domma-cms 0.82.0 → 0.84.0

package/plugins/security/plugin.js

@@ -0,0 +1,303 @@
+/**
+ * Security (free) - defends a Domma CMS site and shows where it is weak.
+ *
+ *  - A guard on every request (global: this is a fastify-plugin, as Analytics
+ *    Pro is): blocked addresses get a bare 403; probe paths (wp-login.php, .env,
+ *    …) a bare 404 before any rendering, and an address that keeps probing is
+ *    blocked for a while. Genuinely local calls are never touched.
+ *  - Sign-in lockout (a 'before' login check - core 0.83's registerLoginCheck),
+ *    counted from auth:loginFailed; password rules (registerPasswordCheck).
+ *  - A sign-in log, and notifications for lockouts and a success after many fails.
+ *  - A health check (server/facts.js gathers, admin/lib/health.js judges).
+ *
+ * Fails OPEN for page traffic (a bug here logs and lets the request through)
+ * and CLOSED for its own admin routes. bin/unlock.js always gets you back in.
+ *
+ * Routes (/api/plugins/security; the `security` permission: read / manage):
+ *   GET /health[?refresh=1] · GET /count · GET /overview · GET /signins
+ *   GET /blocks · POST /blocks · DELETE /blocks (rule | ip) · DELETE /lockouts
+ *   GET|PUT /settings
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import fp from 'fastify-plugin';
+import defaultConfig from './config.js';
+import {createState} from './server/state.js';
+import {gatherFacts} from './server/facts.js';
+import {evaluate} from './admin/lib/health.js';
+import {checkSettings, mergeDefaults} from './admin/lib/settings.js';
+import {accountKey, activeLocks, addressKey, lockedUntil, pruneLockouts, recordFailure, recordSuccess, retryText} from './admin/lib/lockout.js';
+import {passwordProblems} from './admin/lib/policy.js';
+import {isProbe} from './admin/lib/probes.js';
+import {blockedBy, isTrusted, pruneBlocks, recordProbe} from './admin/lib/blocks.js';
+import {ipRuleValid, isLoopbackIp, plainIp} from './admin/lib/ip.js';
+import {getConfig, saveConfig} from '../../server/config.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const NAME = 'security';
+
+/** A call from this machine itself, not a relayed visitor. */
+const genuinelyLocal = (request) => isLoopbackIp(request.raw?.socket?.remoteAddress) && !request.headers['x-forwarded-for'];
+
+let commonPasswords = null;
+function common() {
+    if (commonPasswords) return commonPasswords;
+    try {
+        commonPasswords = new Set(fs.readFileSync(path.join(__dirname, 'server', 'common-passwords.txt'), 'utf8')
+            .split('\n').map(s => s.trim().toLowerCase()).filter(Boolean));
+    } catch {
+        commonPasswords = new Set();
+    }
+    return commonPasswords;
+}
+
+async function security(fastify, options = {}) {
+    let cfg = mergeDefaults({...defaultConfig, ...(options.settings ?? {})});
+    const state = createState(path.join(__dirname, 'data'));
+    const hooks = options.hooks ?? {};
+    const canCheck = typeof hooks.registerLoginCheck === 'function';
+    const log = fastify.log;
+    const recentProbes = new Map();
+
+    const notify = (p) => { try { hooks.notify?.(p); } catch { /* notifications are a courtesy */ } };
+    hooks.registerNotificationSource?.({id: 'lockouts', label: 'Sign-in lockouts', description: 'An account or address was locked after repeated wrong passwords.', severity: 'warning', audience: 'admins'});
+    hooks.registerNotificationSource?.({id: 'suspicious', label: 'Suspicious sign-ins', description: 'Someone signed in after many wrong passwords.', severity: 'warning', audience: 'admins'});
+    hooks.registerNotificationSource?.({id: 'probes', label: 'Scanners blocked', description: 'An address probing for weaknesses was blocked.', severity: 'info', audience: 'admins', defaultOn: false});
+
+    // ---------------------------------------------------------------------
+    // 1. The guard
+    // ---------------------------------------------------------------------
+    fastify.addHook('onRequest', async (request, reply) => {
+        try {
+            if (genuinelyLocal(request)) return;
+            const ip = plainIp(request.ip);
+            const now = Date.now();
+            const s = state.get();
+            const blocked = blockedBy(s, ip, now);
+            if (blocked) {
+                reply.code(403).header('content-type', 'text/plain; charset=utf-8').header('cache-control', 'no-store').send('Forbidden');
+                return reply;
+            }
+            if (!cfg.probes.enabled) return;
+            const reqPath = String(request.url || '').split('?')[0];
+            if (reqPath.startsWith('/api/') || reqPath.startsWith('/admin')) return;
+            if (!isProbe(reqPath, {extra: cfg.probes.extra, allow: cfg.probes.allow})) return;
+            state.count('probes');
+            if (recordProbe(recentProbes, ip, {now, blockAfter: cfg.probes.blockAfter, withinMin: cfg.probes.withinMin}) && !isTrusted(s, ip, now)) {
+                recentProbes.delete(ip);
+                state.change((st) => { st.temp[ip] = {until: now + cfg.probes.blockForMin * 60_000, reason: `Probing (${reqPath.slice(0, 80)})`, at: new Date(now).toISOString()}; });
+                state.count('blocks');
+                if (cfg.notify.probeBlocks) {
+                    notify({source: 'probes', severity: 'info', title: `Scanner blocked: ${ip}`, dedupeKey: `probe:${ip}`,
+                        body: `${ip} kept asking for pages a Domma site never has (last: ${reqPath.slice(0, 80)}) and is blocked for ${cfg.probes.blockForMin} minutes.`,
+                        link: '#/plugins/security/blocked'});
+                }
+            }
+            reply.code(404).header('content-type', 'text/plain; charset=utf-8').header('cache-control', 'no-store').send('Not found');
+            return reply;
+        } catch (err) {
+            log.warn(`[security] guard skipped a request: ${err.message}`);
+        }
+    });
+
+    // ---------------------------------------------------------------------
+    // 2. Sign-in: lockout, password rules, the log
+    // ---------------------------------------------------------------------
+    if (canCheck) {
+        hooks.registerLoginCheck({
+            id: 'lockout',
+            phase: 'before',
+            check({email, ip}) {
+                if (!cfg.lockout.enabled || isLoopbackIp(ip)) return {allow: true};
+                const s = state.get().lockouts;
+                const until = Math.max(lockedUntil(s, accountKey(email)), lockedUntil(s, addressKey(plainIp(ip))));
+                if (!until) return {allow: true};
+                return {deny: true, status: 429, message: `Too many wrong passwords. Try again ${retryText(until)}.`};
+            }
+        });
+        hooks.registerPasswordCheck?.({
+            id: 'policy',
+            check(password, {email, name}) {
+                if (!cfg.policy.enabled) return '';
+                return passwordProblems(password, {email, name}, {...cfg.policy, common: common()}).join(' ');
+            }
+        });
+    } else {
+        log.warn('[security] this engine has no sign-in checks (needs Domma CMS 0.83+): lockout and password rules are off.');
+    }
+
+    hooks.on?.('auth:loginFailed', (e) => {
+        try {
+            const ip = plainIp(e.ip);
+            state.logSignin({at: new Date().toISOString(), ok: false, email: e.email || '', userId: e.userId || null, ip, ua: e.ua || '', reason: e.reason || ''});
+            state.count('failed');
+            // A refusal by the lockout itself is not another wrong password.
+            if (!cfg.lockout.enabled || e.by === 'security:lockout' || isLoopbackIp(ip)) return;
+            const now = Date.now();
+            const locks = state.change((s) => ({
+                account: e.email ? recordFailure(s.lockouts, accountKey(e.email), {now, ...cfg.lockout, threshold: cfg.lockout.accountThreshold}) : 0,
+                address: ip ? recordFailure(s.lockouts, addressKey(ip), {now, ...cfg.lockout, threshold: cfg.lockout.addressThreshold}) : 0
+            }));
+            if (cfg.notify.lockouts && (locks.account || locks.address)) {
+                const who = locks.account ? `the account ${e.email}` : `the address ${ip}`;
+                notify({source: 'lockouts', severity: 'warning', title: `Sign-in locked: ${locks.account ? e.email : ip}`,
+                    dedupeKey: `lock:${locks.account ? e.email : ip}`,
+                    body: `Too many wrong passwords for ${who} (last from ${ip || 'an unknown address'}). Locked until ${new Date(locks.account || locks.address).toLocaleTimeString('en-GB')}.`,
+                    link: '#/plugins/security/blocked'});
+            }
+        } catch (err) {
+            log.warn(`[security] failed sign-in not recorded: ${err.message}`);
+        }
+    });
+
+    hooks.on?.('auth:loginSucceeded', (e) => {
+        try {
+            const ip = plainIp(e.ip);
+            const now = Date.now();
+            state.logSignin({at: new Date(now).toISOString(), ok: true, email: e.email || '', userId: e.userId || null, ip, ua: e.ua || ''});
+            const recent = state.get().lockouts[accountKey(e.email)]?.fails?.length || 0;
+            state.change((s) => {
+                recordSuccess(s.lockouts, accountKey(e.email));
+                if (ip) s.trusted[ip] = now;
+            });
+            if (cfg.notify.successAfterFails && recent >= 3) {
+                notify({source: 'suspicious', severity: 'warning', title: `Signed in after ${recent} wrong passwords: ${e.email}`,
+                    dedupeKey: `after-fails:${e.email}`,
+                    body: `${e.email} signed in from ${ip || 'an unknown address'} after ${recent} wrong passwords in a row. If that was not them, change their password and end their sessions.`,
+                    link: '#/plugins/security/signins'});
+            }
+        } catch (err) {
+            log.warn(`[security] sign-in not recorded: ${err.message}`);
+        }
+    });
+
+    // ---------------------------------------------------------------------
+    // 3. The API
+    // ---------------------------------------------------------------------
+    let lastHealth = null;
+    async function health(request, refresh = false) {
+        if (!refresh && lastHealth && Date.now() - lastHealth.at < 10 * 60_000) return lastHealth;
+        const facts = await gatherFacts(request, {settings: cfg, checks: canCheck, twoFactor: Boolean(options.twoFactor)});
+        lastHealth = {...evaluate(facts, {staleAdminDays: cfg.staleAdminDays}), at: Date.now()};
+        return lastHealth;
+    }
+
+    fastify.register(async (routes) => {
+        const {authenticate, requirePermission} = options.auth ?? {};
+        const may = (action) => ({preHandler: [authenticate, requirePermission('security', action)]});
+
+        routes.get('/health', may('read'), async (request) => health(request, request.query?.refresh === '1'));
+
+        // The sidebar badge: checks failing (red when one is critical).
+        routes.get('/count', may('read'), async (request) => {
+            const h = lastHealth || await health(request).catch(() => null);
+            if (!h) return {count: 0};
+            const bad = h.checks.filter(c => c.status === 'fail' || c.status === 'warn');
+            return {
+                count: bad.length,
+                label: bad.length ? `${bad.length} security ${bad.length === 1 ? 'check needs' : 'checks need'} attention` : 'All security checks pass',
+                ...(h.critical && {tone: 'danger'}),
+                details: {title: 'Security', rows: [{label: 'Score', value: `${h.score}%`}, {label: 'Needs attention', value: String(bad.length)}],
+                    items: bad.slice(0, 5).map(c => ({text: c.title, meta: c.status === 'fail' ? 'failing' : 'could be better'})),
+                    empty: 'Every check passes.'}
+            };
+        });
+
+        routes.get('/overview', may('read'), async () => {
+            const s = state.get();
+            const now = Date.now();
+            const day = state.readSignins(now - 86_400_000);
+            const today = s.counters.day === new Date().toISOString().slice(0, 10) ? s.counters : {probes: 0, blocks: 0, failed: 0};
+            return {
+                today,
+                failed24h: day.filter(e => !e.ok).length,
+                succeeded24h: day.filter(e => e.ok).length,
+                locks: activeLocks(s.lockouts, now).length,
+                blocked: Object.values(s.temp).filter(t => t.until > now).length + s.rules.length,
+                checks: canCheck,
+                settings: {lockout: cfg.lockout.enabled, policy: cfg.policy.enabled, probes: cfg.probes.enabled}
+            };
+        });
+
+        routes.get('/signins', may('read'), async (request) => {
+            const days = Math.min(365, Math.max(1, parseInt(request.query?.days, 10) || cfg.signinDays));
+            const list = state.readSignins(Date.now() - days * 86_400_000);
+            return {days, entries: list.slice(0, 5000)};
+        });
+
+        routes.get('/blocks', may('read'), async (request) => {
+            const s = state.get();
+            const now = Date.now();
+            return {
+                rules: s.rules,
+                temp: Object.entries(s.temp).filter(([, t]) => t.until > now).map(([ip, t]) => ({ip, ...t})).sort((a, b) => b.until - a.until),
+                locks: activeLocks(s.lockouts, now),
+                you: plainIp(request?.ip)
+            };
+        });
+
+        routes.post('/blocks', may('manage'), async (request, reply) => {
+            const rule = String(request.body?.rule ?? '').trim();
+            const note = String(request.body?.note ?? '').trim().slice(0, 200);
+            if (!ipRuleValid(rule)) return reply.code(400).send({error: 'Not an address or range (81.2.69.142, 192.168.1.*, 10.0.0.0/8, 2a00:23c7:*).'});
+            if (isLoopbackIp(rule)) return reply.code(400).send({error: 'This machine itself cannot be blocked.'});
+            const mine = plainIp(request.ip);
+            const {ipMatches} = await import('./admin/lib/ip.js');
+            if (mine && ipMatches(mine, [rule]) && request.body?.confirmSelf !== true) {
+                return reply.code(409).send({error: `That would block you (${mine}). Send it again to confirm.`, self: true});
+            }
+            state.change((s) => { if (!s.rules.some(r => r.rule === rule)) s.rules.push({rule, note, by: request.user?.email || '', at: new Date().toISOString()}); });
+            return {ok: true};
+        });
+
+        routes.delete('/blocks', may('manage'), async (request) => {
+            const rule = String(request.body?.rule ?? request.query?.rule ?? '').trim();
+            const ip = plainIp(request.body?.ip ?? request.query?.ip ?? '');
+            state.change((s) => {
+                if (rule) s.rules = s.rules.filter(r => r.rule !== rule);
+                if (ip) { delete s.temp[ip]; recentProbes.delete(ip); }
+            });
+            return {ok: true};
+        });
+
+        routes.delete('/lockouts', may('manage'), async (request) => {
+            const key = String(request.body?.key ?? request.query?.key ?? '');
+            state.change((s) => {
+                if (key === '*') s.lockouts = {};
+                else if (key) delete s.lockouts[key];
+            });
+            return {ok: true};
+        });
+
+        routes.get('/settings', may('read'), async () => ({settings: cfg, checks: canCheck}));
+
+        routes.put('/settings', may('manage'), async (request, reply) => {
+            const {errors, settings} = checkSettings(request.body ?? {}, cfg);
+            if (Object.keys(errors).length) {
+                return reply.code(400).send({error: Object.values(errors).join(' '), errors});
+            }
+            const plugins = getConfig('plugins') ?? {};
+            plugins[NAME] ??= {};
+            plugins[NAME].settings = settings;
+            saveConfig('plugins', plugins);
+            cfg = settings;
+            lastHealth = null;
+            return {settings: cfg, checks: canCheck};
+        });
+    }, {prefix: `/api/plugins/${NAME}`});
+
+    // ---------------------------------------------------------------------
+    // 4. Daily: forget what no longer matters
+    // ---------------------------------------------------------------------
+    const tidy = () => {
+        state.change((s) => { pruneLockouts(s.lockouts, {windowMin: cfg.lockout.windowMin}); pruneBlocks(s); });
+        state.pruneSignins(cfg.signinDays);
+    };
+    const daily = setInterval(tidy, 6 * 3_600_000);
+    daily.unref?.();
+    setTimeout(tidy, 60_000).unref?.();
+    fastify.addHook('onClose', (_i, done) => { clearInterval(daily); state.close(); done(); });
+}
+
+export default fp(security, {name: 'security'});

package/plugins/security/plugin.json

@@ -0,0 +1,64 @@
+{
+  "name": "security",
+  "displayName": "Security",
+  "version": "1.0.1",
+  "tier": "free",
+  "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
+  "author": "Domma CMS",
+  "date": "2026-09-26",
+  "icon": "shield",
+  "permissions": [
+    {
+      "key": "security",
+      "label": "Security",
+      "group": "Plugins",
+      "description": "See the site's security (read) or change its settings, blocks and lockouts (manage).",
+      "actions": [
+        {
+          "key": "read",
+          "label": "View",
+          "description": "See the health check, sign-ins and blocks"
+        },
+        {
+          "key": "manage",
+          "label": "Manage",
+          "description": "Change settings; block, unblock and unlock"
+        }
+      ],
+      "grant": [
+        "admin"
+      ]
+    }
+  ],
+  "admin": {
+    "sidebar": [
+      {
+        "id": "security",
+        "text": "Security",
+        "icon": "shield",
+        "url": "#/plugins/security",
+        "section": "#/plugins/security",
+        "permission": "security",
+        "countUrl": "/api/plugins/security/count"
+      }
+    ],
+    "routes": [
+      {
+        "path": "/plugins/security",
+        "view": "security-main",
+        "title": "Security"
+      },
+      {
+        "path": "/plugins/security/:tab",
+        "view": "security-main",
+        "title": "Security"
+      }
+    ],
+    "views": {
+      "security-main": {
+        "entry": "security/admin/views/security.js",
+        "exportName": "securityView"
+      }
+    }
+  }
+}

package/plugins/security/server/common-passwords.NOTICE

@@ -0,0 +1,3 @@
+common-passwords.txt is SecLists' "10k-most-common.txt"
+(https://github.com/danielmiessler/SecLists, Passwords/Common-Credentials), MIT licence,
+Copyright (c) 2018 Daniel Miessler. Used by the password policy: a password on this list is refused.