2 Commits
Author SHA1 Message Date
Hermes 46b6952c36 [glm-grade=A] fix(security): DC-120 surface caddy-source perimeter events in Log Insights dashboard — new GET /api/v1/security/events/perimeter endpoint with per-IP/per-vhost aggregations, event-store compileFilter/filterEvents primitives, and Perimeter section in Log Insights modal with XSS-safe rendering and stale-request guards
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
2026-08-23 17:26:07 -07:00
Krystie 7ebb1b1a01 feat: Log Insights panel — plain English activity summary + safe log disposal
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
- New route /api/v1/log-insights: analyzes audit logs + security events
  - Shows top IPs with request counts, failures, and top actions
  - Plain English insights (heavy users, auth failures, security alerts)
  - Summary stats: total requests, unique IPs, failed actions
  - Storage info showing log file sizes and entry counts
- New route POST /api/v1/log-insights/dispose: preview-then-confirm cleanup
  - First call shows what would be deleted (preview mode)
  - Second call with confirm:true actually deletes
  - Configurable retention period (default 30 days)
- Frontend panel with modal UI showing insights as cards
  - Period selector (1h, 6h, 24h, 7d)
  - Top visitors table with IP, requests, failures, actions, last seen
  - Storage info footer
  - Clean Old Logs button with preview confirmation dialog
- Wired into app.js and dashboard navbar (🔍 Insights button)
- Addresses QA issue: users need to see who is accessing before cleanup
2026-08-12 20:44:59 -07:00