6 Commits

Author SHA1 Message Date
5a823501f2 fix: disable self-observe by default, fix crash causes
- ENABLE_SELF_OBSERVE env var (default false) gates self-observe
- Fix UA condition: empty UA no longer triggers logging
- Add per-IP dedup (5min) to prevent 1M+ row storms
- Remove _cache=null from selfObserve (was busting cache on every hit)
- Add 90-day row pruning on startup + every 6h
- Add enrichCache TTL cleanup every 5min to prevent unbounded memory growth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-13 10:00:06 +02:00
379e993384 feat: store raw UA strings, add separate Top User Agents panel
- Add user_agent column to bots table (migration-safe)
- Store raw UA string (up to 300 chars) alongside ua_family on insert
- selfObserve stores raw UA from incoming request headers
- getStats() adds top_user_agents query (top 15 by count, last 30d)
- Dashboard: revert actions+reasons to 2-col, remove embedded UA col
- Dashboard: new separate panel below actions+reasons showing raw UA
  strings with hit counts in monospace, truncated with title tooltip

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 09:00:59 +02:00
85a524784c feat: add Top UA column to Actions + Reasons panel
Convert actions+reasons panel from 2-col to 3-col grid and add a
Top UA bars chart as the third column, reusing the existing top_ua
stats data. Also adds responsive collapse and i18n key for all 3 locales.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 08:54:16 +02:00
a4464214af feat: self-observe — record bots that visit the API directly
Add selfObserve middleware that detects bot/scanner User-Agents (or
requests with no UA) hitting any endpoint except /health and /submit,
and logs them to the bots table as site_id='self', action='observed'.

Dashboard shows these with a cyan [LOCAL] badge and colours 'observed'
action in cyan to distinguish them from WordPress-reported blocks.
Geo-enrichment runs async on self-observed entries too.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 08:37:52 +02:00
a3920cacd5 fix: use npm install instead of npm ci, change port to 3091
- npm ci requires a package-lock.json; use npm install --omit=dev instead
- Change all port references from 3001 to 3091 (3001 is occupied)
  - docker-compose.yml: ports, PORT env, healthcheck URL
  - Dockerfile: EXPOSE
  - .env.example: PORT default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 08:30:54 +02:00
932020d032 feat: initial Bot Intelligence API Docker stack
Self-hosted Node.js/Express + SQLite (WAL) API server and dashboard
for tracking blocked bots and user agents. Features:
- POST /api/v1/submit — batch ingest from WordPress plugin
- GET /api/v1/stats — aggregated stats with 30s cache
- GET /api/v1/stream — SSE live event feed
- GET /api/v1/health — health check endpoint
- Cyan/blue terminal-style dashboard with live feed, bar charts, 24h activity
- Docker Compose setup on port 3001 with persistent SQLite volume
- Bearer token auth with constant-time comparison

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-09 18:32:02 +02:00