[glm-grade=A] fix(security): DC-120 surface caddy-source perimeter events in Log Insights dashboard — new GET /api/v1/security/events/perimeter endpoint with per-IP/per-vhost aggregations, event-store compileFilter/filterEvents primitives, and Perimeter section in Log Insights modal with XSS-safe rendering and stale-request guards

dashcaddy-api/routes/security.js

@@ -8,6 +8,8 @@
  *                                       target; pagination via limit/offset)
  *   GET    /events/stats              — Aggregations (top actors, top targets,
  *                                       counts by source/severity/host)
+ *   GET    /events/perimeter          — Caddy-source perimeter aggregation
+ *                                       (per-IP + per-vhost breakdowns)
  *   GET    /events/:id                — Single event by id
  *   GET    /events/stream             — Server-Sent Events live tail (auth required)
  *
@@ -73,6 +75,103 @@ module.exports = function({ log }) {
     ok(res, stats);
   });
 
+  // GET /events/perimeter — DC-120: caddy-source perimeter aggregation
+  // (per-IP + per-vhost breakdowns) for the Log Insights panel.
+  //
+  // Replaces the frontend doing N paged /events calls and re-deriving
+  // counts client-side (which capped at 1000 and lost per-key maps).
+  // Reads the SAME store the /events endpoints read; aggregation runs
+  // over the in-memory window only (bounded by maxMemory, default 10k).
+  //
+  // Query params:
+  //   hours : window in hours, default 24, falls back to 24 for invalid values.
+  //           The endpoint scans only the bounded in-memory window
+  //           (maxMemory, default 10k events), so accepting 720 hours does
+  //           not guarantee 30 days of retained data — it only controls the
+  //           timestamp filter applied to whatever events are currently in memory.
+  //   limit : top-N IPs returned, default 15, max 50
+  //
+  // Ordering: strict count desc; ties broken by IP string so output is
+  // deterministic across restarts.
+  router.get('/events/perimeter', (req, res) => {
+    // --- validate + default window ---
+    // hours/limit values outside bounds fall back to defaults (24h / 15) —
+    // NOT clamped to the nearest boundary. This is intentional: silently
+    // coercing a typo like hours=9999 to 720 hides the operator's mistake,
+    // whereas a default fallback makes the effective window visible in the
+    // response (window.hours === 24 when garbage was sent).
+    // Strict integer parsing: reject anything that isn't a clean integer
+    // (parseInt accepts "1junk" → 1, "1.5" → 1; both now rejected).
+    const rawHours = String(req.query.hours || '').trim();
+    const rawLimit = String(req.query.limit || '').trim();
+    const hoursMatch = rawHours.match(/^[0-9]+$/);
+    const limitMatch = rawLimit.match(/^[0-9]+$/);
+    const hours = hoursMatch ? parseInt(rawHours, 10) : 24;
+    const limit = limitMatch ? parseInt(rawLimit, 10) : 15;
+    const defaultHours = (hours >= 1 && hours <= 720) ? hours : 24;
+    const defaultLimit = (limit >= 1 && limit <= 50) ? limit : 15;
+    const since = new Date(Date.now() - defaultHours * 3600000).toISOString();
+
+    // --- collect caddy events in window (bounded by maxMemory) ---
+    // filterEvents() scans the in-memory window once. Aggregation then
+    // traverses the selected subset (two Map reductions + summary counts).
+    const events = store.filterEvents({ source_type: 'caddy', since });
+
+    // --- per-IP aggregation ---
+    const ipMap = new Map();
+    for (const ev of events) {
+      const ip = ev.actor || 'unknown';
+      let s = ipMap.get(ip);
+      if (!s) {
+        s = { count: 0, denied: 0, error: 0, hosts: new Set() };
+        ipMap.set(ip, s);
+      }
+      s.count++;
+      if (ev.outcome === 'denied' || ev.outcome === 'rate-limited') s.denied++;
+      if (ev.outcome === 'error') s.error++;
+      const host = ev.metadata && ev.metadata.host;
+      if (host) s.hosts.add(host);
+    }
+
+    const ips = [...ipMap.entries()]
+      .map(([ip, s]) => ({
+        ip,
+        count: s.count,
+        denied: s.denied,
+        error: s.error,
+        hosts: [...s.hosts].sort(),
+      }))
+      .sort((a, b) => b.count - a.count || (a.ip < b.ip ? -1 : a.ip > b.ip ? 1 : 0))
+      .slice(0, defaultLimit);
+
+    // --- per-host (vhost) aggregation ---
+    const hostMap = new Map();
+    for (const ev of events) {
+      const host = (ev.metadata && ev.metadata.host) || 'unknown';
+      const h = hostMap.get(host) || { count: 0, denied: 0, error: 0 };
+      h.count++;
+      if (ev.outcome === 'denied' || ev.outcome === 'rate-limited') h.denied++;
+      if (ev.outcome === 'error') h.error++;
+      hostMap.set(host, h);
+    }
+    const byHost = [...hostMap.entries()]
+      .map(([host, h]) => ({ host, ...h }))
+      .sort((a, b) => b.count - a.count || (a.host < b.host ? -1 : a.host > b.host ? 1 : 0))
+      .slice(0, 20);
+
+    ok(res, {
+      window: { hours: defaultHours, since, until: new Date().toISOString() },
+      summary: {
+        events: events.length,
+        uniqueIPs: ipMap.size,
+        denied: events.reduce((n, ev) => n + (ev.outcome === 'denied' || ev.outcome === 'rate-limited' ? 1 : 0), 0),
+        error: events.reduce((n, ev) => n + (ev.outcome === 'error' ? 1 : 0), 0),
+      },
+      topIPs: ips,
+      byHost,
+    });
+  });
+
   // GET /events/stream — SSE live tail (must come BEFORE /events/:id!)
   router.get('/events/stream', (req, res) => {
     res.writeHead(200, {