kdbx-viewer/public/audit.js

'use strict';
// 审计日志独立页：登录后可访问，支持筛选/分页，数据来自服务端加密响应（会话通道解密）

const $ = (id) => document.getElementById(id);

// ===== 通道密钥（与主页共享会话）=====
let _SESSION_AES = null;
let _SESSION_AES_B64 = null;

function bufFromB64(b64) {
  const bin = atob(b64);
  const u = new Uint8Array(bin.length);
  for (let i = 0; i < bin.length; i++) u[i] = bin.charCodeAt(i);
  return u;
}

async function ensureChannel() {
  // 优先复用主页已协商并缓存的密钥（同会话，避免覆盖服务端密钥槽）
  try { _SESSION_AES_B64 = localStorage.getItem('sessAes'); } catch (e) {}
  if (_SESSION_AES_B64) {
    try {
      _SESSION_AES = await crypto.subtle.importKey('raw', bufFromB64(_SESSION_AES_B64), { name: 'AES-GCM' }, false, ['decrypt']);
      return;
    } catch (e) {}
  }
  // 否则自行协商：取传输公钥，生成 AES 密钥并 RSA 上传
  const r = await fetch('/api/pubkey').then((x) => x.json());
  const pubPem = r.pubkey;
  const b64 = pubPem.replace(/-----(BEGIN|END) PUBLIC KEY-----/g, '').replace(/\s+/g, '');
  const der = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
  const pubKey = await crypto.subtle.importKey('spki', der, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, ['encrypt']);
  const raw = crypto.getRandomValues(new Uint8Array(32));
  _SESSION_AES_B64 = btoa(String.fromCharCode(...raw));
  const enc = await crypto.subtle.encrypt({ name: 'RSA-OAEP' }, pubKey, new TextEncoder().encode(_SESSION_AES_B64));
  const encB64 = btoa(String.fromCharCode(...new Uint8Array(enc)));
  await fetch('/api/session/key', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ key: encB64 }) });
  _SESSION_AES = await crypto.subtle.importKey('raw', raw, { name: 'AES-GCM' }, false, ['decrypt']);
  try { localStorage.setItem('sessAes', _SESSION_AES_B64); } catch (e) {}
}

// AES-256-GCM 解密 {iv, ct, tag}
async function decryptPayload(p) {
  if (!p || typeof p !== 'object' || !p.ct) return p; // 明文兜底
  const iv = bufFromB64(p.iv);
  const tag = bufFromB64(p.tag);
  const ct = bufFromB64(p.ct);
  const key = await crypto.subtle.importKey('raw', bufFromB64(_SESSION_AES_B64), { name: 'AES-GCM' }, false, ['decrypt']);
  // Web Crypto 约定：密文在前、认证标签在后（iv 已通过算法参数单独传入）
  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv, tagLength: 128 }, key, concat(ct, tag));
  return JSON.parse(new TextDecoder().decode(plain));
}
function concat(...arrs) {
  let len = 0; for (const a of arrs) len += a.length;
  const out = new Uint8Array(len); let o = 0;
  for (const a of arrs) { out.set(a, o); o += a.length; }
  return out;
}

async function apiEnc(path) {
  const res = await fetch(path, { credentials: 'same-origin' });
  const p = await res.json();
  return decryptPayload(p);
}

// ===== 渲染 =====
let currentPage = 1;
const PAGE_SIZE = 50;

function fmtTime(iso) {
  const d = new Date(iso);
  if (isNaN(d)) return iso;
  return d.toLocaleString('zh-CN', { hour12: false });
}

function renderRow(e) {
  const tr = document.createElement('tr');
  if (!e.ok) tr.classList.add('row-fail');
  const ipTypeLabel = e.ipType === 'internal' ? '<span class="tag tag-internal">内网</span>'
    : e.ipType === 'external' ? '<span class="tag tag-external">外网</span>' : '-';
  tr.innerHTML = `
    <td>${fmtTime(e.t)}</td>
    <td class="mono">${esc(e.ip)}</td>
    <td>${ipTypeLabel}</td>
    <td class="mono" title="${esc(e.remote)}">${esc(e.remote)}</td>
    <td class="mono" title="${esc(e.xff)}">${esc(e.xff && e.xff !== '-' ? e.xff : '-')}</td>
    <td>${esc(e.method)}</td>
    <td class="mono">${esc(e.path)}</td>
    <td>${e.status || '-'}</td>
    <td class="code">${esc(e.code)}</td>
    <td class="ua" title="${esc(e.ua)}">${esc(e.ua)}</td>
    <td>${esc(e.detail || '')}</td>
    <td class="mono">${esc(e.sid)}</td>`;
  return tr;
}
function esc(s) {
  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
}

async function load() {
  const params = new URLSearchParams();
  params.set('page', String(currentPage));
  params.set('pageSize', String(PAGE_SIZE));
  const ip = $('fIp').value.trim(); if (ip) params.set('ip', ip);
  const ipType = $('fIpType').value; if (ipType) params.set('iptype', ipType);
  const code = $('fCode').value; if (code) params.set('code', code);
  const method = $('fMethod').value; if (method) params.set('method', method);
  const pathF = $('fPath').value.trim(); if (pathF) params.set('path', pathF);
  if ($('fFail').checked) params.set('fail', '1');
  const from = $('fFrom').value; if (from) params.set('from', new Date(from).toISOString());
  const to = $('fTo').value; if (to) params.set('to', new Date(to).toISOString());
  try {
    const data = await apiEnc('/api/audit?' + params.toString());
    const body = $('auditBody');
    body.innerHTML = '';
    (data.log || []).forEach((e) => body.appendChild(renderRow(e)));
    $('pageInfo').textContent = '第 ' + (data.page || 1) + ' 页（每页 ' + PAGE_SIZE + '）';
    $('totalInfo').textContent = ' 命中 ' + (data.total || 0) + ' 条';
    // 基于索引显示全量日志规模，便于核对分页正确性
    const idx = await apiEnc('/api/audit/index').catch(() => null);
    if (idx) {
      const files = (idx.files || []).map((f) => `${f.file}[${f.startSeq}-${f.endSeq},${f.count}条]`).join('  ');
      $('indexInfo').textContent = ` 索引总条数 ${idx.total} | 文件分布: ${files}`;
    }
  } catch (e) {
    alert('加载审计日志失败：' + (e && e.message ? e.message : e));
  }
}

async function loadBlocks() {
  try {
    const data = await apiEnc('/api/audit/blocks');
    const box = $('blocksBox');
    const list = $('blocksList');
    list.innerHTML = '';
    if (data.blocks && data.blocks.length) {
      box.style.display = '';
      data.blocks.forEach((b) => {
        const li = document.createElement('li');
        li.innerHTML = `<span class="mono">${esc(b.ip)}</span> 失败 ${b.fails} 次，封锁至 ${fmtTime(b.expiresAt)}
          <button class="btn-ghost unblock" data-ip="${esc(b.ip)}">解封</button>`;
        list.appendChild(li);
      });
      list.querySelectorAll('.unblock').forEach((btn) => {
        btn.onclick = async () => {
          await fetch('/api/audit/unblock', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ip: btn.dataset.ip }) });
          loadBlocks();
        };
      });
    } else { box.style.display = 'none'; }
  } catch (e) {}
}

// ===== 事件 =====
$('searchBtn').onclick = () => { currentPage = 1; load(); };
$('resetBtn').onclick = () => {
  $('fIp').value = ''; $('fCode').value = ''; $('fMethod').value = ''; $('fPath').value = '';
  $('fFail').checked = false; $('fFrom').value = ''; $('fTo').value = '';
  currentPage = 1; load();
};
$('prevPage').onclick = () => { if (currentPage > 1) { currentPage--; load(); } };
$('nextPage').onclick = () => { currentPage++; load(); };
$('logoutBtn').onclick = async () => {
  await fetch('/api/logout', { method: 'POST', credentials: 'same-origin' });
  location.href = '/';
};

// ===== 启动 =====
(async () => {
  // 鉴权检查
  try {
    const st = await fetch('/api/status', { credentials: 'same-origin' }).then((r) => r.json());
    if (!st.authed) { location.href = '/'; return; }
  } catch (e) { location.href = '/'; return; }
  await ensureChannel();
  await load();
  await loadBlocks();
})();