+    const events = [...this.pendingEvents.values()];
+    for (let offset = 0; offset < events.length; offset += MAX_PERSIST_BATCH_SIZE) {
+      const batch = events.slice(offset, offset + MAX_PERSIST_BATCH_SIZE);
+      await AuthenticationEventDoc.upsertMany(batch);
+      for (const event of batch) {
+        if (this.pendingEvents.get(event.id) === event) {
+          this.pendingEvents.delete(event.id);
+        }
+      }
+    }
+  }
+
+  public async recordAttempt(optionsArg: {
+    username: string;
+    userId?: string;
+    success: boolean;
+    requestedAuthSource: TAuthenticationSource;
+    resolvedAuthSource?: TResolvedAuthenticationSource;
+    failureReason?: TAuthenticationFailureReason;
+  }): Promise<IAuthenticationEvent> {
+    const event: IAuthenticationEvent = {
+      id: `auth-${plugins.uuid.v4()}`,
+      timestamp: Date.now(),
+      username: String(optionsArg.username || '').trim().toLowerCase() || 'unknown',
+      success: optionsArg.success,
+      requestedAuthSource: optionsArg.requestedAuthSource,
+      ...(optionsArg.userId ? { userId: optionsArg.userId } : {}),
+      ...(optionsArg.resolvedAuthSource
+        ? { resolvedAuthSource: optionsArg.resolvedAuthSource }
+        : {}),
+      ...(optionsArg.failureReason ? { failureReason: optionsArg.failureReason } : {}),
+    };
+    // Buffer before any asynchronous persistence so authentication cannot be
+    // held behind a slow database and the bounded drop policy remains effective.
+    this.rememberEvent(event);
+    try {
+      SecurityLogger.getInstance().logEvent({
+        level: event.success ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
+        type: SecurityEventType.AUTHENTICATION,
+        message: event.success ? 'Authentication succeeded' : 'Authentication failed',
+        userId: event.userId,
+        success: event.success,
+        details: { authenticationEvent: event },
+      });
+    } catch (error) {
+      logger.log('warn', `Unable to mirror authentication event to the security log: ${(error as Error).message}`);
+    }
+    return event;
+  }
+
+  public flushBuffered(): Promise<void> {
+    if (this.flushInFlight) return this.flushInFlight;
+    const run = this.flushBufferedUnlocked();
+    this.flushInFlight = run;
+    run.then(
+      () => { if (this.flushInFlight === run) this.flushInFlight = undefined; },
+      () => { if (this.flushInFlight === run) this.flushInFlight = undefined; },
+    );
+    return run;
+  }
+
+  public pruneBefore(cutoffArg: number): Promise<number> {
+    if (this.pruneInFlight) return this.pruneInFlight;
+    const run = this.canPersist()
+      ? AuthenticationEventDoc.pruneBefore(cutoffArg)
+      : Promise.resolve(0);
+    this.pruneInFlight = run;
+    run.then(
+      () => { if (this.pruneInFlight === run) this.pruneInFlight = undefined; },
+      () => { if (this.pruneInFlight === run) this.pruneInFlight = undefined; },
+    );
+    return run;
+  }
+
+  private getInMemoryWindow(cutoffArg: number, limitArg: number): IAuthenticationWindowStats {
+    const events = [...this.recentEvents.values()]
+      .filter((event) => event.timestamp >= cutoffArg)
+      .sort((a, b) => b.timestamp - a.timestamp || b.id.localeCompare(a.id));
+    return {
+      windowStart: cutoffArg,
+      successes: events.filter((event) => event.success).length,
+      failures: events.filter((event) => !event.success).length,
+      events: events.slice(0, limitArg),
+    };
+  }
+
+  private async getWindowStatsUnlocked(
+    windowMsArg = 24 * 60 * 60 * 1000,
+    limitArg = 100,
+  ): Promise<IAuthenticationWindowStats> {
+    const cutoff = Date.now() - windowMsArg;
+    if (!this.canPersist()) {
+      return this.getInMemoryWindow(cutoff, limitArg);
+    }
+
+    try {
+      await this.flushBuffered();
+    } catch (error) {
+      logger.log('warn', `Unable to flush authentication event buffer: ${(error as Error).message}`);
+    }
+
+    try {
+      const durable = await AuthenticationEventDoc.getWindowSummary(cutoff, limitArg);
+      const buffered = [...this.pendingEvents.values()]
+        .filter((event) => event.timestamp >= cutoff);
+      const existingIds = new Set<string>();
+      const bufferedIds = buffered.map((event) => event.id);
+      for (let offset = 0; offset < bufferedIds.length; offset += MAX_PERSIST_BATCH_SIZE) {
+        const existingBatch = await AuthenticationEventDoc.findExistingIds(
+          bufferedIds.slice(offset, offset + MAX_PERSIST_BATCH_SIZE),
+        );
+        existingBatch.forEach((id) => existingIds.add(id));
+      }
+      const unpersisted = buffered.filter((event) => !existingIds.has(event.id));
+      const mergedById = new Map<string, IAuthenticationEvent>();
+      for (const event of durable.events) mergedById.set(event.id, event);
+      for (const event of unpersisted) {
+        if (!mergedById.has(event.id)) mergedById.set(event.id, event);
+      }
+      const mergedEvents = [...mergedById.values()]
+        .sort((a, b) => b.timestamp - a.timestamp || b.id.localeCompare(a.id))
+        .slice(0, limitArg);
+      return {
+        windowStart: cutoff,
+        successes: durable.successes + unpersisted.filter((event) => event.success).length,
+        failures: durable.failures + unpersisted.filter((event) => !event.success).length,
+        events: mergedEvents,
+      };
+    } catch (error) {
+      logger.log('warn', `Unable to query durable authentication events: ${(error as Error).message}`);
+      return this.getInMemoryWindow(cutoff, limitArg);
+    }
+  }
+
+  public getWindowStats(
+    windowMsArg = 24 * 60 * 60 * 1000,
+    limitArg = 100,
+  ): Promise<IAuthenticationWindowStats> {
+    if (!Number.isSafeInteger(windowMsArg) || windowMsArg <= 0) {
+      return Promise.reject(new Error('Authentication window must be a positive integer'));
+    }
+    if (!Number.isSafeInteger(limitArg) || limitArg <= 0 || limitArg > 500) {
+      return Promise.reject(new Error('Authentication event limit must be from 1 to 500'));
+    }
+    const key = `${windowMsArg}:${limitArg}`;
+    const existing = this.windowStatsInFlight.get(key);
+    if (existing) return existing;
+    const run = this.getWindowStatsUnlocked(windowMsArg, limitArg);
+    this.windowStatsInFlight.set(key, run);
+    run.then(
+      () => { if (this.windowStatsInFlight.get(key) === run) this.windowStatsInFlight.delete(key); },
+      () => { if (this.windowStatsInFlight.get(key) === run) this.windowStatsInFlight.delete(key); },
+    );
+    return run;
+  }
+
+  /** Test-only reset for the DcRouter-owned in-process buffers. */
+  public async resetForTests(): Promise<void> {
+    await this.flushInFlight?.catch(() => undefined);
+    this.pendingEvents.clear();
+    this.recentEvents.clear();
+  }
+}

package/ts/security/index.ts

@@ -26,3 +26,4 @@ export {
   type IRemoteIngressFirewallSnapshot,
 } from './classes.security-policy-manager.js';
 export * from './classes.route-policy-augmenter.js';
+export * from './classes.authentication-event-manager.js';

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.1.0',
+  version: '18.1.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/elements/overview/ops-view-overview.ts

@@ -119,7 +119,7 @@ export class OpsViewOverview extends DeesElement {
         <dees-heading level="hr">Activity Charts</dees-heading>
         <div class="chartGrid">
           <dees-chart-area
-            .label=${'Email Traffic (24h)'}
+            .label=${'Email Traffic — Last 24 Hours'}
             .series=${this.getEmailTrafficSeries()}
             .realtimeMode=${true}
             .rollingWindow=${86400000}
@@ -506,6 +506,7 @@ export class OpsViewOverview extends DeesElement {
     return [
       { name: 'Sent', color: '#22c55e', data: (ts.sent || []).map((p: any) => ({ x: p.timestamp, y: p.value })) },
       { name: 'Received', color: '#3b82f6', data: (ts.received || []).map((p: any) => ({ x: p.timestamp, y: p.value })) },
+      { name: 'Failed', color: '#ef4444', data: (ts.failed || []).map((p: any) => ({ x: p.timestamp, y: p.value })) },
     ];
   }
 

package/ts_web/elements/security/ops-view-security-authentication.ts

@@ -60,10 +60,8 @@ export class OpsViewSecurityAuthentication extends DeesElement {
       `;
     }
 
-    // Derive auth events from recentEvents
-    const allEvents: any[] = metrics.recentEvents || [];
-    const authEvents = allEvents.filter((evt: any) => evt.type === 'authentication');
-    const successfulLogins = authEvents.filter((evt: any) => evt.success === true).length;
+    const authEvents = metrics.authenticationEvents || [];
+    const successfulLogins = metrics.authenticationSuccesses || 0;
 
     const tiles: IStatsTile[] = [
       {
@@ -73,7 +71,7 @@ export class OpsViewSecurityAuthentication extends DeesElement {
         type: 'number',
         icon: 'lucide:LockOpen',
         color: metrics.authenticationFailures > 10 ? '#ef4444' : '#f59e0b',
-        description: 'Failed authentication attempts today',
+        description: 'Failed authentication attempts in the last 24 hours',
       },
       {
         id: 'successfulLogins',
@@ -82,17 +80,26 @@ export class OpsViewSecurityAuthentication extends DeesElement {
         type: 'number',
         icon: 'lucide:Lock',
         color: '#22c55e',
-        description: 'Successful logins today',
+        description: 'Successful logins in the last 24 hours',
       },
     ];
 
-    // Map auth events to login history table data
-    const loginHistory = authEvents.map((evt: any) => ({
+    const failureLabels: Record<string, string> = {
+      invalidCredentials: 'Invalid credentials',
+      serviceUnavailable: 'Authentication service unavailable',
+      identityIssuanceFailed: 'Session identity could not be issued',
+      internalError: 'Internal authentication error',
+    };
+    const loginHistory = authEvents.map((evt) => ({
       timestamp: evt.timestamp,
-      username: evt.details?.username || 'unknown',
-      ipAddress: evt.ipAddress || 'unknown',
-      success: evt.success ?? false,
-      reason: evt.success ? '' : evt.message || 'Authentication failed',
+      username: evt.username,
+      source: evt.resolvedAuthSource
+        ? evt.requestedAuthSource === 'auto'
+          ? `Auto → ${evt.resolvedAuthSource}`
+          : evt.resolvedAuthSource
+        : evt.requestedAuthSource,
+      success: evt.success,
+      reason: evt.success ? '' : failureLabels[evt.failureReason || ''] || 'Authentication failed',
     }));
 
     return html`
@@ -111,7 +118,7 @@ export class OpsViewSecurityAuthentication extends DeesElement {
         .displayFunction=${(item) => ({
           'Time': new Date(item.timestamp).toLocaleString(),
           'Username': item.username,
-          'IP Address': item.ipAddress,
+          'Source': item.source,
           'Status': item.success ? 'Success' : 'Failed',
           'Reason': item.reason || '-',
         })}

package/ts_web/elements/security/ops-view-security-overview.ts

@@ -63,12 +63,7 @@ export class OpsViewSecurityOverview extends DeesElement {
     const threatLevel = this.calculateThreatLevel(metrics);
     const threatScore = this.getThreatScore(metrics);
 
-    // Derive active sessions from recent successful auth events (last hour)
-    const allEvents: any[] = metrics.recentEvents || [];
-    const oneHourAgo = Date.now() - 3600000;
-    const recentAuthSuccesses = allEvents.filter(
-      (evt: any) => evt.type === 'authentication' && evt.success === true && evt.timestamp >= oneHourAgo
-    ).length;
+    const successfulLogins = metrics.authenticationSuccesses || 0;
 
     const tiles: IStatsTile[] = [
       {
@@ -95,16 +90,16 @@ export class OpsViewSecurityOverview extends DeesElement {
         type: 'number',
         icon: 'lucide:ShieldCheck',
         color: '#ef4444',
-        description: 'Total threats blocked today',
+        description: 'Threats observed in the last 24 hours',
       },
       {
-        id: 'activeSessions',
-        title: 'Active Sessions',
-        value: recentAuthSuccesses,
+        id: 'successfulLogins',
+        title: 'Successful Logins',
+        value: successfulLogins,
         type: 'number',
         icon: 'lucide:Users',
         color: '#22c55e',
-        description: 'Authenticated in last hour',
+        description: 'Successful logins in the last 24 hours',
       },
       {
         id: 'authFailures',
@@ -113,7 +108,7 @@ export class OpsViewSecurityOverview extends DeesElement {
         type: 'number',
         icon: 'lucide:LockOpen',
         color: metrics.authenticationFailures > 10 ? '#ef4444' : '#f59e0b',
-        description: 'Failed login attempts today',
+        description: 'Failed login attempts in the last 24 hours',
       },
     ];