From a5a43e37ac01533ce874e9d8f5d7d371ca49d95e Mon Sep 17 00:00:00 2001 From: johnnyq Date: Mon, 19 Oct 2026 00:56:52 -0400 Subject: [PATCH] Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing --- CHANGELOG.md | 23 +- admin/api_keys.php | 26 ++- admin/audit_logs.php | 3 +- admin/database_updates/3.3.2.php | 39 ++++ admin/includes/side_nav.php | 6 + admin/modals/api/api_key_usage.php | 117 ++++++++++ admin/modals/audit_log/audit_log.php | 4 +- admin/post/api_keys.php | 2 + admin/post/settings_security.php | 8 +- admin/settings_security.php | 17 +- admin/sign_ins.php | 324 +++++++++++++++++++++++++++ admin/software_template.php | 2 +- agent/audit_log.php | 3 +- agent/user/user_activity.php | 3 +- api/v1/validate_api_key.php | 15 +- client/login_microsoft.php | 4 + cron/nightly_tasks.php | 4 +- db.sql | 38 ++-- functions.php | 1 + functions/api_keys.php | 135 +++++++++++ functions/audit_log.php | 23 +- functions/email_preview.php | 6 + functions/sign_in.php | 233 +++++++++++++++++++ functions/user.php | 18 +- login.php | 40 ++-- 25 files changed, 1022 insertions(+), 72 deletions(-) create mode 100644 admin/database_updates/3.3.2.php create mode 100644 admin/modals/api/api_key_usage.php create mode 100644 admin/sign_ins.php create mode 100644 functions/sign_in.php diff --git a/CHANGELOG.md b/CHANGELOG.md index 38b3aea8f..f8d3a6215 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,9 +6,9 @@ This file documents all notable changes made to ITFlow. ### Upgrading to 26.11 -Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 3.3.1) in the same pass. Nothing else is required. +Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 3.3.2) in the same pass. Nothing else is required. -This is a big release, with fifty-two database steps in one go, so take a backup before you update. +This is a big release, with fifty-three database steps in one go, so take a backup before you update. The update also clears out data that deletes in older versions left behind, all of it pointing at something that no longer exists: @@ -211,6 +211,12 @@ If you are coming from 26.08 or earlier, the database update still has to be run - New endpoint to read services, under the Support permission. Vendors take the account manager's phone and email. - A call the key's role doesn't allow is refused with what it needs and what the key's user has - "This needs Modify on Support - the key's user, Tess Tech (Technician), has Read." - in place of "The user linked to this API key does not have permission for this action." It is still a 403. Anything that matches on the old text needs changing. - Audit log for agents: each client now has an Audit Log, and record pages show their history, to anyone who can open them - not only admins. An agent sees the kinds of entry their role covers - a technician without Financial sees no expenses or trips, someone without Credentials no passwords looked at - and never sign-ins, users, settings or another agent turned away from a client, which stay in Admin > Audit Logs. The client overview's Recent activity follows the same rule, so it can show a restricted role less than before. +- Sign-ins: + - A failed sign in is now logged against the account it was to - a wrong password, or an account that is disabled, archived or not set up yet - where it used to name no one. So it shows in that person's Your account > Activity and in the sign-ins Admin > Users shows for them, even when someone else was guessing at it. + - A client portal contact's wrong two-step code now counts toward turning an IP address away (15 failed sign-ins in 10 minutes), as an agent's always did. + - Admins are now told about a run of failed sign-ins - 10 in 10 minutes from one IP address or against one account - with a notification and an email each. Change or turn it off in Admin > Settings > Security. + - A call to the API with a key that has expired now says which key, and is logged against it. Anything that reads the `logs` table for "Incorrect or expired key" needs the new wording. + - The `auth_logs` table is removed. Nothing was ever written to it. - Audit log: each thing done now has one name, in the entries already there as well as new ones. Unarchive and Restored are Restore, Deleted is Delete, and Closed, Resolved, Reopened, Merged and Sent are Close, Resolve, Reopen, Merge and Send. An agent turned away from a client they can't open is Denied, where it was Access. A saved card or payment provider deleted is Delete and a card saved is Create, where both were Update, and a contract template changed is Edit. A report or script that reads the `logs` table by the old names needs the new ones. ### New Features & Updates @@ -943,6 +949,11 @@ If you are coming from 26.08 or earlier, the database update still has to be run - The client overview's Recent activity links to the client's Audit Log, for everyone rather than admins only. - Your account > Activity is rebuilt on the same list: everything you did, searched and filtered by date, a page at a time, with views for Changes, Deletions, Sign-ins and Data out, each entry with its client, its record and where you did it from. Sign-ins says what to do about one that wasn't you. - A document's earlier versions are now in a card called Versions, with its history under it. + - A failed sign in says why - a wrong password, no account with that email, an account that is disabled, archived or hasn't set a password yet, a contact whose client is archived, the client portal turned off, or a wrong MFA or two-step code after the right password - and is on the account it was to, marked Their account, as it may not have been them. A sign in through Microsoft 365 that fails is logged too. + - The first time an account signs in from an IP address, the sign in is marked New IP - in Admin > Audit Logs, the client's Audit Log, Your account > Activity and the quick look. + - Admin > Sign-ins, under Access: People - each agent and portal contact with their last sign in, its IP address and device, how many sign-ins and failed ones (the wrong MFA codes among them), how many IP addresses and, for a date range, how many of them were new - and IP addresses - each address with its sign-ins and failures, the accounts it tried and any emails with no account, when it was first and last seen, and whether it is being turned away now. Searched by name, email or address, for a date range, sorted from the column headings, a page at a time; each opens its sign-ins in the audit log. + - Failed sign-in alerts: after a number of failed sign-ins in 10 minutes from one IP address or against one account - 10 to start with, or 5, 20, 50 or never, in Admin > Settings > Security - each admin gets a notification and an email saying who was tried and from where, with a link to look. A run is told about once. The same goes for API calls turned away from one address. Each alert is in the audit log's Security view. + - Admin > API Keys counts each key's calls over the last 30 days and shows where the last one came from. Usage, on a key's menu or its count, shows its calls today, this week and this month, each day's as a bar, the endpoints it called and how often, the IP addresses the calls came from, and the calls turned away after it expired. Use is kept as long as the audit log. - **Emails** (rebuilt) - Ticket emails to clients now look like the billing emails: your logo or name, a coloured heading saying what it is, the ticket's number, subject, status and priority in a box, the reply or the details quoted as they were written with who wrote them, a button to open the ticket, and your details at the foot. This covers a ticket opened by an agent, on a schedule or from an email, a reply, resolved, closed, being made a watcher, replying to a closed ticket, a reply through the API and a task needing their approval. - Each says under it why they get it - the contact on the ticket, watching it, or asking for every update on their company's tickets - in place of the YOU ARE A COLLABORATOR block. @@ -964,7 +975,7 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Shared links: the email with a link and the one with a code to open it are in the same look, with your note quoted and the whole link printed under the button, as a link only works when it is copied whole. Subjects are the same. - Calendar invitations, updates and cancellations say when, how often it repeats, where, the description and a Join button for a meeting link, with the calendar file as before. - Email on the contacts and clients lists: what you write goes out with your logo above it, your details below and a line saying why they got it. Pick the mailbox it comes from and the name it shows, start it "Hello" and their name if you like, and send it now or later. What you write is made safe and its images point at your ITFlow, as in ticket emails. -- **Admin > Mail > Previews**: every email ITFlow sends, 52 of them, as it goes out - your logo, your details and the address it comes from. Each is made when you open it, by the same code that sends it, on sample records (a client, its contacts and an agent) that are thrown away again, so looking sends and saves nothing. It says who gets it and what sends it, shows it at computer or phone width, and Send me a copy emails it to you, marked [Preview]. +- **Admin > Mail > Previews**: every email ITFlow sends, 53 of them, as it goes out - your logo, your details and the address it comes from. Each is made when you open it, by the same code that sends it, on sample records (a client, its contacts and an agent) that are thrown away again, so looking sends and saves nothing. It says who gets it and what sends it, shows it at computer or phone width, and Send me a copy emails it to you, marked [Preview]. ### Bug Fixes @@ -1598,6 +1609,12 @@ If you are coming from 26.08 or earlier, the database update still has to be run - New `agent/audit_log.php` (`client_id` - without it, admins go to Admin > Audit Logs and agents to the clients - `q`, `user`, `type`, `action`, `entity`, `view` - `changes`, `deletions`, `signins` or `data` - the date filter, `sort` - `log_created_at`, `user_name`, `log_type`, `log_action`, `log_ip` or `log_id` - `order` and `page`), scoped to the client and `auditLogRoleSql()`, in `client_side_nav.php` after Calendar. `clientOverviewActivity()` applies `auditLogRoleSql()`. - `agent/user/user_activity.php` is rebuilt (`q`, `view`, the date filter, `sort` - `log_created_at`, `log_type`, `log_action`, `client_name`, `log_ip` or `log_id` - `order` and `page`), on the agent's own entries. - The admin quick look's links to itself are absolute, so it opens from agent pages too. + - Database 3.3.2: `auth_logs` is dropped (never written; nightly only emptied it); `settings.config_login_alert_failures` (int, 10; 0 never) - read with `signInAlertLimit()` rather than with every page's settings, so pages open before the update adds it; new `api_key_usage` (`api_key_usage_key_id`, `api_key_usage_date`, `api_key_usage_endpoint`, `api_key_usage_calls`, `api_key_usage_last_at`, `api_key_usage_last_ip`; primary key the first three). Nightly deletes `api_key_usage` older than `config_log_retention` in place of `auth_logs`. + - New `functions/sign_in.php`: `SIGN_IN_WINDOW_MINUTES` (10), `SIGN_IN_LOCKOUT` (15), `SIGN_IN_TYPES` (Login, Client Login), `SIGN_IN_FAILED` (Failed, MFA Failed); `signInAlertOptions()`, `signInAlertLimit()`, `signInFailureReason($email)` (`user_id`, `client_id`, `name`, `type`, `reason`; an agent's account before a portal one), `signInLog()` (as the account, without signing in), `signInLogFailure()`, `signInWatch($user_id)` (on reaching the limit from the IP address or against the account), `signInAccountsTried()`, `signInAdmins()`, `signInAlertAdmins($title, $text, $summary, $url)` (a Failed Sign-ins notification and an email to each active admin, and Login Alert in the log), `signInMailAlert()` (in Mail > Previews as `admin_sign_in_alert`), `signInNewIpIds($rows)` and `signInNewIpBadge()`. + - `login.php`: the IP lockout counts both sign-in types' failures, with the constants; a password that matches no account is logged with `signInFailureReason()`, as Login or Client Login on that account; an agent's wrong MFA code, a contact's wrong two-step code, the portal turned off and a contact's account that can't sign in with a password go through `signInLogFailure()`. `client/login_microsoft.php` logs a failed Entra sign in. Blocked reads "Sign in turned away from IP - 15 failed sign-ins in 10 minutes". `userLoginLineHtml()` shows why a sign in failed, and `userRecentLogins()` includes the failures against the account. + - `auditLogWho()` marks a failed sign in Their account; Security also takes Login Alert and API Failed; Alert is a danger action. Admin > Audit Logs, the client's Audit Log, Your account > Activity and the quick look badge `signInNewIpIds()`. + - New `admin/sign_ins.php` (`view` - '' People or `ips` - `q`, the date filter, `sort` - People `user_name`, `sign_ins`, `failures`, `ips` or `last_seen`, IP addresses `log_ip`, `sign_ins`, `failures`, `accounts`, `first_seen` or `last_seen` - `order`, `page`), in the admin nav under Access. Settings > Security takes `config_login_alert_failures` (one of `signInAlertOptions()`, else 10). + - API keys, in `functions/api_keys.php`: `apiKeyUsageEndpoint($uri)`, `apiKeyUsageRecord($id, $endpoint, $ip)` (an upsert per call; nothing before the update), `apiKeyUsageSummary($ids, $days)` (`calls`, `endpoints`, `last_at`, `last_ip`), `apiKeyUsageDaily()`, `apiKeyUsageEndpoints()`, `apiKeyUsageIps()`, `apiKeyTurnedAway()` and `apiKeyWatch()`. `api/v1/validate_api_key.php` records each call, and logs a call turned away as "Expired API key NAME used - it ended DATE" with `log_entity_id` the key, or "Unknown API key used". New `admin/modals/api/api_key_usage.php` (`id`); deleting a key deletes its use. - Empty states: every list page sets `$empty_state` before including `includes/filter_footer.php`, and `includes/inc_empty_state.php` draws it with `emptyStateHtml()` (`functions/format.php`) when the list has nothing - `thing`, `icon`, `title`, `text`, `actions` (`label`, `modal` or `href`, `size`, `icon`; the first is the main one), `archived`, `view`, `filtered`, `views`, `match_title`, `match_text` and `clear_url`. `emptyStateFiltered($views)` reads the GET string for a search or filter, leaving out paging, sorting, `client_id`, `archived` and the page's views, and `emptyStateClearUrl($views)` is the page without them. `emptyStatePill($pills, $key, $default, $good)` builds a pill's own state from the page's pill array (`label`, `icon`, `title`, `alarm`), with a tick for `alarm` pills and the keys in `$good`. Files, notifications and racks call `emptyStateHtml()` in their own layout; files and notifications set `$empty_state_skip`. A page that sets nothing still gets one, worded from `$page_title`. The pages' own empty blocks (`.itflow-asset-empty` under a list) are gone. CSS: `.itflow-empty-state` with `-icon` (a grey round tile), `-title`, `-text` and `-actions`. - Removed unused helpers and files: - `credentialLink()`, `projectLink()`, `linkCounts()`, `assetContactAvatar()`, `clientOverviewPersonInitials()`, and `getMonthlyTax()` and `getQuarterlyTax()`, which looked a tax up by name diff --git a/admin/api_keys.php b/admin/api_keys.php index 7ca0f48bb..88431ec33 100644 --- a/admin/api_keys.php +++ b/admin/api_keys.php @@ -4,9 +4,10 @@ * Admin > API Keys - the keys other systems use the API with. Each acts as * an agent, so each shows who, what their role opens and which clients * they see, whether the key works (it expires, and an agent who is - * disabled, archived or has no role turns every call away) and when it was - * last used. A revoked key has expired, so it moves to Expired, where it can - * be deleted. The work is in functions/api_keys.php; the handlers are + * disabled, archived or has no role turns every call away), when it was + * last used and from where, and its calls over the last 30 days - each + * opening what it was used for (modals/api/api_key_usage.php). A revoked key + * has expired, so it moves to Expired, where it can be deleted. The work is in functions/api_keys.php; the handlers are * admin/post/api_keys.php. */ @@ -49,6 +50,8 @@ while ($row = mysqli_fetch_assoc($sql)) { } $roles = roleRows(); $access = userClientAccess(array_filter(array_map('intval', array_column($keys, 'api_key_user_id')))); +// What each is used for, the last 30 days (functions/api_keys.php) +$usage = apiKeyUsageSummary(array_keys($keys)); $counts = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COALESCE(SUM(api_key_expire > '$today'), 0), COALESCE(SUM(api_key_expire <= '$today'), 0) FROM api_keys LEFT JOIN users ON user_id = api_key_user_id WHERE $search")); @@ -117,6 +120,7 @@ $csrf = $_SESSION['csrf_token']; Can open + Calls (30 days) @@ -127,6 +131,11 @@ $csrf = $_SESSION['csrf_token']; $expired = apiKeyExpired($row); $agent_name = trim(str_replace(' (archived)', '', (string) $row['user_name'])); $last_used = $row['api_key_last_used_at'] ? '' . escapeHtml(timeAgo($row['api_key_last_used_at'])) . '' : 'Never'; + $use = $usage[$api_key_id] ?? null; + if ($use && $use['last_ip'] !== '') { + $last_used .= '
' . escapeHtml($use['last_ip']) . '
'; + } + $usage_url = "modals/api/api_key_usage.php?id=$api_key_id"; ob_start(); ?>
@@ -165,6 +174,14 @@ $csrf = $_SESSION['csrf_token']; + + + +
endpoint
+ + None + +
@@ -172,6 +189,9 @@ $csrf = $_SESSION['csrf_token']; Edit + + Usage +
- +
diff --git a/admin/database_updates/3.3.2.php b/admin/database_updates/3.3.2.php new file mode 100644 index 000000000..4840e90b4 --- /dev/null +++ b/admin/database_updates/3.3.2.php @@ -0,0 +1,39 @@ +API Keys

 +
  • + + +

    Sign-ins

    +     +
  • LISTS
  • diff --git a/admin/modals/api/api_key_usage.php b/admin/modals/api/api_key_usage.php new file mode 100644 index 000000000..9610ad377 --- /dev/null +++ b/admin/modals/api/api_key_usage.php @@ -0,0 +1,117 @@ + +
    That key is gone - it may have been deleted.
    + + +
    +
    API Key:
    + +
    +
    + +
    + + •••• · last used +
    + +
    + $today, 'Last 7 days' => $week, 'Last 30 days' => $month] as $label => $calls) { ?> +
    +
    +
    +
    +
    +
    + +
    + + +
    Calls a day
    +
    + $calls) { ?> +
    + +
    +
    + + Today +
    + +
    +
    +
    Endpoints
    + + + + + + + + + + + +
    + +
    Not used in the last 30 days.
    + +
    +
    +
    From
    + +
      + +
    • + + +
      • + +
    + +
    Nowhere yet.
    + + + +
    + call turned away after it expired, the last . + See them +
    + +
    +
    + +
    +
    + Its history + + +
    + + - Everything from it + Everything from it Not recorded @@ -168,7 +168,7 @@ ob_start(); 0) { ?>
    -
    What did around then
    +
    0) { ?> All of that day diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php index b3027db4d..1e6cc1f6f 100644 --- a/admin/post/api_keys.php +++ b/admin/post/api_keys.php @@ -112,6 +112,7 @@ if (isset($_GET['delete_api_key'])) { } mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = " . intval($row['api_key_id'])); + mysqli_query($mysqli, "DELETE FROM api_key_usage WHERE api_key_usage_key_id = " . intval($row['api_key_id'])); logAudit("API Key", "Delete", "$session_name deleted API key " . escapeSql($row['api_key_name']), 0, $row['api_key_id']); @@ -132,6 +133,7 @@ if (isset($_POST['bulk_delete_api_keys'])) { continue; } mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); + mysqli_query($mysqli, "DELETE FROM api_key_usage WHERE api_key_usage_key_id = $api_key_id"); logAudit("API Key", "Delete", "$session_name deleted API key " . escapeSql($row['api_key_name']), 0, $api_key_id); $count++; } diff --git a/admin/post/settings_security.php b/admin/post/settings_security.php index 44a8e5267..1cddac09f 100644 --- a/admin/post/settings_security.php +++ b/admin/post/settings_security.php @@ -19,12 +19,18 @@ if (isset($_POST['edit_security_settings'])) { } $config_share_require_protection = intval($_POST['config_share_require_protection'] ?? 0) ? 1 : 0; + // Failed sign-in alerts (functions/sign_in.php) - only the choices offered + $config_login_alert_failures = intval($_POST['config_login_alert_failures'] ?? 10); + if (!isset(signInAlertOptions()[$config_login_alert_failures])) { + $config_login_alert_failures = 10; + } + // Disallow turning on login key without a secret if (empty($config_login_key_secret)) { $config_login_key_required = 0; } - mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret', config_login_remember_me_expire = $config_login_remember_me_expire, config_log_retention = $config_log_retention, config_share_max_hours = $config_share_max_hours, config_share_require_protection = $config_share_require_protection WHERE company_id = 1"); + mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret', config_login_remember_me_expire = $config_login_remember_me_expire, config_log_retention = $config_log_retention, config_share_max_hours = $config_share_max_hours, config_share_require_protection = $config_share_require_protection, config_login_alert_failures = $config_login_alert_failures WHERE company_id = 1"); logAudit("Settings", "Edit", "$session_name edited security settings"); diff --git a/admin/settings_security.php b/admin/settings_security.php index 07660d0c4..2204e865f 100644 --- a/admin/settings_security.php +++ b/admin/settings_security.php @@ -1,6 +1,9 @@
    @@ -40,13 +43,25 @@ require_once "includes/inc_all_admin.php";
    - +
    +
    + +
    + + +
    +
    +
    Shared links
    diff --git a/admin/sign_ins.php b/admin/sign_ins.php new file mode 100644 index 000000000..1d34de089 --- /dev/null +++ b/admin/sign_ins.php @@ -0,0 +1,324 @@ + Sign-ins - who signs in, and from where. People: each agent and + * portal contact with sign-in activity - their last sign in with its IP + * address and device, how many sign-ins and failed ones (the wrong MFA codes + * among them), how many IP addresses and, for a date range, how many of them + * were new. IP addresses: each address - the sign-ins and failures from it, + * the accounts it tried (and emails with no account), when it was first and + * last seen, and whether it is being turned away now. Searched by name, email + * or IP address, for a date range, sorted from the column headings, a page at + * a time; each opens its sign-ins in Admin > Audit Logs. The work is in + * functions/sign_in.php. + */ + +// Default Column Sortby Filter +$sort = "last_seen"; +$order = "DESC"; + +require_once "includes/inc_all_admin.php"; + +$page_title = 'Sign-ins'; + +$view = ($_GET['view'] ?? '') === 'ips' ? 'ips' : ''; +$types = "log_type IN ('" . implode("', '", SIGN_IN_TYPES) . "')"; +$failed = "log_action IN ('" . implode("', '", SIGN_IN_FAILED) . "')"; +$dated = $dtf !== '1970-01-01' || $dtt !== '2099-12-31'; +$range = $dated ? "AND log_created_at >= '$dtf 00:00:00' AND log_created_at < '$dtt' + INTERVAL 1 DAY" : ''; +$like = $q !== '' ? "AND (user_name LIKE '%$q%' OR user_email LIKE '%$q%' OR log_ip LIKE '%$q%')" : ''; +$joins = "LEFT JOIN users ON users.user_id = log_user_id AND log_user_id > 0"; + +// Only these sort, for the view on show +$sortable_columns = $view === 'ips' ? [ + 'log_ip' => "log_ip $order", + 'sign_ins' => "sign_ins $order, last_seen DESC", + 'failures' => "failures $order, last_seen DESC", + 'accounts' => "accounts $order, last_seen DESC", + 'first_seen' => "first_seen $order", + 'last_seen' => "last_seen $order", +] : [ + 'user_name' => "user_name $order", + 'sign_ins' => "sign_ins $order, last_seen DESC", + 'failures' => "failures $order, last_seen DESC", + 'ips' => "ips $order, last_seen DESC", + 'last_seen' => "last_seen $order", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'last_seen'; +} + +$rows = []; +if ($view === 'ips') { + $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS log_ip, + SUM(log_action = 'Success') AS sign_ins, SUM($failed) AS failures, SUM(log_action = 'Blocked') AS blocked, + COUNT(DISTINCT NULLIF(log_user_id, 0)) AS accounts, + COUNT(DISTINCT IF(log_user_id = 0 AND log_action = 'Failed', log_description, NULL)) AS unknown, + MIN(log_created_at) AS first_seen, MAX(log_created_at) AS last_seen, MAX(log_id) AS last_id + FROM logs $joins + WHERE $types AND log_ip <> '' $range $like + GROUP BY log_ip + ORDER BY {$sortable_columns[$sort]} + LIMIT $record_from, $record_to"); +} else { + $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS log_user_id, user_name, user_email, user_avatar, user_type, user_status, user_archived_at, + SUM(log_action = 'Success') AS sign_ins, SUM($failed) AS failures, SUM(log_action = 'MFA Failed') AS mfa_failures, + COUNT(DISTINCT IF(log_action = 'Success', log_ip, NULL)) AS ips, + MAX(IF(log_action = 'Success', log_id, NULL)) AS last_success_id, MAX(log_created_at) AS last_seen + FROM logs JOIN users ON users.user_id = log_user_id + WHERE $types AND log_user_id > 0 $range $like + GROUP BY log_user_id + ORDER BY {$sortable_columns[$sort]} + LIMIT $record_from, $record_to"); +} +$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; +} + +// How many of each, for the filters +$counts = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(DISTINCT users.user_id), COUNT(DISTINCT NULLIF(log_ip, '')) + FROM logs $joins WHERE $types $range $like")); + +if ($view === 'ips') { + // The accounts each address tried, its last device, and whether it is turned away now + $ip_list = implode(', ', array_map(function ($row) { return "'" . escapeSql($row['log_ip']) . "'"; }, $rows)) ?: "''"; + $tried = []; + $sql = mysqli_query($mysqli, "SELECT log_ip, users.user_id, user_name, user_avatar, user_type, MAX(log_id) AS last_id FROM logs JOIN users ON users.user_id = log_user_id + WHERE log_ip IN ($ip_list) AND $types $range GROUP BY log_ip, users.user_id ORDER BY last_id DESC"); + while ($row = mysqli_fetch_assoc($sql)) { + $tried[$row['log_ip']][] = $row; + } + $last_devices = []; + $last_ids = array_filter(array_map('intval', array_column($rows, 'last_id'))); + if ($last_ids) { + $sql = mysqli_query($mysqli, "SELECT log_ip, log_user_agent FROM logs WHERE log_id IN (" . implode(',', $last_ids) . ")"); + while ($row = mysqli_fetch_assoc($sql)) { + $last_devices[$row['log_ip']] = auditLogDevice($row['log_user_agent']); + } + } + $turned_away = []; + $sql = mysqli_query($mysqli, "SELECT log_ip, COUNT(*) FROM logs WHERE log_ip IN ($ip_list) AND $types AND $failed + AND log_created_at > NOW() - INTERVAL " . SIGN_IN_WINDOW_MINUTES . " MINUTE GROUP BY log_ip HAVING COUNT(*) >= " . SIGN_IN_LOCKOUT); + while ($row = mysqli_fetch_row($sql)) { + $turned_away[$row[0]] = true; + } +} else { + // Each one's last sign in, and the addresses that were new in the date range + $last = []; + $last_ids = array_filter(array_map('intval', array_column($rows, 'last_success_id'))); + if ($last_ids) { + $sql = mysqli_query($mysqli, "SELECT log_id, log_ip, log_user_agent, log_created_at FROM logs WHERE log_id IN (" . implode(',', $last_ids) . ")"); + while ($row = mysqli_fetch_assoc($sql)) { + $last[intval($row['log_id'])] = $row; + } + } + $new_ips = []; + $user_ids = array_filter(array_map('intval', array_column($rows, 'log_user_id'))); + if ($dated && $user_ids) { + $sql = mysqli_query($mysqli, "SELECT log_user_id, COUNT(*) FROM ( + SELECT log_user_id, MIN(log_created_at) AS first_at FROM logs + WHERE log_user_id IN (" . implode(',', $user_ids) . ") AND $types AND log_action = 'Success' AND log_ip <> '' + GROUP BY log_user_id, log_type, log_ip) firsts + WHERE first_at >= '$dtf 00:00:00' AND first_at < '$dtt' + INTERVAL 1 DAY GROUP BY log_user_id"); + while ($row = mysqli_fetch_row($sql)) { + $new_ips[intval($row[0])] = intval($row[1]); + } + } + // A portal contact opens on their contact page + $contacts = []; + if ($user_ids) { + $sql = mysqli_query($mysqli, "SELECT contact_user_id, contact_id, contact_client_id FROM contacts WHERE contact_user_id IN (" . implode(',', $user_ids) . ")"); + while ($row = mysqli_fetch_assoc($sql)) { + $contacts[intval($row['contact_user_id'])] = $row; + } + } +} + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; +// A view keeps the search and dates, and starts from the top +$view_url = function ($key) { + $query = array_diff_key($_GET, ['page' => 1, 'sort' => 1, 'order' => 1]); + $query['view'] = $key; + return '?' . http_build_query(array_filter($query, function ($value) { + return $value !== '' && $value !== null && $value !== []; + })); +}; +// Their sign-ins in Admin > Audit Logs, for the same dates +$dates_query = $dated ? ['canned_date' => 'custom', 'dtf' => $dtf, 'dtt' => $dtt] : []; +$audit_url = function (array $query) use ($dates_query) { + return '/admin/audit_logs.php?' . http_build_query(['view' => 'signins'] + $query + $dates_query); +}; + +?> + +
    +
    +

    Sign-ins

    +
    + + Alerts + +
    +
    +
    +
    + +
    +
    +
    + + +
    +
    +
    + + + + +
    +
    +
    + +
    +
    + + "> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Last sign in
    +
    +
    + + Turned away now + + Turned away × + +     		+
    + + Portal' : '' ?> + + 3) { ?>and more +
    + +
    email with no account
    + +     		+ +
    +
    + +
    + + + + + + + + Portal' : '' ?> + ' . escapeHtml($state) . '' : '' ?> +
    +
    +
    +     		+ +
    +
    + + None + +     		+ + +
    MFA
    + +     		+ + +
    new
    + +     		+ +
    +
    + $view === 'ips' ? 'IP addresses' : 'sign-ins', + 'icon' => 'fa-sign-in-alt', + 'filtered' => $q !== '' || $dated, + 'views' => ['view'], + 'text' => 'Agents and portal contacts signing in - and failing to - show here, by who and by where from.', + ]; + require_once "../includes/filter_footer.php"; + ?> +
    + + $definition) { $view_counts[$key] = count(array_filter($all_licenses, $definition['test'])); diff --git a/agent/audit_log.php b/agent/audit_log.php index 27b6bc187..09cc274e3 100644 --- a/agent/audit_log.php +++ b/agent/audit_log.php @@ -63,6 +63,7 @@ while ($row = mysqli_fetch_assoc($sql)) { $rows[] = $row; } $records = auditLogRecords($rows); +$new_ips = signInNewIpIds($rows); $kinds = auditLogKinds(); // Each view counted for the rest of the filters @@ -225,7 +226,7 @@ $view_empty = [
    - +
    diff --git a/agent/user/user_activity.php b/agent/user/user_activity.php index abb8bf0bb..f9bbae774 100644 --- a/agent/user/user_activity.php +++ b/agent/user/user_activity.php @@ -51,6 +51,7 @@ while ($row = mysqli_fetch_assoc($sql)) { $rows[] = $row; } $records = auditLogRecords($rows); +$new_ips = signInNewIpIds($rows); $kinds = auditLogKinds(); // Each view counted for the search and dates @@ -148,7 +149,7 @@ $view_empty = [
    - +
    diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 94ac7fbd0..b0beaf6fa 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -78,10 +78,18 @@ if (isset($api_key)) { // Failed if (mysqli_num_rows($sql) !== 1) { - // Invalid Key + // Invalid Key - an expired one is logged against it (functions/api_keys.php), and a run of them from one address tells the admins $url_path = escapeSql(parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH)); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = 'Incorrect or expired key (endpoint: $url_path)', log_ip = '$ip', log_user_agent = '$user_agent'"); + $expired_key = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT api_key_id, api_key_name, api_key_expire FROM api_keys WHERE api_key_secret = '$api_key' LIMIT 1")); + if ($expired_key) { + $failed_description = escapeSql("Expired API key " . $expired_key['api_key_name'] . " used - it ended " . $expired_key['api_key_expire']) . " (endpoint: $url_path)"; + } else { + $failed_description = "Unknown API key used (endpoint: $url_path)"; + } + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = '$failed_description', log_ip = '$ip', log_user_agent = '$user_agent', + log_entity_id = " . intval($expired_key['api_key_id'] ?? 0)); + apiKeyWatch(); $return_arr['success'] = "False"; $return_arr['message'] = "Authentication failed. API key is invalid or has expired."; @@ -104,6 +112,9 @@ if (isset($api_key)) { mysqli_query($mysqli, "UPDATE api_keys SET api_key_last_used_at = NOW() WHERE api_key_id = " . intval($row['api_key_id']) . " AND (api_key_last_used_at IS NULL OR api_key_last_used_at < NOW() - INTERVAL 1 MINUTE)"); + // What it is used for - each call counted to its day and endpoint (functions/api_keys.php) + apiKeyUsageRecord($row['api_key_id'], apiKeyUsageEndpoint($_SERVER['REQUEST_URI'] ?? ''), getIP()); + // Set limit & offset for queries if (isset($_GET['limit'])) { $limit = intval($_GET['limit']); diff --git a/client/login_microsoft.php b/client/login_microsoft.php index 6bed955dd..2ab4a1f77 100644 --- a/client/login_microsoft.php +++ b/client/login_microsoft.php @@ -165,6 +165,10 @@ if (isset($_GET['code']) || isset($_GET['error'])) { } else { + // Logged with why, against the account when there is one (functions/sign_in.php) + $entra_why = $row ? ['user_id' => $user_id, 'client_id' => $client_id, 'reason' => 'the account signs in with a password, not Microsoft 365'] : signInFailureReason($msgraph_response['userPrincipalName']); + signInLogFailure('Client Login', 'Failed', "Failed client portal sign in via Entra as $upn - " . escapeSql($entra_why['reason']), $entra_why['user_id'], $entra_why['client_id']); + $_SESSION['login_message'] = 'Something went wrong with logging you in: Your account is not configured for Entra SSO. Please ensure you are setup in ITFlow as a contact and have Entra SSO configured.'; header("Location: ../login.php"); diff --git a/cron/nightly_tasks.php b/cron/nightly_tasks.php index e2bbfcd28..3d925da68 100644 --- a/cron/nightly_tasks.php +++ b/cron/nightly_tasks.php @@ -185,8 +185,8 @@ mysqli_query($mysqli, "DELETE FROM logs WHERE log_created_at < CURDATE() - INTER // Cleanup old app/debug logs mysqli_query($mysqli, "DELETE FROM app_logs WHERE app_log_created_at < CURDATE() - INTERVAL $config_log_retention DAY"); -// Cleanup old auth logs -mysqli_query($mysqli, "DELETE FROM auth_logs WHERE auth_log_created_at < CURDATE() - INTERVAL $config_log_retention DAY"); +// Cleanup old API key use - the days kept as long as the audit log +mysqli_query($mysqli, "DELETE FROM api_key_usage WHERE api_key_usage_date < CURDATE() - INTERVAL $config_log_retention DAY"); // CLeanup old domain history $sql = mysqli_query($mysqli, "SELECT domain_id FROM domains"); diff --git a/db.sql b/db.sql index 757f12e5f..b6da257fb 100644 --- a/db.sql +++ b/db.sql @@ -104,6 +104,24 @@ CREATE TABLE `ai_providers` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Table structure for table `api_key_usage` +-- + +DROP TABLE IF EXISTS `api_key_usage`; +/*!40101 SET @saved_cs_client = @@character_set_client */; +/*!40101 SET character_set_client = utf8mb4 */; +CREATE TABLE `api_key_usage` ( + `api_key_usage_key_id` int(11) NOT NULL, + `api_key_usage_date` date NOT NULL, + `api_key_usage_endpoint` varchar(100) NOT NULL DEFAULT '', + `api_key_usage_calls` int(11) NOT NULL DEFAULT 0, + `api_key_usage_last_at` datetime NOT NULL DEFAULT current_timestamp(), + `api_key_usage_last_ip` varchar(200) DEFAULT NULL, + PRIMARY KEY (`api_key_usage_key_id`,`api_key_usage_date`,`api_key_usage_endpoint`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; +/*!40101 SET character_set_client = @saved_cs_client */; + -- -- Table structure for table `api_keys` -- @@ -368,25 +386,6 @@ CREATE TABLE `assets` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; --- --- Table structure for table `auth_logs` --- - -DROP TABLE IF EXISTS `auth_logs`; -/*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8mb4 */; -CREATE TABLE `auth_logs` ( - `auth_log_id` int(11) NOT NULL AUTO_INCREMENT, - `auth_log_status` tinyint(1) NOT NULL, - `auth_log_details` varchar(200) DEFAULT NULL, - `auth_log_ip` varchar(200) DEFAULT NULL, - `auth_log_user_agent` varchar(250) DEFAULT NULL, - `auth_log_user_id` int(11) NOT NULL DEFAULT 0, - `auth_log_created_at` datetime NOT NULL DEFAULT current_timestamp(), - PRIMARY KEY (`auth_log_id`) -) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; -/*!40101 SET character_set_client = @saved_cs_client */; - -- -- Table structure for table `backups` -- @@ -2945,6 +2944,7 @@ CREATE TABLE `settings` ( `config_update_checked_at` datetime DEFAULT NULL, `config_share_max_hours` int(11) NOT NULL DEFAULT 720, `config_share_require_protection` tinyint(1) NOT NULL DEFAULT 0, + `config_login_alert_failures` int(11) NOT NULL DEFAULT 10, PRIMARY KEY (`company_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; diff --git a/functions.php b/functions.php index a834eeba3..217d18abb 100644 --- a/functions.php +++ b/functions.php @@ -35,6 +35,7 @@ require_once __DIR__ . '/functions/links.php'; require_once __DIR__ . '/functions/auth.php'; require_once __DIR__ . '/functions/logging.php'; require_once __DIR__ . '/functions/audit_log.php'; +require_once __DIR__ . '/functions/sign_in.php'; require_once __DIR__ . '/functions/app.php'; require_once __DIR__ . '/functions/email.php'; require_once __DIR__ . '/functions/email_preview.php'; diff --git a/functions/api_keys.php b/functions/api_keys.php index 24c8371bf..08ec59316 100644 --- a/functions/api_keys.php +++ b/functions/api_keys.php @@ -155,3 +155,138 @@ function apiKeyAgentFieldHtml($selected = 0) { getMessage()); + } +} + +/* + * Each key's use over the last $days days - [api_key_id => ['calls', + * 'endpoints', 'last_at', 'last_ip']], nothing for a key not used. + */ +function apiKeyUsageSummary(array $api_key_ids, $days = 30) { + global $mysqli; + $ids = array_values(array_filter(array_map('intval', $api_key_ids))); + $usage = []; + if (!$ids) { + return $usage; + } + $days = max(1, intval($days)); + $sql = mysqli_query($mysqli, "SELECT api_key_usage_key_id, SUM(api_key_usage_calls) AS calls, COUNT(DISTINCT api_key_usage_endpoint) AS endpoints, MAX(api_key_usage_last_at) AS last_at + FROM api_key_usage WHERE api_key_usage_key_id IN (" . implode(',', $ids) . ") AND api_key_usage_date > CURDATE() - INTERVAL $days DAY + GROUP BY api_key_usage_key_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $usage[intval($row['api_key_usage_key_id'])] = ['calls' => intval($row['calls']), 'endpoints' => intval($row['endpoints']), 'last_at' => $row['last_at'], 'last_ip' => '']; + } + // Where the last call came from - the row it was counted on + $sql = mysqli_query($mysqli, "SELECT u.api_key_usage_key_id, u.api_key_usage_last_ip FROM api_key_usage u + JOIN (SELECT api_key_usage_key_id, MAX(api_key_usage_last_at) AS last_at FROM api_key_usage WHERE api_key_usage_key_id IN (" . implode(',', $ids) . ") GROUP BY api_key_usage_key_id) m + ON m.api_key_usage_key_id = u.api_key_usage_key_id AND m.last_at = u.api_key_usage_last_at"); + while ($row = mysqli_fetch_row($sql)) { + if (isset($usage[intval($row[0])])) { + $usage[intval($row[0])]['last_ip'] = (string) $row[1]; + } + } + return $usage; +} + +/* A key's calls each day over the last $days days, oldest first - [Y-m-d => calls], every day there. */ +function apiKeyUsageDaily($api_key_id, $days = 30) { + global $mysqli; + $days = max(1, intval($days)); + $daily = []; + for ($i = $days - 1; $i >= 0; $i--) { + $daily[date('Y-m-d', strtotime("-$i days"))] = 0; + } + $sql = mysqli_query($mysqli, "SELECT api_key_usage_date, SUM(api_key_usage_calls) FROM api_key_usage + WHERE api_key_usage_key_id = " . intval($api_key_id) . " AND api_key_usage_date > CURDATE() - INTERVAL $days DAY GROUP BY api_key_usage_date"); + while ($row = mysqli_fetch_row($sql)) { + if (isset($daily[$row[0]])) { + $daily[$row[0]] = intval($row[1]); + } + } + return $daily; +} + +/* The endpoints a key called over the last $days days, busiest first - rows of endpoint, calls, last_at. */ +function apiKeyUsageEndpoints($api_key_id, $days = 30) { + global $mysqli; + $rows = []; + $sql = mysqli_query($mysqli, "SELECT api_key_usage_endpoint AS endpoint, SUM(api_key_usage_calls) AS calls, MAX(api_key_usage_last_at) AS last_at FROM api_key_usage + WHERE api_key_usage_key_id = " . intval($api_key_id) . " AND api_key_usage_date > CURDATE() - INTERVAL " . max(1, intval($days)) . " DAY + GROUP BY api_key_usage_endpoint ORDER BY calls DESC, endpoint ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} + +/* The IP addresses a key was last called from on each day, over the last $days days - rows of ip and last_at, latest first. */ +function apiKeyUsageIps($api_key_id, $days = 30) { + global $mysqli; + $rows = []; + $sql = mysqli_query($mysqli, "SELECT api_key_usage_last_ip AS ip, MAX(api_key_usage_last_at) AS last_at FROM api_key_usage + WHERE api_key_usage_key_id = " . intval($api_key_id) . " AND api_key_usage_date > CURDATE() - INTERVAL " . max(1, intval($days)) . " DAY AND api_key_usage_last_ip <> '' + GROUP BY api_key_usage_last_ip ORDER BY last_at DESC LIMIT 10"); + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} + +/* Calls turned away with a key after it expired, over the last $days days - ['count', 'last_at']. */ +function apiKeyTurnedAway($api_key_id, $days = 30) { + global $mysqli; + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*), MAX(log_created_at) FROM logs + WHERE log_type = 'API' AND log_action = 'Failed' AND log_entity_id = " . intval($api_key_id) . " AND log_created_at > NOW() - INTERVAL " . max(1, intval($days)) . " DAY")); + return ['count' => intval($row[0]), 'last_at' => $row[1]]; +} + +/* + * After an API call is turned away: when this IP address has just reached + * the admins' number of them in SIGN_IN_WINDOW_MINUTES, tell them + * (signInAlertAdmins()). + */ +function apiKeyWatch() { + global $mysqli, $session_ip; + $limit = signInAlertLimit(); + $ip = escapeSql((string) $session_ip); + if ($limit <= 0 || $ip === '') { + return; + } + $count = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE log_type = 'API' AND log_action = 'Failed' AND log_ip = '$ip' + AND log_created_at > NOW() - INTERVAL " . SIGN_IN_WINDOW_MINUTES . " MINUTE"))[0]); + if ($count === $limit) { + signInAlertAdmins( + "$limit API calls turned away from $session_ip", + "$limit API calls in " . SIGN_IN_WINDOW_MINUTES . " minutes from $session_ip were turned away - with a key that is wrong or has expired.", + ['IP address' => (string) $session_ip], + '/admin/audit_logs.php?view=security&q=' . rawurlencode((string) $session_ip) + ); + } +} diff --git a/functions/audit_log.php b/functions/audit_log.php index 670589573..c7a02a3b7 100644 --- a/functions/audit_log.php +++ b/functions/audit_log.php @@ -137,7 +137,7 @@ function auditLogActionStyle($action) { 'Reply' => ['primary', 'fa-reply'], 'Resolve' => ['success', 'fa-check'], 'Close' => ['secondary', 'fa-check-double'], 'Reopen' => ['primary', 'fa-redo'], 'Delete' => ['danger', 'fa-trash-alt'], 'Bulk Delete' => ['danger', 'fa-trash-alt'], 'Revoke' => ['danger', 'fa-ban'], 'Archive' => ['secondary', 'fa-archive'], 'Bulk Archive' => ['secondary', 'fa-archive'], 'Restore' => ['info', 'fa-redo'], 'Bulk Restore' => ['info', 'fa-redo'], - 'Success' => ['success', 'fa-check-circle'], 'Failed' => ['danger', 'fa-times-circle'], 'Failure' => ['danger', 'fa-times-circle'], 'MFA Failed' => ['danger', 'fa-shield-alt'], 'Blocked' => ['danger', 'fa-ban'], 'Denied' => ['danger', 'fa-ban'], + 'Success' => ['success', 'fa-check-circle'], 'Alert' => ['danger', 'fa-bell'], 'Failed' => ['danger', 'fa-times-circle'], 'Failure' => ['danger', 'fa-times-circle'], 'MFA Failed' => ['danger', 'fa-shield-alt'], 'Blocked' => ['danger', 'fa-ban'], 'Denied' => ['danger', 'fa-ban'], 'View' => ['warning', 'fa-eye'], 'View TOTP' => ['warning', 'fa-eye'], 'View As' => ['warning', 'fa-user-secret'], 'Export' => ['warning', 'fa-download'], 'Download' => ['warning', 'fa-download'], 'Share' => ['warning', 'fa-share-alt'], 'Send' => ['primary', 'fa-paper-plane'], 'Email' => ['primary', 'fa-envelope'], 'Payment' => ['success', 'fa-credit-card'], 'Auto Payment' => ['success', 'fa-credit-card'], 'Error' => ['danger', 'fa-exclamation-triangle'], @@ -163,10 +163,11 @@ function auditLogActionPill($action) { /* * The list's views - key => label, icon, title and the SQL on logs that picks * them. Sign-ins are agents and portal contacts signing in and out; security - * is the sign-ins that failed or were blocked, access denied, the portal - * viewed as a contact, and changes to users, roles, API keys, the master key, - * settings and backups; data out is passwords looked at, exports, downloads - * and shared links. + * is the sign-ins that failed or were turned away and the admins told about + * them, API calls turned away, access denied, the portal viewed as a contact, + * and changes to users, roles, API keys, the master key, settings and + * backups; data out is passwords looked at, exports, downloads and shared + * links. */ function auditLogViews() { $signins = "log_type IN ('Login', 'Login 2FA', 'Logout', 'Client Login')"; @@ -176,8 +177,8 @@ function auditLogViews() { 'changes' => ['label' => 'Changes', 'icon' => 'fa-pen', 'title' => 'Records made, changed, archived, restored and deleted', 'where' => "NOT $signins AND NOT $data_out"], 'deletions' => ['label' => 'Deletions', 'icon' => 'fa-trash-alt', 'title' => 'Records deleted for good', 'where' => "log_action IN ('Delete', 'Bulk Delete')"], 'signins' => ['label' => 'Sign-ins', 'icon' => 'fa-sign-in-alt', 'title' => 'Agents and portal contacts signing in and out', 'where' => $signins], - 'security' => ['label' => 'Security', 'icon' => 'fa-shield-alt', 'title' => 'Failed and blocked sign-ins, access denied, the portal viewed as a contact, and changes to users, roles, API keys, the master key, settings and backups', - 'where' => "(($signins AND log_action IN ('Failed', 'MFA Failed', 'Blocked')) OR log_action IN ('Denied', 'View As') OR log_type IN ('User', 'User Account', 'User Role', 'API Key', 'Master Key', 'Settings', 'Backup', 'Identity Provider'))"], + 'security' => ['label' => 'Security', 'icon' => 'fa-shield-alt', 'title' => 'Failed and turned away sign-ins and the alerts about them, API calls turned away, access denied, the portal viewed as a contact, and changes to users, roles, API keys, the master key, settings and backups', + 'where' => "(($signins AND log_action IN ('Failed', 'MFA Failed', 'Blocked', 'Alert')) OR (log_type = 'API' AND log_action = 'Failed') OR log_action IN ('Denied', 'View As') OR log_type IN ('User', 'User Account', 'User Role', 'API Key', 'Master Key', 'Settings', 'Backup', 'Identity Provider'))"], 'data' => ['label' => 'Data out', 'icon' => 'fa-file-export', 'title' => 'Passwords looked at, exports, downloads and shared links', 'where' => $data_out], ]; } @@ -316,7 +317,8 @@ function auditLogDescription(array $row) { /* * Who did it - ['name', 'kind' (agent, portal - a client contact - or * system), 'html' (their avatar or tile and name)]. No one is ITFlow itself: - * cron, the API, the email parser. + * cron, the API, the email parser. A failed sign in names the account it was + * to, marked Their account - it may not have been them. */ function auditLogWho(array $row) { $user_id = intval($row['log_user_id']); @@ -325,9 +327,12 @@ function auditLogWho(array $row) { return ['name' => $name, 'kind' => 'system', 'html' => '' . escapeHtml($name) . '']; } $portal = intval($row['user_type'] ?? 1) === 2; + // A failed sign in is to their account, not necessarily by them + $against = in_array($row['log_type'] ?? '', SIGN_IN_TYPES, true) && in_array($row['log_action'] ?? '', SIGN_IN_FAILED, true); $html = '' . userAvatar($user_id, $row['user_name'], (string) ($row['user_avatar'] ?? ''), 'xs') . '' . escapeHtml($row['user_name']) . '' - . ($portal ? 'Portal' : '') . ''; + . ($portal ? 'Portal' : '') + . ($against ? 'Their account' : '') . ''; return ['name' => (string) $row['user_name'], 'kind' => $portal ? 'portal' : 'agent', 'html' => $html]; } diff --git a/functions/email_preview.php b/functions/email_preview.php index 44a4549b6..90976fa34 100644 --- a/functions/email_preview.php +++ b/functions/email_preview.php @@ -395,6 +395,12 @@ function emailPreviewCatalog() { 'run' => function ($s) { userMailSignInAlert($s['agent_name'], $s['agent_email'], 'mfa', '198.51.100.7', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) Gecko/20100101 Firefox/129.0'); }], + 'admin_sign_in_alert' => ['group' => 'Your team\'s accounts', 'label' => 'Failed sign-ins', 'to' => 'Every admin', 'when' => 'A run of failed sign-ins from one IP address or against one account (Admin > Settings > Security)', + 'run' => function ($s) { + signInMailAlert($s['agent_name'], $s['agent_email'], '10 failed sign-ins from 198.51.100.7', + '10 failed sign-ins in 10 minutes from 198.51.100.7, trying ' . $s['agent_name'] . ' and 3 emails with no account.', + ['IP address' => '198.51.100.7', 'Accounts tried' => 'Trying ' . $s['agent_name'] . ' and 3 emails with no account'], '/admin/sign_ins.php?view=ips&q=198.51.100.7'); + }], // ---- Other 'bulk' => ['group' => 'Other', 'label' => 'Email to many contacts', 'to' => 'The contacts picked', 'when' => 'Email on the contacts or clients list', diff --git a/functions/sign_in.php b/functions/sign_in.php new file mode 100644 index 000000000..ad9edd9e9 --- /dev/null +++ b/functions/sign_in.php @@ -0,0 +1,233 @@ + + * Settings > Security (config_login_alert_failures, 0 for never). login.php, + * client/login_microsoft.php and api/v1/validate_api_key.php write it; Admin > + * Sign-ins, the audit log and Your account > Activity read it. + */ + +/** How long a run of failures is counted over, and how many from one IP address login.php turns away after. */ +const SIGN_IN_WINDOW_MINUTES = 10; +const SIGN_IN_LOCKOUT = 15; + +/** The kinds of audit log entry that are signing in, and the actions that are a failed one. */ +const SIGN_IN_TYPES = ['Login', 'Client Login']; +const SIGN_IN_FAILED = ['Failed', 'MFA Failed']; + +/** The choices for when admins are told - failures in SIGN_IN_WINDOW_MINUTES => label. */ +function signInAlertOptions() { + return [0 => 'Never', 5 => 'After 5 failed sign-ins', 10 => 'After 10 failed sign-ins', 20 => 'After 20 failed sign-ins', 50 => 'After 50 failed sign-ins']; +} + +/** How many failed sign-ins in a row tell the admins - 0 for never. Read once a request; 0 before the setting exists. */ +function signInAlertLimit() { + global $mysqli; + static $limit = null; + if ($limit === null) { + try { + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT config_login_alert_failures FROM settings WHERE company_id = 1")); + $limit = max(0, intval($row[0] ?? 0)); + } catch (Throwable $e) { + $limit = 0; + } + } + return $limit; +} + +/* + * Why a password didn't get someone in as $email (raw) - the account it + * belongs to, if any: ['user_id', 'client_id', 'name', 'type' (Login for an + * agent or no account, Client Login for a portal contact), 'reason']. An + * agent's account comes before a portal one with the same email. + */ +function signInFailureReason($email) { + global $mysqli; + $email_sql = escapeSql(trim((string) $email)); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT users.user_id, user_name, user_type, user_status, user_archived_at, contact_client_id, client_archived_at + FROM users + LEFT JOIN contacts ON contact_user_id = users.user_id + LEFT JOIN clients ON client_id = contact_client_id + WHERE user_email = '$email_sql' + ORDER BY user_type ASC, users.user_id ASC LIMIT 1")); + if (!$row) { + return ['user_id' => 0, 'client_id' => 0, 'name' => '', 'type' => 'Login', 'reason' => 'no account uses that email']; + } + $agent = intval($row['user_type']) === 1; + if ($row['user_archived_at'] !== null) { + $reason = 'the account is archived'; + } elseif (intval($row['user_status']) === 2) { + $reason = "they haven't set a password yet"; + } elseif (intval($row['user_status']) !== 1) { + $reason = $agent ? 'the account is disabled' : 'their portal access is turned off'; + } elseif (!$agent && $row['client_archived_at'] !== null) { + $reason = 'their client is archived'; + } else { + $reason = 'wrong password'; + } + return [ + 'user_id' => intval($row['user_id']), + 'client_id' => $agent ? 0 : intval($row['contact_client_id']), + 'name' => (string) $row['user_name'], + 'type' => $agent ? 'Login' : 'Client Login', + 'reason' => $reason, + ]; +} + +/* + * A sign in event in the audit log, as $user_id - whose account it was, even + * when nobody signed in - from this request's IP address and browser. + * $description is SQL-safe. + */ +function signInLog($type, $action, $description, $user_id = 0, $client_id = 0) { + global $session_user_id; + $was = $session_user_id ?? 0; + $session_user_id = intval($user_id); + logAudit($type, $action, $description, $client_id, $user_id); + $session_user_id = $was; +} + +/* A failed sign in, logged with why, then watched (signInWatch()). */ +function signInLogFailure($type, $action, $description, $user_id = 0, $client_id = 0) { + signInLog($type, $action, $description, $user_id, $client_id); + signInWatch($user_id); +} + +/* + * After a failed sign in: when this IP address, or the account, has just + * reached the admins' number of failures in SIGN_IN_WINDOW_MINUTES, tell them + * (signInAlertAdmins()). Only on reaching it, so one run is one alert. + */ +function signInWatch($user_id = 0) { + global $mysqli, $session_ip; + $limit = signInAlertLimit(); + if ($limit <= 0) { + return; + } + $ip = escapeSql((string) $session_ip); + $window = "log_type IN ('" . implode("', '", SIGN_IN_TYPES) . "') AND log_action IN ('" . implode("', '", SIGN_IN_FAILED) . "') + AND log_created_at > NOW() - INTERVAL " . SIGN_IN_WINDOW_MINUTES . " MINUTE"; + + if ($ip !== '' && intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE $window AND log_ip = '$ip'"))[0]) === $limit) { + $accounts = signInAccountsTried("$window AND log_ip = '$ip'"); + signInAlertAdmins( + "$limit failed sign-ins from $session_ip", + "$limit failed sign-ins in " . SIGN_IN_WINDOW_MINUTES . " minutes from $session_ip, " . $accounts . '.', + ['IP address' => (string) $session_ip, 'Accounts tried' => ucfirst($accounts)], + '/admin/sign_ins.php?view=ips&q=' . rawurlencode((string) $session_ip) + ); + } + + $user_id = intval($user_id); + if ($user_id && intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE $window AND log_user_id = $user_id"))[0]) === $limit) { + $user = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $user_id")); + $ips = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(DISTINCT log_ip) FROM logs WHERE $window AND log_user_id = $user_id"))[0]); + $name = (string) ($user['user_name'] ?? 'an account'); + signInAlertAdmins( + "$limit failed sign-ins for $name", + "$limit failed sign-ins in " . SIGN_IN_WINDOW_MINUTES . " minutes for $name's account" . ($user ? ' (' . $user['user_email'] . ')' : '') . ", from " . ($ips === 1 ? 'one IP address' : "$ips IP addresses") . '.', + ['Account' => $name . ($user ? ' - ' . $user['user_email'] : ''), 'IP addresses' => (string) $ips], + '/admin/audit_logs.php?view=signins&user=' . $user_id + ); + } +} + +/* The accounts a run of failures tried, in words - "trying Tess Tech, Johnny Test and 2 addresses with no account". Raw. */ +function signInAccountsTried($where) { + global $mysqli; + $names = []; + $sql = mysqli_query($mysqli, "SELECT DISTINCT user_name FROM logs JOIN users ON user_id = log_user_id WHERE $where AND log_user_id > 0 ORDER BY user_name LIMIT 6"); + while ($row = mysqli_fetch_row($sql)) { + $names[] = $row[0]; + } + $unknown = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(DISTINCT log_description) FROM logs WHERE $where AND log_user_id = 0"))[0]); + if ($unknown) { + $names[] = $unknown === 1 ? 'an email with no account' : "$unknown emails with no account"; + } + if (!$names) { + return 'trying no account in particular'; + } + $last = array_pop($names); + return 'trying ' . ($names ? implode(', ', $names) . ' and ' : '') . $last; +} + +/* The active admins - [user_id => ['name', 'email']]. */ +function signInAdmins() { + global $mysqli; + $admins = []; + $sql = mysqli_query($mysqli, "SELECT users.user_id, user_name, user_email FROM users + JOIN user_roles ON role_id = user_role_id AND role_is_admin = 1 + WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL"); + while ($row = mysqli_fetch_assoc($sql)) { + $admins[intval($row['user_id'])] = ['name' => $row['user_name'], 'email' => $row['user_email']]; + } + return $admins; +} + +/* + * Tell the admins about a run of failures - a notification each, an email + * each, and an entry in the audit log (Login Alert, from the address it is + * about). Raw values in; $url is where to look. + */ +function signInAlertAdmins($title, $text, array $summary, $url) { + global $mysqli; + $type = escapeSql('Failed Sign-ins'); + $notice = escapeSql(mb_substr($text, 0, 1000)); + $action = escapeSql($url); + foreach (signInAdmins() as $admin_id => $admin) { + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = '$type', notification = '$notice', notification_action = '$action', notification_user_id = $admin_id"); + signInMailAlert($admin['name'], $admin['email'], $title, $text, $summary, $url); + } + signInLog('Login', 'Alert', escapeSql("Admins were told: $text")); +} + +/* The email to an admin about a run of failed sign-ins. Raw values in. */ +function signInMailAlert($name, $email, $title, $text, array $summary, $url) { + global $config_base_url; + $app = userMailAppName(); + emailQueue([['email' => $email, 'name' => $name, 'footnote' => "You get this as an $app administrator. Admin > Settings > Security says when."]], + "$app: $title", [ + 'kind' => 'Security', 'tone' => 'danger', 'preview' => $text, + 'title' => 'Failed sign-ins', + 'intro' => [$text], + 'summary' => ['When' => date('D j M Y, g:i A')] + $summary, + 'callout' => "$app turns an IP address away after " . SIGN_IN_LOCKOUT . " failed sign-ins in " . SIGN_IN_WINDOW_MINUTES . " minutes. If an account is being guessed at, make sure it has a strong password and multi-factor authentication.", + 'button' => ['label' => 'See the sign-ins', 'url' => "https://$config_base_url$url"], + ]); +} + +/* + * The successful sign ins among $rows (audit log rows with log_id, log_type, + * log_action, log_user_id, log_ip) that were the first from their IP address + * for that account - [log_id => true]. Measured against the log ITFlow still + * keeps. + */ +function signInNewIpIds(array $rows) { + global $mysqli; + $ids = []; + foreach ($rows as $row) { + if (in_array($row['log_type'], SIGN_IN_TYPES, true) && $row['log_action'] === 'Success' && intval($row['log_user_id']) > 0 && trim((string) $row['log_ip']) !== '') { + $ids[] = intval($row['log_id']); + } + } + if (!$ids) { + return []; + } + $new = []; + $sql = mysqli_query($mysqli, "SELECT l.log_id FROM logs l + WHERE l.log_id IN (" . implode(',', $ids) . ") + AND NOT EXISTS (SELECT 1 FROM logs p WHERE p.log_user_id = l.log_user_id AND p.log_type = l.log_type AND p.log_action = 'Success' AND p.log_ip = l.log_ip AND p.log_id < l.log_id)"); + while ($row = mysqli_fetch_row($sql)) { + $new[intval($row[0])] = true; + } + return $new; +} + +/** The New IP badge on a sign in that was the first from its address. */ +function signInNewIpBadge() { + return 'New IP'; +} diff --git a/functions/user.php b/functions/user.php index 756339039..e5480e9a4 100644 --- a/functions/user.php +++ b/functions/user.php @@ -332,8 +332,9 @@ function userLastLogins(array $user_ids) { } /** - * An agent's latest sign ins and failed MFA codes, newest first - log rows - * with log_action, log_created_at, log_ip, log_user_agent. Theirs only. + * An agent's latest sign ins, and the failed ones against their account (a + * wrong password or MFA code), newest first - log rows with log_action, + * log_description, log_created_at, log_ip, log_user_agent. Theirs only. */ function userRecentLogins($user_id, $limit = 10) { global $mysqli; @@ -347,13 +348,22 @@ function userRecentLogins($user_id, $limit = 10) { return $rows; } -/** One of those as a line - a tick for a sign in, a cross for a failed code - with when and from where. Raw in, HTML out. */ +/* + * One of those as a line - a tick for a sign in, a cross for a failed one + * with why (the end of what the log says, after " - ") - with when and from + * where. Raw in, HTML out. + */ function userLoginLineHtml($log) { $ok = $log['log_action'] === 'Success'; + $why = $log['log_action'] === 'MFA Failed' ? 'wrong MFA code' : 'failed'; + $description = (string) ($log['log_description'] ?? ''); + if ($log['log_action'] === 'Failed' && strrpos($description, ' - ') !== false) { + $why = 'failed - ' . substr($description, strrpos($description, ' - ') + 3); + } return '
    ' . '' . '
    ' . escapeHtml(timeAgo($log['log_created_at'])) . '' - . ($ok ? '' : ' ' . escapeHtml($log['log_action'] === 'MFA Failed' ? 'wrong MFA code' : $log['log_action']) . '') + . ($ok ? '' : ' ' . escapeHtml($why) . '') . '
    ' . userDeviceHtml($log['log_user_agent']) . ' · ' . escapeHtml($log['log_ip']) . '
    ' . '
    '; } diff --git a/login.php b/login.php index ca873a03b..fcb054ec2 100644 --- a/login.php +++ b/login.php @@ -53,20 +53,21 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { } } +// Agents' and portal contacts' failures alike (functions/sign_in.php) $row = mysqli_fetch_assoc(mysqli_query( $mysqli, "SELECT COUNT(log_id) AS failed_login_count FROM logs WHERE log_ip = '$session_ip' - AND log_type = 'Login' - AND log_action IN ('Failed', 'MFA Failed') - AND log_created_at > (NOW() - INTERVAL 10 MINUTE)" + AND log_type IN ('" . implode("', '", SIGN_IN_TYPES) . "') + AND log_action IN ('" . implode("', '", SIGN_IN_FAILED) . "') + AND log_created_at > (NOW() - INTERVAL " . SIGN_IN_WINDOW_MINUTES . " MINUTE)" )); $failed_login_count = intval($row['failed_login_count']); -if ($failed_login_count >= 15) { +if ($failed_login_count >= SIGN_IN_LOCKOUT) { // Make sure global session_user_id is not required here (will be 0 anyway) - logAudit("Login", "Blocked", "$session_ip was blocked access to login due to IP lockout"); + logAudit("Login", "Blocked", "Sign in turned away from $session_ip - " . SIGN_IN_LOCKOUT . " failed sign-ins in " . SIGN_IN_WINDOW_MINUTES . " minutes"); header("HTTP/1.1 429 Too Many Requests"); exit("

    $config_app_name

    Your IP address has been blocked due to repeated failed login attempts. Please try again later.

    This action has been logged."); } @@ -141,6 +142,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_
    "; } else { $email = escapeSql($sess['email'] ?? ''); + $email_raw = (string) ($sess['email'] ?? ''); } } @@ -161,6 +163,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_
    "; } else { $email = escapeSql($sess['email'] ?? ''); + $email_raw = (string) ($sess['email'] ?? ''); // A client portal user's code, or an agent's $role_choice = ($sess['type'] ?? 'agent') === 'client' ? 'client' : 'agent'; } @@ -171,6 +174,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ // ----------------------------------- if ($is_login_step && empty($response)) { $email = escapeSql($_POST['email'] ?? ''); + $email_raw = trim((string) ($_POST['email'] ?? '')); $password = $_POST['password'] ?? ''; if (empty($email) || empty($password) || !filter_var($email, FILTER_VALIDATE_EMAIL)) { @@ -261,8 +265,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ if ($agentRow === null && $clientRow === null) { header("HTTP/1.1 401 Unauthorized"); - // Option B not possible here (we don't know user_id reliably) - logAudit("Login", "Failed", "Failed login attempt using $email"); + // Why, and whose account it was - so it counts against the account too + $failed_why = signInFailureReason($email_raw ?? ''); + signInLogFailure($failed_why['type'], 'Failed', escapeSql('Failed sign in as ' . ($email_raw ?? '') . ' - ' . $failed_why['reason']), $failed_why['user_id'], $failed_why['client_id']); $response = "
    @@ -572,9 +577,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ } elseif ($current_code !== 0) { - // Option B: set session_user_id BEFORE logAudit() - $session_user_id = $user_id; - logAudit("Login", "MFA Failed", "$user_email failed MFA", 0, $user_id); + signInLogFailure('Login', 'MFA Failed', "$user_email entered a wrong MFA code - the password was right", $user_id); userMailSignInAlert($selectedRow['user_name'], $selectedRow['user_email'], 'mfa', getIP(), $_SERVER['HTTP_USER_AGENT'] ?? ''); @@ -593,7 +596,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ if ($config_client_portal_enable != 1) { header("HTTP/1.1 401 Unauthorized"); - logAudit("Client Login", "Failed", "Client portal disabled; login attempt using $email"); + $failed_user_id = intval($selectedRow['contact_user_id'] ?? 0) ?: intval($selectedRow['user_id'] ?? 0); + signInLogFailure('Client Login', 'Failed', "Failed sign in as $email - the client portal is turned off", $failed_user_id, intval($selectedRow['contact_client_id'] ?? 0)); $response = "
    @@ -677,8 +681,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ header("HTTP/1.1 429 Too Many Requests"); $response = "
    Too many wrong codes. Wait 10 minutes and sign in again.
    "; } elseif ($client_code !== '' || isset($_POST['current_code'])) { - $session_user_id = $user_id; - logAudit("Client Login", "MFA Failed", "Client contact $user_email entered a wrong two-step sign-in code", $client_id, $user_id); + signInLogFailure('Client Login', 'MFA Failed', "Client contact $user_email entered a wrong two-step sign-in code - the password was right", $user_id, $client_id); $response = "
    That code is not right - try the newest one in your app.
    "; } @@ -720,15 +723,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ } else { - // if we have a users.user_id, log it - $session_user_id = $user_id ?: 0; - logAudit( - "Client Login", - "Failed", - "Failed client portal login attempt using $email (invalid auth method or missing contact/client)", - $client_id ?? 0, - $user_id - ); + // The account is there, but can't sign in here with a password + signInLogFailure('Client Login', 'Failed', "Failed sign in as $email - " . ($user_auth_method === 'azure' ? 'the account signs in with Microsoft 365' : 'the account has no contact or client'), $user_id, $client_id ?? 0); header("HTTP/1.1 401 Unauthorized"); $response = "