security: fix auth vulnerabilities, add login audit trail

- handleRefresh: store auth_type/group_id server-side in users table instead of
  trusting client-controlled x-auth-type/x-group-id headers. Prevents privilege
  escalation via forged group membership.
- handleTestConnection: added admin auth check (was unauthenticated SSRF oracle).
- handleListUsers: restricted to admins only (was any authenticated user).
- handleUpdateGroup: only full admins may reassign group adminId.
- body size limits: readJsonBody 10MB, readRawBody 50MB. Oversized requests
  destroy the socket.
- login_audit table: tracks login, group_login, refresh, logout events with
  user_id, group_id, ip_address, timestamp. Replaces users.last_login.
- recordLoginAudit() helper + LoginAuditEvent enum in auth.ts.
- getClientIp() respects x-forwarded-for header.
- Tests: 2 new auth spec tests for LoginAuditEvent enum.

Signed-off-by: Mike Lischke <mike@lischke-online.de>

Author: mike-lischke

src/server/auth.ts

@@ -250,11 +250,15 @@ export const createRefreshToken = (): { raw: string; hash: string; maxAge: numbe
  * @returns The userId and new raw token if valid, or undefined.
  */
 export const verifyAndRotateRefreshToken = async (adapter: IDatabaseAdapter,
-    rawToken: string,): Promise<{ userId: number; newRawToken: string; } | undefined> => {
+    rawToken: string,): Promise<{
+        userId: number; newRawToken: string; authType?: string; groupId?: number;
+    } | undefined> => {
     const hash = crypto.createHash("sha256").update(rawToken).digest("hex");
 
-    const rows = await adapter.query<{ id: number; }>(
-        "SELECT id FROM users WHERE refresh_token_hash = ?",
+    const rows = await adapter.query<{
+        id: number; auth_type: string | null; group_id: number | null;
+    }>(
+        "SELECT id, auth_type, group_id FROM users WHERE refresh_token_hash = ?",
         [hash],
     );
 
@@ -264,13 +268,43 @@ export const verifyAndRotateRefreshToken = async (adapter: IDatabaseAdapter,
         return undefined;
     }
 
-    const userId = rows[0].id;
+    const { id: userId, auth_type: authType, group_id: groupId } = rows[0];
     const newRaw = crypto.randomBytes(32).toString("hex");
     const newHash = crypto.createHash("sha256").update(newRaw).digest("hex");
 
     await adapter.execute("UPDATE users SET refresh_token_hash = ? WHERE id = ?", [newHash, userId]);
 
-    return { userId, newRawToken: newRaw };
+    return {
+        userId,
+        newRawToken: newRaw,
+        authType: authType ?? undefined,
+        groupId: groupId ?? undefined,
+    };
+};
+
+export enum LoginAuditEvent {
+    Login = "login",
+    GroupLogin = "group_login",
+    Refresh = "refresh",
+    Logout = "logout",
+}
+
+/**
+ * Records a login audit event.
+ *
+ * @param adapter   The database adapter.
+ * @param userId    The user ID.
+ * @param event     The type of login event.
+ * @param groupId   The group ID (only for group_login events).
+ * @param ipAddress The client IP address (optional).
+ */
+export const recordLoginAudit = async (adapter: IDatabaseAdapter, userId: number, event: LoginAuditEvent,
+    groupId?: number, ipAddress?: string): Promise<void> => {
+    await adapter.execute(
+        `INSERT INTO login_audit (user_id, event, group_id, ip_address)
+         VALUES (?, ?, ?, ?)`,
+        [userId, event, groupId ?? null, ipAddress ?? null],
+    );
 };
 
 /**

src/server/backend-db.sql

@@ -56,14 +56,29 @@ CREATE TABLE users (
   username      VARCHAR(255) NOT NULL,
   password_hash     VARCHAR(512) NOT NULL,
   refresh_token_hash VARCHAR(256) NULL,
+  auth_type     VARCHAR(16)  NULL,
+  group_id      INT UNSIGNED NULL,
   display_name      VARCHAR(255) NOT NULL,
-  last_login   TIMESTAMP    NULL,
   created_at    TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
   updated_at    TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (id),
   UNIQUE KEY uk_users_username (username)
 ) ENGINE=InnoDB;
 
+CREATE TABLE login_audit (
+  id         INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  user_id    INT UNSIGNED NOT NULL,
+  event      ENUM('login', 'group_login', 'refresh', 'logout') NOT NULL,
+  group_id   INT UNSIGNED NULL,
+  ip_address VARCHAR(45) NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (id),
+  INDEX idx_audit_user_time (user_id, created_at),
+  CONSTRAINT fk_audit_user
+    FOREIGN KEY (user_id) REFERENCES users(id)
+    ON DELETE CASCADE
+) ENGINE=InnoDB;
+
 CREATE TABLE `groups` (
   id          INT UNSIGNED NOT NULL AUTO_INCREMENT,
   name        VARCHAR(255) NOT NULL,

src/server/backend.ts

@@ -16,7 +16,7 @@ import {
     adminGroupName, worldGroupName, getWorldGroupId,
     buildCapabilities, checkPermission, createAccessToken, createRefreshToken,
     getPermissionSummary, hashPassword,
-    hasUsers, isUserInAdminGroup, refreshTokenExpirySeconds,
+    hasUsers, isUserInAdminGroup, LoginAuditEvent, recordLoginAudit, refreshTokenExpirySeconds,
     setOwner, addEntityGroup, removeEntityGroup, getExplicitEntityGroups, getExplicitOwner,
     verifyAndRotateRefreshToken, verifyPassword, verifyToken,
     AccessLevel,
@@ -91,6 +91,18 @@ const createAdapter = (): IDatabaseAdapter => {
     }
 };
 
+// ---------- Network helpers ----------
+
+const getClientIp = (req: IncomingMessage): string | undefined => {
+    const forwarded = getHeader(req, "x-forwarded-for");
+
+    if (forwarded) {
+        return forwarded.split(",")[0].trim() || undefined;
+    }
+
+    return req.socket.remoteAddress ?? undefined;
+};
+
 // ---------- JSON helpers ----------
 
 const sendJson = (res: ServerResponse, data: unknown, status = 200): void => {
@@ -103,11 +115,22 @@ const sendError = (res: ServerResponse, message: string, status = 400): void =>
     sendJson(res, { error: message }, status);
 };
 
-const readJsonBody = (req: IncomingMessage): Promise<Record<string, unknown>> => {
+const readJsonBody = (req: IncomingMessage, maxSize = 10 * 1024 * 1024): Promise<Record<string, unknown>> => {
     return new Promise((resolve, reject) => {
         const chunks: Buffer[] = [];
+        let totalSize = 0;
 
         req.on("data", (chunk: Buffer) => {
+            totalSize += chunk.length;
+
+            if (totalSize > maxSize) {
+                req.destroy();
+
+                reject(new Error("Request body too large"));
+
+                return;
+            }
+
             chunks.push(chunk);
         });
         req.on("end", () => {
@@ -471,6 +494,14 @@ const seedIfExists = async (targetAdapter: IDatabaseAdapter): Promise<void> => {
 };
 
 const handleTestConnection = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    const user = getAuthUser(req);
+
+    if (!user || !(await isUserInAdminGroup(adapter, user.userId))) {
+        sendError(res, "Forbidden", 403);
+
+        return;
+    }
+
     const body = await readJsonBody(req);
 
     const testConfig: IDatabaseConfig = {
@@ -976,12 +1007,14 @@ const handleLogin = async (req: IncomingMessage, res: ServerResponse): Promise<v
     const accessToken = createAccessToken(payload);
     const refreshToken = createRefreshToken();
 
-    // Store the hash in the database for rotation.
+    // Store the hash in the database for rotation. Normal login: no group context.
     await adapter.execute(
-        "UPDATE users SET refresh_token_hash = ?, last_login = NOW() WHERE id = ?",
+        "UPDATE users SET refresh_token_hash = ?, auth_type = NULL, group_id = NULL WHERE id = ?",
         [refreshToken.hash, user.id],
     );
 
+    await recordLoginAudit(adapter, user.id, LoginAuditEvent.Login, undefined, getClientIp(req));
+
     setRefreshTokenCookie(res, refreshToken.raw, refreshToken.maxAge);
 
     const capabilities = await buildCapabilities(adapter, payload);
@@ -1056,10 +1089,12 @@ const handleGroupLogin = async (req: IncomingMessage, res: ServerResponse): Prom
     const refreshToken = createRefreshToken();
 
     await adapter.execute(
-        "UPDATE users SET refresh_token_hash = ?, last_login = NOW() WHERE id = ?",
-        [refreshToken.hash, anon.id],
+        "UPDATE users SET refresh_token_hash = ?, auth_type = 'group', group_id = ? WHERE id = ?",
+        [refreshToken.hash, group.id, anon.id],
     );
 
+    await recordLoginAudit(adapter, anon.id, LoginAuditEvent.GroupLogin, group.id, getClientIp(req));
+
     // Update group last_login.
     await adapter.execute(
         "UPDATE `groups` SET last_login = NOW() WHERE id = ?",
@@ -1120,28 +1155,11 @@ const handleRefresh = async (req: IncomingMessage, res: ServerResponse): Promise
     const user = rows[0];
     const admin = await isUserInAdminGroup(adapter, user.id);
 
-    // Preserve group-login info from the old access token, or from custom headers
-    // (sessionStorage backup for page reloads where the in-memory token is lost).
-    const authHeader = req.headers.authorization;
-    let authType: string | undefined;
-    let groupId: number | undefined;
-
-    if (authHeader?.startsWith("Bearer ")) {
-        const oldPayload = verifyToken(authHeader.slice(7));
-
-        if (oldPayload?.authType === "group") {
-            authType = oldPayload.authType;
-            groupId = oldPayload.groupId;
-        }
-    }
-
-    const headerAuthType = req.headers["x-auth-type"];
-    const headerGroupId = req.headers["x-group-id"];
-
-    if (!authType && headerAuthType === "group" && headerGroupId) {
-        authType = "group";
-        groupId = Number(headerGroupId);
-    }
+    // Restore group-login context from the database (set during handleLogin/handleGroupLogin).
+    // Never trust client-provided headers — they were only needed as a backup before this data
+    // was persisted server-side. The sessionStorage fallback on the frontend can now be removed.
+    const authType = result.authType;
+    const groupId = result.groupId;
 
     const accessToken = createAccessToken({
         userId: user.id,
@@ -1153,10 +1171,18 @@ const handleRefresh = async (req: IncomingMessage, res: ServerResponse): Promise
 
     setRefreshTokenCookie(res, result.newRawToken, refreshTokenExpirySeconds);
 
+    await recordLoginAudit(adapter, user.id, LoginAuditEvent.Refresh, groupId, getClientIp(req));
+
     sendJson(res, { token: accessToken });
 };
 
-const handleLogout = (req: IncomingMessage, res: ServerResponse): void => {
+const handleLogout = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    const user = getAuthUser(req);
+
+    if (user) {
+        await recordLoginAudit(adapter, user.userId, LoginAuditEvent.Logout, undefined, getClientIp(req));
+    }
+
     clearRefreshTokenCookie(res);
     sendJson(res, { success: true });
 };
@@ -1387,15 +1413,16 @@ const handleCreateInitialAdmin = async (req: IncomingMessage, res: ServerRespons
 const handleListUsers = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     const user = getAuthUser(req);
 
-    if (!user) {
+    if (!user || !(await isUserInAdminGroup(adapter, user.userId))) {
         sendError(res, "Forbidden", 403);
 
         return;
     }
 
     const rows = await adapter.query(
-        `SELECT u.id, u.username, u.display_name, u.last_login, u.created_at, u.updated_at,
-                (ug.user_id IS NOT NULL) AS is_admin
+        `SELECT u.id, u.username, u.display_name, u.created_at, u.updated_at,
+                (ug.user_id IS NOT NULL) AS is_admin,
+                (SELECT MAX(la.created_at) FROM login_audit la WHERE la.user_id = u.id) AS last_login
          FROM users u
          LEFT JOIN user_groups ug ON u.id = ug.user_id
              AND ug.group_id = (SELECT id FROM \`groups\` WHERE name = ?)
@@ -1727,6 +1754,15 @@ const handleUpdateGroup = async (req: IncomingMessage, res: ServerResponse): Pro
         : undefined;
     const adminId = body.adminId !== undefined ? (Number(body.adminId) || null) : undefined;
 
+    // Only full admins can reassign group ownership.
+    if (adminId !== undefined) {
+        if (!await isUserInAdminGroup(adapter, user.userId)) {
+            sendError(res, "Only admins can change the group owner.", 403);
+
+            return;
+        }
+    }
+
     if (!name && description === undefined && color === undefined
         && password === undefined && adminId === undefined) {
         sendError(res, "No fields to update");
@@ -2295,14 +2331,27 @@ interface IMultipartPart {
 /**
  * Reads the full raw request body.
  *
- * @param req The incoming HTTP request.
+ * @param req     The incoming HTTP request.
+ * @param maxSize Maximum allowed body size in bytes (default 50 MB).
+ *
  * @returns The full body as a Buffer.
  */
-const readRawBody = (req: IncomingMessage): Promise<Buffer> => {
+const readRawBody = (req: IncomingMessage, maxSize = 50 * 1024 * 1024): Promise<Buffer> => {
     return new Promise((resolve, reject) => {
         const chunks: Buffer[] = [];
+        let totalSize = 0;
 
         req.on("data", (chunk: Buffer) => {
+            totalSize += chunk.length;
+
+            if (totalSize > maxSize) {
+                req.destroy();
+
+                reject(new Error("Request body too large"));
+
+                return;
+            }
+
             chunks.push(chunk);
         });
         req.on("end", () => {
@@ -2529,7 +2578,7 @@ const handleRequest = async (req: IncomingMessage, res: ServerResponse): Promise
                     break;
 
                 case "logout":
-                    handleLogout(req, res);
+                    await handleLogout(req, res);
 
                     break;
 

tests/server/auth.spec.ts

@@ -6,7 +6,7 @@
 import { describe, expect, it } from "vitest";
 
 import { createAccessToken, createRefreshToken, verifyToken } from "../../src/server/auth.js";
-import { AccessLevel, adminGroupName, worldGroupName, EntityType } from "../../src/server/auth.js";
+import { AccessLevel, adminGroupName, worldGroupName, EntityType, LoginAuditEvent } from "../../src/server/auth.js";
 
 describe("auth — JWT", () => {
     it("round-trip: access token", () => {
@@ -65,3 +65,18 @@ describe("auth — Constants", () => {
         expect(EntityType.Feature).toBe("feature");
     });
 });
+
+describe("auth — LoginAuditEvent", () => {
+    it("has four event types with correct string values", () => {
+        expect(LoginAuditEvent.Login).toBe("login");
+        expect(LoginAuditEvent.GroupLogin).toBe("group_login");
+        expect(LoginAuditEvent.Refresh).toBe("refresh");
+        expect(LoginAuditEvent.Logout).toBe("logout");
+    });
+
+    it("all enum values are unique", () => {
+        const values = Object.values(LoginAuditEvent);
+
+        expect(new Set(values).size).toBe(values.length);
+    });
+});