honeyweb-core 2.0.2 → 2.0.4

package/middleware/request-analyzer.js

@@ -1,29 +1,12 @@
-// honeyweb-core/middleware/request-analyzer.js
-// Request analysis middleware
-
-/**
- * Create request analyzer middleware
- * @param {Object} config - Configuration
- * @param {Object} storage - Storage instance
- * @param {Object} botTracker - Bot tracker instance
- * @param {Object} detector - Detection engine
- * @param {Object} aiAnalyzer - AI analyzer
- * @param {Object} logger - Logger instance
- * @param {Object} events - Event emitter
- * @returns {Function} - Middleware function
- */
 function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer, logger, events) {
     const trapPaths = config.traps.paths;
 
     return async function analyzeRequest(req, res, next) {
         const clientIP = req.ip || req.connection.remoteAddress;
-
-        // 1. THREAT DETECTION (whitelist check happens FIRST to protect legit bots)
         const analysis = await detector.analyze(req, clientIP);
 
-        // Skip ALL checks if legitimate bot (even trap paths!)
+        // Legitimate bots skip all checks
         if (analysis.legitimateBot) {
-            // Record legitimate bot visit for dashboard
             botTracker.recordVisit({
                 botName: analysis.whitelist.botName,
                 ip: clientIP,
@@ -32,22 +15,18 @@ function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer
                 verified: analysis.whitelist.verified,
                 timestamp: Date.now()
             });
-
             logger.info('Legitimate bot detected', {
-                ip: clientIP,
-                botName: analysis.whitelist.botName,
-                verified: analysis.whitelist.verified,
-                path: req.path
+                ip: clientIP, botName: analysis.whitelist.botName,
+                verified: analysis.whitelist.verified, path: req.path
             });
             return next();
         }
 
-        // 2. CHECK IF TRAP ACCESSED (only after confirming not a legit bot)
+        // Trap access — immediate ban
         if (trapPaths.includes(req.path)) {
             logger.trapTriggered(clientIP, req.path);
             events.emitTrapTriggered(clientIP, req.path);
 
-            // Ban the IP immediately
             try {
                 await storage.ban(clientIP, `Trap triggered: ${req.path}`);
                 events.emitIpBanned(clientIP, `Trap triggered: ${req.path}`);
@@ -55,67 +34,47 @@ function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer
                 logger.error('Error banning IP', { error: err.message });
             }
 
-            // AI analysis for trap trigger
             if (aiAnalyzer.isEnabled()) {
                 aiAnalyzer.analyzeTrap({
-                    ip: clientIP,
-                    path: req.path,
-                    userAgent: req.headers['user-agent'],
-                    timestamp: Date.now()
+                    ip: clientIP, path: req.path,
+                    userAgent: req.headers['user-agent'], timestamp: Date.now()
                 }).then(report => {
                     if (report) {
                         logger.info('AI Trap Analysis', { ip: clientIP, report });
                         events.emitAiAnalysis(clientIP, report);
                     }
-                }).catch(err => {
-                    logger.error('AI analysis failed', { error: err.message });
-                });
+                }).catch(err => logger.error('AI trap analysis failed', { error: err.message }));
             }
 
-            return res.status(403).send(
-                '<h1>403 Forbidden</h1><p>You have accessed a restricted area.</p>'
-            );
+            return res.status(403).send('<h1>403 Forbidden</h1><p>You have accessed a restricted area.</p>');
         }
 
-        // 3. OTHER THREAT DETECTION (patterns, rate limiting, behavioral)
-
-        if (analysis.detected) {
+        // Pattern/rate/behavioral/bot threats
+        if (analysis.detected && analysis.threatLevel >= 50) {
             logger.threatDetected(clientIP, analysis.threats, analysis.threatLevel);
             events.emitThreatDetected(clientIP, analysis.threats, analysis.threatLevel);
 
-            // Ban if threat level is high
-            if (analysis.threatLevel >= 50) {
-                try {
-                    await storage.ban(clientIP, `Threat detected: ${analysis.threats[0]}`);
-                    events.emitIpBanned(clientIP, `Threat detected: ${analysis.threats[0]}`);
-                } catch (err) {
-                    logger.error('Error banning IP', { error: err.message });
-                }
-
-                // AI analysis for threat
-                if (aiAnalyzer.isEnabled()) {
-                    aiAnalyzer.analyzeThreat({
-                        ip: clientIP,
-                        path: req.path,
-                        method: req.method,
-                        threats: analysis.threats,
-                        userAgent: req.headers['user-agent'],
-                        referer: req.headers['referer'],
-                        timestamp: Date.now()
-                    }).then(report => {
-                        if (report) {
-                            logger.info('AI Threat Analysis', { ip: clientIP, report });
-                            events.emitAiAnalysis(clientIP, report);
-                        }
-                    }).catch(err => {
-                        logger.error('AI analysis failed', { error: err.message });
-                    });
-                }
+            try {
+                await storage.ban(clientIP, `Threat detected: ${analysis.threats[0]}`);
+                events.emitIpBanned(clientIP, `Threat detected: ${analysis.threats[0]}`);
+            } catch (err) {
+                logger.error('Error banning IP', { error: err.message });
+            }
 
-                return res.status(403).send(
-                    '<h1>403 Forbidden</h1><p>Malicious activity detected.</p>'
-                );
+            if (aiAnalyzer.isEnabled()) {
+                aiAnalyzer.analyzeThreat({
+                    ip: clientIP, path: req.path, method: req.method,
+                    threats: analysis.threats, userAgent: req.headers['user-agent'],
+                    referer: req.headers['referer'], timestamp: Date.now()
+                }).then(report => {
+                    if (report) {
+                        logger.info('AI Threat Analysis', { ip: clientIP, report });
+                        events.emitAiAnalysis(clientIP, report);
+                    }
+                }).catch(err => logger.error('AI analysis failed', { error: err.message }));
             }
+
+            return res.status(403).send('<h1>403 Forbidden</h1><p>Malicious activity detected.</p>');
         }
 
         next();

package/middleware/trap-injector.js

@@ -1,50 +1,25 @@
-// honeyweb-core/middleware/trap-injector.js
-// Trap injection middleware (extracted from main index.js)
-
 const cheerio = require('cheerio');
 
-/**
- * Create trap injector middleware
- * @param {Object} config - Trap configuration
- * @returns {Function} - Middleware function
- */
 function createTrapInjector(config) {
     const trapPaths = config.traps.paths;
 
     return function injectTraps(req, res, next) {
-        // Only inject if trap injection is enabled
-        if (!config.traps.injection.enabled) {
-            return next();
-        }
+        if (!config.traps.injection.enabled) return next();
 
-        // Intercept res.send to inject traps
         const originalSend = res.send;
-
         res.send = function (body) {
-            // Only inject if the content is HTML
             if (typeof body === 'string' && (body.includes('<html') || body.includes('<body'))) {
                 try {
                     const $ = cheerio.load(body);
-
-                    // Pick a random trap
                     const trapUrl = trapPaths[Math.floor(Math.random() * trapPaths.length)];
-
-                    // Create invisible link (Hidden by CSS)
-                    const trapLink = `<a href="${trapUrl}" style="opacity:0; position:absolute; z-index:-999; left:-9999px;">Admin Panel</a>`;
-
-                    // Inject into body
-                    $('body').append(trapLink);
-
+                    $('body').append(`<a href="${trapUrl}" style="opacity:0;position:absolute;z-index:-999;left:-9999px;">Admin Panel</a>`);
                     body = $.html();
                 } catch (err) {
-                    // If cheerio fails, just send original body
-                    console.error('[TrapInjector] Failed to inject trap:', err.message);
+                    // If injection fails, send original body
                 }
             }
-
             originalSend.call(this, body);
         };
-
         next();
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeyweb-core",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Production-ready honeypot middleware with behavioral analysis, bot fingerprinting, and AI threat intelligence",
   "main": "index.js",
   "scripts": {

package/storage/bot-tracker.js

@@ -1,16 +1,11 @@
 // honeyweb-core/storage/bot-tracker.js
-// Track legitimate bot visits for dashboard display
 
 class BotTracker {
     constructor() {
-        this.botVisits = new Map(); // botName -> array of visits
-        this.maxVisitsPerBot = 50; // Keep last 50 visits per bot
+        this.botVisits = new Map();
+        this.maxVisitsPerBot = 50;
     }
 
-    /**
-     * Record a legitimate bot visit
-     * @param {Object} visit - Visit data
-     */
     recordVisit(visit) {
         const { botName, ip, path, userAgent, verified, timestamp } = visit;
 
@@ -19,49 +14,23 @@ class BotTracker {
         }
 
         const visits = this.botVisits.get(botName);
+        visits.unshift({ ip, path, userAgent, verified, timestamp: timestamp || Date.now() });
 
-        // Add new visit at the beginning (most recent first)
-        visits.unshift({
-            ip,
-            path,
-            userAgent,
-            verified,
-            timestamp: timestamp || Date.now()
-        });
-
-        // Keep only last N visits
-        if (visits.length > this.maxVisitsPerBot) {
-            visits.pop();
-        }
+        if (visits.length > this.maxVisitsPerBot) visits.pop();
     }
 
-    /**
-     * Get all bot visits grouped by bot name
-     * @returns {Object} - Bot visits grouped by name
-     */
     getAllVisits() {
         const result = {};
-
         for (const [botName, visits] of this.botVisits.entries()) {
             result[botName] = visits;
         }
-
         return result;
     }
 
-    /**
-     * Get visits for a specific bot
-     * @param {string} botName - Bot name
-     * @returns {Array} - Array of visits
-     */
     getVisitsByBot(botName) {
         return this.botVisits.get(botName) || [];
     }
 
-    /**
-     * Get statistics
-     * @returns {Object} - Statistics
-     */
     getStats() {
         let totalVisits = 0;
         const botCounts = {};
@@ -71,37 +40,21 @@ class BotTracker {
             botCounts[botName] = visits.length;
         }
 
-        return {
-            totalBots: this.botVisits.size,
-            totalVisits,
-            botCounts
-        };
+        return { totalBots: this.botVisits.size, totalVisits, botCounts };
     }
 
-    /**
-     * Clear all bot visits
-     */
     clear() {
         this.botVisits.clear();
     }
 
-    /**
-     * Cleanup old visits (older than 7 days)
-     */
     cleanup() {
-        const maxAge = 7 * 24 * 60 * 60 * 1000; // 7 days
+        const maxAge = 7 * 24 * 60 * 60 * 1000;
         const now = Date.now();
 
         for (const [botName, visits] of this.botVisits.entries()) {
-            const filtered = visits.filter(visit => {
-                return (now - visit.timestamp) < maxAge;
-            });
-
-            if (filtered.length === 0) {
-                this.botVisits.delete(botName);
-            } else {
-                this.botVisits.set(botName, filtered);
-            }
+            const filtered = visits.filter(v => (now - v.timestamp) < maxAge);
+            if (filtered.length === 0) this.botVisits.delete(botName);
+            else this.botVisits.set(botName, filtered);
         }
     }
 }

package/storage/index.js

@@ -1,24 +1,15 @@
 // honeyweb-core/storage/index.js
-// Storage factory
 
 const JsonStore = require('./json-store');
 const MemoryStore = require('./memory-store');
 
-/**
- * Create storage instance based on configuration
- * @param {Object} config - Storage configuration
- * @returns {JsonStore|MemoryStore}
- */
 function createStorage(config) {
     const type = config.type || 'json';
 
     switch (type) {
-        case 'json':
-            return new JsonStore(config);
-        case 'memory':
-            return new MemoryStore(config);
-        default:
-            throw new Error(`[HoneyWeb] Unknown storage type: ${type}`);
+        case 'json': return new JsonStore(config);
+        case 'memory': return new MemoryStore(config);
+        default: throw new Error(`[HoneyWeb] Unknown storage type: ${type}`);
     }
 }
 

package/storage/json-store.js

@@ -1,5 +1,4 @@
 // honeyweb-core/storage/json-store.js
-// Async JSON storage with in-memory cache
 
 const fs = require('fs-extra');
 const path = require('path');
@@ -8,18 +7,14 @@ const LRUCache = require('../utils/cache');
 class JsonStore {
     constructor(config) {
         this.filePath = path.resolve(config.path || './blocked-ips.json');
-        this.banDuration = config.banDuration || 86400000; // 24 hours
+        this.banDuration = config.banDuration || 86400000;
         this.autoCleanup = config.autoCleanup !== false;
-        this.cache = config.cache ? new LRUCache(1000, 60000) : null; // 1 minute cache
+        this.cache = config.cache ? new LRUCache(1000, 60000) : null;
 
-        // Initialize file
         this._initFile();
 
-        // Start auto-cleanup if enabled
         if (this.autoCleanup) {
-            this.cleanupInterval = setInterval(() => {
-                this._cleanupExpired();
-            }, 300000); // Clean up every 5 minutes
+            this.cleanupInterval = setInterval(() => this._cleanupExpired(), 300000);
         }
     }
 
@@ -33,24 +28,12 @@ class JsonStore {
         }
     }
 
-    /**
-     * Get all banned IPs
-     * @returns {Promise<Array>} - Array of banned IP objects
-     */
     async getAll() {
-        // Check cache first
-        if (this.cache && this.cache.has('all')) {
-            return this.cache.get('all');
-        }
+        if (this.cache && this.cache.has('all')) return this.cache.get('all');
 
         try {
             const data = await fs.readJson(this.filePath);
-
-            // Cache the result
-            if (this.cache) {
-                this.cache.set('all', data);
-            }
-
+            if (this.cache) this.cache.set('all', data);
             return data;
         } catch (err) {
             console.error('[JsonStore] Error reading file:', err);
@@ -58,24 +41,16 @@ class JsonStore {
         }
     }
 
-    /**
-     * Check if IP is banned
-     * @param {string} ip
-     * @returns {Promise<boolean>}
-     */
     async isBanned(ip) {
         const bannedIPs = await this.getAll();
 
-        // Support both simple array format and object format
         if (bannedIPs.length > 0 && typeof bannedIPs[0] === 'string') {
             return bannedIPs.includes(ip);
         }
 
-        // Object format with expiry
         const entry = bannedIPs.find(entry => entry.ip === ip);
         if (!entry) return false;
 
-        // Check if expired
         if (entry.expiry && Date.now() > entry.expiry) {
             await this.unban(ip);
             return false;
@@ -84,79 +59,47 @@ class JsonStore {
         return true;
     }
 
-    /**
-     * Ban an IP
-     * @param {string} ip
-     * @param {string} reason
-     * @returns {Promise<void>}
-     */
     async ban(ip, reason = 'Suspicious activity') {
         const bannedIPs = await this.getAll();
 
-        // Check if already banned
-        const existingIndex = bannedIPs.findIndex(entry =>
+        const exists = bannedIPs.some(entry =>
             typeof entry === 'string' ? entry === ip : entry.ip === ip
         );
+        if (exists) return;
 
-        if (existingIndex !== -1) {
-            return; // Already banned
-        }
-
-        // Add new ban with expiry
-        const banEntry = {
+        bannedIPs.push({
             ip,
             reason,
             timestamp: Date.now(),
             expiry: Date.now() + this.banDuration
-        };
-
-        bannedIPs.push(banEntry);
+        });
 
         await this._save(bannedIPs);
     }
 
-    /**
-     * Unban an IP
-     * @param {string} ip
-     * @returns {Promise<void>}
-     */
     async unban(ip) {
         const bannedIPs = await this.getAll();
-
         const filtered = bannedIPs.filter(entry =>
             typeof entry === 'string' ? entry !== ip : entry.ip !== ip
         );
-
         await this._save(filtered);
     }
 
-    /**
-     * Save data to file and invalidate cache
-     * @private
-     */
     async _save(data) {
         try {
             await fs.writeJson(this.filePath, data, { spaces: 2 });
-
-            // Invalidate cache
-            if (this.cache) {
-                this.cache.delete('all');
-            }
+            if (this.cache) this.cache.delete('all');
         } catch (err) {
             console.error('[JsonStore] Error writing file:', err);
         }
     }
 
-    /**
-     * Clean up expired bans
-     * @private
-     */
     async _cleanupExpired() {
         const bannedIPs = await this.getAll();
         const now = Date.now();
 
         const active = bannedIPs.filter(entry => {
-            if (typeof entry === 'string') return true; // Keep simple format
+            if (typeof entry === 'string') return true;
             return !entry.expiry || now <= entry.expiry;
         });
 
@@ -165,41 +108,24 @@ class JsonStore {
         }
     }
 
-    /**
-     * Get statistics
-     * @returns {Promise<Object>}
-     */
     async getStats() {
         const bannedIPs = await this.getAll();
         const now = Date.now();
-
-        let active = 0;
-        let expired = 0;
+        let active = 0, expired = 0;
 
         bannedIPs.forEach(entry => {
-            if (typeof entry === 'string') {
-                active++;
-            } else if (!entry.expiry || now <= entry.expiry) {
+            if (typeof entry === 'string' || !entry.expiry || now <= entry.expiry) {
                 active++;
             } else {
                 expired++;
             }
         });
 
-        return {
-            total: bannedIPs.length,
-            active,
-            expired
-        };
+        return { total: bannedIPs.length, active, expired };
     }
 
-    /**
-     * Cleanup and stop intervals
-     */
     destroy() {
-        if (this.cleanupInterval) {
-            clearInterval(this.cleanupInterval);
-        }
+        if (this.cleanupInterval) clearInterval(this.cleanupInterval);
     }
 }