honeyweb-core 2.0.3 → 2.0.4

package/middleware/dashboard.js

@@ -1,5 +1,4 @@
 // honeyweb-core/middleware/dashboard.js
-// Dashboard middleware with cookie-based auth (no credentials in URL)
 
 const crypto = require('crypto');
 
@@ -67,7 +66,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
     return async function dashboard(req, res, next) {
         if (req.path !== dashboardPath) return next();
 
-        // POST login
         if (req.method === 'POST') {
             const submitted = req.body && req.body.secret;
             if (submitted === dashboardSecret) {
@@ -77,7 +75,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
             return renderLoginPage(res, 'Invalid secret. Try again.');
         }
 
-        // Legacy ?key= support (redirect to clean URL)
         if (req.query.key) {
             if (req.query.key === dashboardSecret) {
                 res.setHeader('Set-Cookie', `honeyweb_session=${sessionToken}; HttpOnly; Path=${dashboardPath}; SameSite=Strict; Max-Age=3600`);
@@ -109,14 +106,12 @@ function createDashboard(config, storage, botTracker, detector, events) {
         code{font-family:'Cascadia Code','Fira Code',Consolas,monospace;background:#0d1117;padding:2px 6px;border-radius:4px;font-size:0.88em;color:#e6edf3}
         pre{font-family:'Cascadia Code','Fira Code',Consolas,monospace}
 
-        /* Layout */
         .wrap{max-width:1100px;margin:0 auto;padding:32px 24px 48px}
         .top-bar{display:flex;align-items:center;justify-content:space-between;margin-bottom:32px;flex-wrap:wrap;gap:12px}
         .top-bar h1{font-size:1.6em;color:#e6edf3}
         .top-bar h1 span{color:#58a6ff}
         .top-bar .meta{color:#484f58;font-size:0.78em}
 
-        /* Stat cards */
         .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:16px;margin-bottom:36px}
         .stat{background:#161b22;border:1px solid #21262d;border-radius:8px;padding:20px}
         .stat .label{font-size:0.75em;text-transform:uppercase;letter-spacing:.5px;color:#8b949e;margin-bottom:8px;font-weight:600}
@@ -124,13 +119,10 @@ function createDashboard(config, storage, botTracker, detector, events) {
         .stat .val.green{color:#238636}
         .stat .val.blue{color:#58a6ff}
 
-        /* Section headers */
         .section-hdr{font-size:1.15em;color:#e6edf3;margin:32px 0 16px;padding-bottom:8px;border-bottom:1px solid #21262d;display:flex;align-items:center;gap:10px}
 
-        /* Card generic */
         .card{background:#161b22;border:1px solid #21262d;border-radius:8px;padding:20px 24px;margin-bottom:14px}
 
-        /* Bot cards */
         .bot-hdr{display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin-bottom:8px}
         .bot-hdr h3{color:#e6edf3;font-size:1em;margin:0}
         .badge{padding:3px 8px;border-radius:12px;font-size:0.7em;font-weight:700;text-transform:uppercase;letter-spacing:.3px}
@@ -143,14 +135,12 @@ function createDashboard(config, storage, botTracker, detector, events) {
         details summary{cursor:pointer;color:#58a6ff;font-size:0.88em;margin-top:4px}
         details summary:hover{text-decoration:underline}
 
-        /* AI reports */
         .ai-card{background:#161b22;border:1px solid #21262d;border-radius:8px;padding:20px 24px;margin-bottom:14px}
         .ai-header{display:flex;justify-content:space-between;align-items:center;margin-bottom:12px;flex-wrap:wrap;gap:8px}
         .ai-header .ip-tag{background:rgba(248,81,73,0.1);color:#f85149;padding:4px 10px;border-radius:12px;font-size:0.78em;font-weight:600}
         .ai-header .ts{color:#484f58;font-size:0.78em}
         .ai-body{background:#0d1117;border:1px solid #21262d;border-radius:6px;padding:16px;white-space:pre-wrap;word-wrap:break-word;font-size:0.85em;line-height:1.6;color:#c9d1d9}
 
-        /* Banned table */
         .ban-table{width:100%;border-collapse:collapse;background:#161b22;border:1px solid #21262d;border-radius:8px;overflow:hidden}
         .ban-table th{background:#1a2332;color:#8b949e;font-size:0.75em;text-transform:uppercase;letter-spacing:.5px;font-weight:600;padding:12px 16px;text-align:left;border-bottom:1px solid #21262d}
         .ban-table td{padding:12px 16px;border-bottom:1px solid #21262d;font-size:0.9em}
@@ -159,15 +149,12 @@ function createDashboard(config, storage, botTracker, detector, events) {
         .ban-table .reason{color:#f85149;font-weight:500}
         .ban-table .ts{color:#484f58;font-size:0.8em}
 
-        /* Empty states */
         .empty{text-align:center;padding:36px;color:#484f58;background:#161b22;border:1px solid #21262d;border-radius:8px}
         .empty p:first-child{font-size:0.95em;color:#8b949e}
         .empty p.hint{font-size:0.78em;margin-top:8px}
 
-        /* Footer */
         .dash-footer{text-align:center;color:#484f58;font-size:0.75em;margin-top:40px;padding-top:16px;border-top:1px solid #21262d}
 
-        /* Logout */
         .logout-btn{background:none;border:1px solid #30363d;color:#8b949e;padding:6px 14px;border-radius:6px;font-size:0.8em;cursor:pointer;transition:all .2s}
         .logout-btn:hover{border-color:#f85149;color:#f85149}
     </style>
@@ -186,7 +173,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
         </div>
     </div>
 
-    <!-- Stats -->
     <div class="stats">
         <div class="stat">
             <div class="label">Banned IPs (Total)</div>
@@ -211,7 +197,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
         </div>` : ''}
     </div>
 
-    <!-- Legitimate Bots -->
     <div class="section-hdr">Legitimate Bot Activity</div>
     ${Object.keys(botVisits).length === 0 ? `
         <div class="empty">
@@ -238,7 +223,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
         </div>
     `).join('')}
 
-    <!-- AI Analysis -->
     <div class="section-hdr">AI Threat Analysis</div>
     ${aiReports.length === 0 ? `
         <div class="empty">
@@ -255,7 +239,6 @@ function createDashboard(config, storage, botTracker, detector, events) {
         </div>
     `).join('')}
 
-    <!-- Banned IPs -->
     <div class="section-hdr">Banned IP Addresses</div>
     ${bannedIPs.length === 0 ? `
         <div class="empty"><p>No banned IPs yet.</p></div>

package/middleware/index.js

@@ -1,24 +1,9 @@
-// honeyweb-core/middleware/index.js
-// Middleware factory - orchestrates all middleware components
-
 const createBlocklistChecker = require('./blocklist-checker');
 const createRequestAnalyzer = require('./request-analyzer');
 const createTrapInjector = require('./trap-injector');
 const createDashboard = require('./dashboard');
 
-/**
- * Create HoneyWeb middleware stack
- * @param {Object} config - Configuration
- * @param {Object} storage - Storage instance
- * @param {Object} botTracker - Bot tracker instance
- * @param {Object} detector - Detection engine
- * @param {Object} aiAnalyzer - AI analyzer
- * @param {Object} logger - Logger instance
- * @param {Object} events - Event emitter
- * @returns {Function} - Express middleware function
- */
 function createMiddleware(config, storage, botTracker, detector, aiAnalyzer, logger, events) {
-    // Create individual middleware components
     const blocklistChecker = createBlocklistChecker(storage, logger, events);
     const requestAnalyzer = createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer, logger, events);
     const trapInjector = createTrapInjector(config);
@@ -27,56 +12,35 @@ function createMiddleware(config, storage, botTracker, detector, aiAnalyzer, log
         ? createDashboard(config, storage, botTracker, detector, events)
         : null;
 
-    // Return combined middleware function
     return async function honeyWebMiddleware(req, res, next) {
         try {
-            // 1. Dashboard (if enabled and path matches)
+            // Dashboard route
             if (dashboard && req.path === config.dashboard.path) {
                 return dashboard(req, res, next);
             }
 
-            // 2. If this is a trap path, ALWAYS run the analyzer first
-            //    so trap triggers are logged + AI-analyzed even for banned IPs
+            // Trap paths: always analyze first
             if (trapPaths.includes(req.path)) {
                 await new Promise((resolve, reject) => {
-                    requestAnalyzer(req, res, (err) => {
-                        if (err) reject(err);
-                        else resolve();
-                    });
+                    requestAnalyzer(req, res, (err) => err ? reject(err) : resolve());
                 });
-                // Analyzer already sent 403 for traps
                 if (res.headersSent) return;
             }
 
-            // 3. Check blocklist (non-trap requests)
+            // Blocklist check
             await new Promise((resolve, reject) => {
-                blocklistChecker(req, res, (err) => {
-                    if (err) reject(err);
-                    else resolve();
-                });
+                blocklistChecker(req, res, (err) => err ? reject(err) : resolve());
             });
+            if (res.headersSent) return;
 
-            // If response was sent (blocked), stop here
-            if (res.headersSent) {
-                return;
-            }
-
-            // 4. Analyze request (patterns, rate limiting, behavioral)
+            // Full request analysis
             await new Promise((resolve, reject) => {
-                requestAnalyzer(req, res, (err) => {
-                    if (err) reject(err);
-                    else resolve();
-                });
+                requestAnalyzer(req, res, (err) => err ? reject(err) : resolve());
             });
+            if (res.headersSent) return;
 
-            // If response was sent (blocked), stop here
-            if (res.headersSent) {
-                return;
-            }
-
-            // 5. Inject traps into HTML responses
+            // Inject traps into HTML responses
             trapInjector(req, res, next);
-
         } catch (err) {
             logger.error('Middleware error', { error: err.message });
             next(err);

package/middleware/request-analyzer.js

@@ -1,29 +1,12 @@
-// honeyweb-core/middleware/request-analyzer.js
-// Request analysis middleware
-
-/**
- * Create request analyzer middleware
- * @param {Object} config - Configuration
- * @param {Object} storage - Storage instance
- * @param {Object} botTracker - Bot tracker instance
- * @param {Object} detector - Detection engine
- * @param {Object} aiAnalyzer - AI analyzer
- * @param {Object} logger - Logger instance
- * @param {Object} events - Event emitter
- * @returns {Function} - Middleware function
- */
 function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer, logger, events) {
     const trapPaths = config.traps.paths;
 
     return async function analyzeRequest(req, res, next) {
         const clientIP = req.ip || req.connection.remoteAddress;
-
-        // 1. THREAT DETECTION (whitelist check happens FIRST to protect legit bots)
         const analysis = await detector.analyze(req, clientIP);
 
-        // Skip ALL checks if legitimate bot (even trap paths!)
+        // Legitimate bots skip all checks
         if (analysis.legitimateBot) {
-            // Record legitimate bot visit for dashboard
             botTracker.recordVisit({
                 botName: analysis.whitelist.botName,
                 ip: clientIP,
@@ -32,22 +15,18 @@ function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer
                 verified: analysis.whitelist.verified,
                 timestamp: Date.now()
             });
-
             logger.info('Legitimate bot detected', {
-                ip: clientIP,
-                botName: analysis.whitelist.botName,
-                verified: analysis.whitelist.verified,
-                path: req.path
+                ip: clientIP, botName: analysis.whitelist.botName,
+                verified: analysis.whitelist.verified, path: req.path
             });
             return next();
         }
 
-        // 2. CHECK IF TRAP ACCESSED (only after confirming not a legit bot)
+        // Trap access — immediate ban
         if (trapPaths.includes(req.path)) {
             logger.trapTriggered(clientIP, req.path);
             events.emitTrapTriggered(clientIP, req.path);
 
-            // Ban the IP immediately
             try {
                 await storage.ban(clientIP, `Trap triggered: ${req.path}`);
                 events.emitIpBanned(clientIP, `Trap triggered: ${req.path}`);
@@ -55,71 +34,47 @@ function createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer
                 logger.error('Error banning IP', { error: err.message });
             }
 
-            // AI analysis for trap trigger
             if (aiAnalyzer.isEnabled()) {
                 aiAnalyzer.analyzeTrap({
-                    ip: clientIP,
-                    path: req.path,
-                    userAgent: req.headers['user-agent'],
-                    timestamp: Date.now()
+                    ip: clientIP, path: req.path,
+                    userAgent: req.headers['user-agent'], timestamp: Date.now()
                 }).then(report => {
                     if (report) {
                         logger.info('AI Trap Analysis', { ip: clientIP, report });
                         events.emitAiAnalysis(clientIP, report);
-                    } else {
-                        logger.warn('AI returned empty report for trap', { ip: clientIP, path: req.path });
                     }
-                }).catch(err => {
-                    logger.error('AI trap analysis failed', { error: err.message });
-                });
-            } else {
-                logger.info('AI is disabled, skipping trap analysis');
+                }).catch(err => logger.error('AI trap analysis failed', { error: err.message }));
             }
 
-            return res.status(403).send(
-                '<h1>403 Forbidden</h1><p>You have accessed a restricted area.</p>'
-            );
+            return res.status(403).send('<h1>403 Forbidden</h1><p>You have accessed a restricted area.</p>');
         }
 
-        // 3. OTHER THREAT DETECTION (patterns, rate limiting, behavioral)
-
-        if (analysis.detected) {
+        // Pattern/rate/behavioral/bot threats
+        if (analysis.detected && analysis.threatLevel >= 50) {
             logger.threatDetected(clientIP, analysis.threats, analysis.threatLevel);
             events.emitThreatDetected(clientIP, analysis.threats, analysis.threatLevel);
 
-            // Ban if threat level is high
-            if (analysis.threatLevel >= 50) {
-                try {
-                    await storage.ban(clientIP, `Threat detected: ${analysis.threats[0]}`);
-                    events.emitIpBanned(clientIP, `Threat detected: ${analysis.threats[0]}`);
-                } catch (err) {
-                    logger.error('Error banning IP', { error: err.message });
-                }
-
-                // AI analysis for threat
-                if (aiAnalyzer.isEnabled()) {
-                    aiAnalyzer.analyzeThreat({
-                        ip: clientIP,
-                        path: req.path,
-                        method: req.method,
-                        threats: analysis.threats,
-                        userAgent: req.headers['user-agent'],
-                        referer: req.headers['referer'],
-                        timestamp: Date.now()
-                    }).then(report => {
-                        if (report) {
-                            logger.info('AI Threat Analysis', { ip: clientIP, report });
-                            events.emitAiAnalysis(clientIP, report);
-                        }
-                    }).catch(err => {
-                        logger.error('AI analysis failed', { error: err.message });
-                    });
-                }
+            try {
+                await storage.ban(clientIP, `Threat detected: ${analysis.threats[0]}`);
+                events.emitIpBanned(clientIP, `Threat detected: ${analysis.threats[0]}`);
+            } catch (err) {
+                logger.error('Error banning IP', { error: err.message });
+            }
 
-                return res.status(403).send(
-                    '<h1>403 Forbidden</h1><p>Malicious activity detected.</p>'
-                );
+            if (aiAnalyzer.isEnabled()) {
+                aiAnalyzer.analyzeThreat({
+                    ip: clientIP, path: req.path, method: req.method,
+                    threats: analysis.threats, userAgent: req.headers['user-agent'],
+                    referer: req.headers['referer'], timestamp: Date.now()
+                }).then(report => {
+                    if (report) {
+                        logger.info('AI Threat Analysis', { ip: clientIP, report });
+                        events.emitAiAnalysis(clientIP, report);
+                    }
+                }).catch(err => logger.error('AI analysis failed', { error: err.message }));
             }
+
+            return res.status(403).send('<h1>403 Forbidden</h1><p>Malicious activity detected.</p>');
         }
 
         next();

package/middleware/trap-injector.js

@@ -1,50 +1,25 @@
-// honeyweb-core/middleware/trap-injector.js
-// Trap injection middleware (extracted from main index.js)
-
 const cheerio = require('cheerio');
 
-/**
- * Create trap injector middleware
- * @param {Object} config - Trap configuration
- * @returns {Function} - Middleware function
- */
 function createTrapInjector(config) {
     const trapPaths = config.traps.paths;
 
     return function injectTraps(req, res, next) {
-        // Only inject if trap injection is enabled
-        if (!config.traps.injection.enabled) {
-            return next();
-        }
+        if (!config.traps.injection.enabled) return next();
 
-        // Intercept res.send to inject traps
         const originalSend = res.send;
-
         res.send = function (body) {
-            // Only inject if the content is HTML
             if (typeof body === 'string' && (body.includes('<html') || body.includes('<body'))) {
                 try {
                     const $ = cheerio.load(body);
-
-                    // Pick a random trap
                     const trapUrl = trapPaths[Math.floor(Math.random() * trapPaths.length)];
-
-                    // Create invisible link (Hidden by CSS)
-                    const trapLink = `<a href="${trapUrl}" style="opacity:0; position:absolute; z-index:-999; left:-9999px;">Admin Panel</a>`;
-
-                    // Inject into body
-                    $('body').append(trapLink);
-
+                    $('body').append(`<a href="${trapUrl}" style="opacity:0;position:absolute;z-index:-999;left:-9999px;">Admin Panel</a>`);
                     body = $.html();
                 } catch (err) {
-                    // If cheerio fails, just send original body
-                    console.error('[TrapInjector] Failed to inject trap:', err.message);
+                    // If injection fails, send original body
                 }
             }
-
             originalSend.call(this, body);
         };
-
         next();
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeyweb-core",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Production-ready honeypot middleware with behavioral analysis, bot fingerprinting, and AI threat intelligence",
   "main": "index.js",
   "scripts": {

package/storage/bot-tracker.js

@@ -1,16 +1,11 @@
 // honeyweb-core/storage/bot-tracker.js
-// Track legitimate bot visits for dashboard display
 
 class BotTracker {
     constructor() {
-        this.botVisits = new Map(); // botName -> array of visits
-        this.maxVisitsPerBot = 50; // Keep last 50 visits per bot
+        this.botVisits = new Map();
+        this.maxVisitsPerBot = 50;
     }
 
-    /**
-     * Record a legitimate bot visit
-     * @param {Object} visit - Visit data
-     */
     recordVisit(visit) {
         const { botName, ip, path, userAgent, verified, timestamp } = visit;
 
@@ -19,49 +14,23 @@ class BotTracker {
         }
 
         const visits = this.botVisits.get(botName);
+        visits.unshift({ ip, path, userAgent, verified, timestamp: timestamp || Date.now() });
 
-        // Add new visit at the beginning (most recent first)
-        visits.unshift({
-            ip,
-            path,
-            userAgent,
-            verified,
-            timestamp: timestamp || Date.now()
-        });
-
-        // Keep only last N visits
-        if (visits.length > this.maxVisitsPerBot) {
-            visits.pop();
-        }
+        if (visits.length > this.maxVisitsPerBot) visits.pop();
     }
 
-    /**
-     * Get all bot visits grouped by bot name
-     * @returns {Object} - Bot visits grouped by name
-     */
     getAllVisits() {
         const result = {};
-
         for (const [botName, visits] of this.botVisits.entries()) {
             result[botName] = visits;
         }
-
         return result;
     }
 
-    /**
-     * Get visits for a specific bot
-     * @param {string} botName - Bot name
-     * @returns {Array} - Array of visits
-     */
     getVisitsByBot(botName) {
         return this.botVisits.get(botName) || [];
     }
 
-    /**
-     * Get statistics
-     * @returns {Object} - Statistics
-     */
     getStats() {
         let totalVisits = 0;
         const botCounts = {};
@@ -71,37 +40,21 @@ class BotTracker {
             botCounts[botName] = visits.length;
         }
 
-        return {
-            totalBots: this.botVisits.size,
-            totalVisits,
-            botCounts
-        };
+        return { totalBots: this.botVisits.size, totalVisits, botCounts };
     }
 
-    /**
-     * Clear all bot visits
-     */
     clear() {
         this.botVisits.clear();
     }
 
-    /**
-     * Cleanup old visits (older than 7 days)
-     */
     cleanup() {
-        const maxAge = 7 * 24 * 60 * 60 * 1000; // 7 days
+        const maxAge = 7 * 24 * 60 * 60 * 1000;
         const now = Date.now();
 
         for (const [botName, visits] of this.botVisits.entries()) {
-            const filtered = visits.filter(visit => {
-                return (now - visit.timestamp) < maxAge;
-            });
-
-            if (filtered.length === 0) {
-                this.botVisits.delete(botName);
-            } else {
-                this.botVisits.set(botName, filtered);
-            }
+            const filtered = visits.filter(v => (now - v.timestamp) < maxAge);
+            if (filtered.length === 0) this.botVisits.delete(botName);
+            else this.botVisits.set(botName, filtered);
         }
     }
 }

package/storage/index.js

@@ -1,24 +1,15 @@
 // honeyweb-core/storage/index.js
-// Storage factory
 
 const JsonStore = require('./json-store');
 const MemoryStore = require('./memory-store');
 
-/**
- * Create storage instance based on configuration
- * @param {Object} config - Storage configuration
- * @returns {JsonStore|MemoryStore}
- */
 function createStorage(config) {
     const type = config.type || 'json';
 
     switch (type) {
-        case 'json':
-            return new JsonStore(config);
-        case 'memory':
-            return new MemoryStore(config);
-        default:
-            throw new Error(`[HoneyWeb] Unknown storage type: ${type}`);
+        case 'json': return new JsonStore(config);
+        case 'memory': return new MemoryStore(config);
+        default: throw new Error(`[HoneyWeb] Unknown storage type: ${type}`);
     }
 }