diff --git a/db/migrations/004_rate_limits.sql b/db/migrations/004_rate_limits.sql new file mode 100644 index 0000000..2adc7f5 --- /dev/null +++ b/db/migrations/004_rate_limits.sql @@ -0,0 +1,8 @@ +-- Migration 004: API rate limiting table +CREATE TABLE IF NOT EXISTS api_rate_limits ( + ip VARCHAR(45) NOT NULL, + endpoint VARCHAR(64) NOT NULL DEFAULT 'api', + hits INT UNSIGNED NOT NULL DEFAULT 1, + window_start INT UNSIGNED NOT NULL, + PRIMARY KEY (ip, endpoint) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci; diff --git a/panel/api/endpoints/sessions.php b/panel/api/endpoints/sessions.php new file mode 100644 index 0000000..3680e9d --- /dev/null +++ b/panel/api/endpoints/sessions.php @@ -0,0 +1,57 @@ +require('admin'); +$body = json_decode(file_get_contents('php://input'), true) ?? []; +$db = DB::getInstance(); +$me = Auth::getInstance()->user(); +$method = $_SERVER['REQUEST_METHOD']; + +match (true) { + + $action === 'list' && $method === 'GET' => (function() use ($db) { + $rows = $db->fetchAll( + "SELECT s.id, s.user_id, s.ip_address, s.user_agent, s.created_at, s.expires_at, + u.username, u.email, u.role + FROM sessions s + JOIN users u ON u.id = s.user_id + WHERE s.expires_at > NOW() + ORDER BY s.created_at DESC + LIMIT 200" + ) ?: []; + Response::json(['success' => true, 'data' => $rows]); + })(), + + $action === 'revoke' && $method === 'DELETE' => (function() use ($db, $body) { + $sid = trim($body['session_id'] ?? ''); + if (!$sid) Response::error('session_id required', 400); + $db->execute("DELETE FROM sessions WHERE id = ?", [$sid]); + Response::json(['success' => true]); + })(), + + $action === 'revoke-user' && $method === 'DELETE' => (function() use ($db, $body) { + $uid = (int)($body['user_id'] ?? 0); + if (!$uid) Response::error('user_id required', 400); + $count = $db->execute("DELETE FROM sessions WHERE user_id = ?", [$uid]); + Response::json(['success' => true, 'data' => ['revoked' => $count]]); + })(), + + $action === 'revoke-all' && $method === 'DELETE' => (function() use ($db, $me, $body) { + // Keep current session if provided + $keepId = $body['keep_session'] ?? null; + if ($keepId) { + $db->execute("DELETE FROM sessions WHERE id != ?", [hash('sha256', $keepId)]); + } else { + $db->execute("DELETE FROM sessions"); + } + Response::json(['success' => true]); + })(), + + default => Response::error('Not found', 404), +}; diff --git a/panel/api/index.php b/panel/api/index.php index 1b7839e..7b84ec6 100644 --- a/panel/api/index.php +++ b/panel/api/index.php @@ -56,4 +56,38 @@ if (!file_exists($endpointFile)) { Response::error("Unknown endpoint: $endpoint", 404); } + + +// #28 Rate limiting — per-IP, per-endpoint bucket +(function() use ($endpoint) { + $db = DB::getInstance(); + $ip = $_SERVER["REMOTE_ADDR"] ?? "0.0.0.0"; + $now = time(); + $window = 60; + $limit = $endpoint === "auth" ? 10 : 120; + $bucket = $endpoint === "auth" ? "auth" : "api"; + try { + $row = $db->fetchOne("SELECT hits, window_start FROM api_rate_limits WHERE ip=? AND endpoint=?", [$ip, $bucket]); + if ($row && ($now - (int)$row["window_start"]) < $window) { + $hits = (int)$row["hits"] + 1; + $db->execute("UPDATE api_rate_limits SET hits=? WHERE ip=? AND endpoint=?", [$hits, $ip, $bucket]); + } else { + $hits = 1; + $db->execute("INSERT INTO api_rate_limits (ip, endpoint, hits, window_start) VALUES (?,?,1,?) ON DUPLICATE KEY UPDATE hits=1, window_start=VALUES(window_start)", [$ip, $bucket, $now]); + } + $reset = ($row ? (int)$row["window_start"] : $now) + $window; + $remaining = max(0, $limit - $hits); + header("X-RateLimit-Limit: {$limit}"); + header("X-RateLimit-Remaining: {$remaining}"); + header("X-RateLimit-Reset: {$reset}"); + if ($hits > $limit) { + http_response_code(429); + echo json_encode(["success"=>false,"message"=>"Too many requests. Try again in " . ($reset - $now) . " seconds.","errors"=>[]]); + exit; + } + } catch (Throwable $e) { + novacpx_log("warn", "rate limit error: " . $e->getMessage()); + } +})(); + require $endpointFile; diff --git a/panel/public/admin/index.php b/panel/public/admin/index.php index c16e457..504d9df 100644 --- a/panel/public/admin/index.php +++ b/panel/public/admin/index.php @@ -14,6 +14,7 @@
@@ -165,7 +170,8 @@
- + +
Dashboard
diff --git a/panel/public/assets/css/nova.css b/panel/public/assets/css/nova.css index 04254cf..0c49803 100644 --- a/panel/public/assets/css/nova.css +++ b/panel/public/assets/css/nova.css @@ -300,3 +300,84 @@ code { font-family: 'JetBrains Mono', 'Fira Code', monospace; font-size: .85em; .text-muted { color: var(--text-muted); } .text-sm { font-size: .82rem; } .text-right { text-align: right; } .font-bold { font-weight: 700; } .w-full { width: 100%; } .hidden { display: none; } + +/* ── #26 Mobile Responsive Additions ────────────────────────────────────────── */ +#sidebar-toggle { display: none; } + +.sidebar-overlay { + display: none; position: fixed; inset: 0; + background: rgba(0,0,0,.5); z-index: 99; +} +.sidebar-overlay.open { display: block; } + +/* page-header layout */ +.page-header { + display: flex; align-items: center; justify-content: space-between; + margin-bottom: 1.5rem; flex-wrap: wrap; gap: .75rem; +} +.page-title { font-size: 1.2rem; font-weight: 700; } +.page-actions { display: flex; gap: .5rem; flex-wrap: wrap; align-items: center; } + +/* panel utility */ +.panel { + background: var(--bg2); border: 1px solid var(--border); + border-radius: var(--radius); margin-bottom: 1.5rem; +} +.panel-header { + padding: 1rem 1.25rem; border-bottom: 1px solid var(--border); + display: flex; align-items: center; justify-content: space-between; + flex-wrap: wrap; gap: .5rem; +} +.panel-title { font-size: .95rem; font-weight: 600; } +.panel-body { padding: 1.25rem; } + +/* table alias */ +.table { width: 100%; border-collapse: collapse; font-size: .88rem; } +.table th { text-align: left; font-size: .75rem; text-transform: uppercase; letter-spacing: .05em; color: var(--text-muted); padding: .65rem 1rem; border-bottom: 1px solid var(--border); white-space: nowrap; } +.table td { padding: .75rem 1rem; border-bottom: 1px solid var(--border); } +.table tr:last-child td { border-bottom: none; } +.table tr:hover td { background: var(--bg3); } + +/* btn variants */ +.btn-success { background: var(--green); color: #fff; } +.btn-success:hover { background: #0da271; } +.btn-warning { background: var(--yellow); color: #000; } +.btn-warning:hover { background: #d97706; } +.btn-danger { background: var(--red); color: #fff; } +.btn-danger:hover { background: #dc2626; } +.btn-secondary { background: var(--bg3); border: 1px solid var(--border); color: var(--text); } +.btn-secondary:hover { border-color: var(--primary); color: var(--primary); } +.btn-xs { padding: .2rem .55rem; font-size: .75rem; border-radius: 6px; } + +/* badge alias */ +.badge-muted { background: rgba(148,163,184,.15); color: #94a3b8; } + +@media (max-width: 768px) { + #sidebar-toggle { display: flex; } + + .sidebar { + transform: translateX(-100%); + transition: transform .25s ease; + z-index: 200; + } + .sidebar.open { transform: translateX(0); } + + .main-content { margin-left: 0; } + + .page-header { flex-direction: column; align-items: flex-start; } + .page-actions { width: 100%; } + + .stats-grid { grid-template-columns: repeat(auto-fill, minmax(140px, 1fr)); } + + .modal { max-width: calc(100vw - 2rem); margin: 1rem; } + + .panel-header { flex-direction: column; align-items: flex-start; } + + .topbar { padding: .65rem 1rem; } + + /* hide non-essential table columns on mobile */ + .table th:nth-child(n+4), + .table td:nth-child(n+4) { display: none; } + + .grid-2, .grid-3, .grid-4 { grid-template-columns: 1fr; } +} diff --git a/panel/public/assets/js/admin.js b/panel/public/assets/js/admin.js index e2683e2..8218b72 100644 --- a/panel/public/assets/js/admin.js +++ b/panel/public/assets/js/admin.js @@ -88,6 +88,7 @@ 'mail-server': mailServer, 'ftp-server': ftpServer, 'nginx-proxy': nginxProxy, + sessions, wordpress, 'ssl-manager': sslManager, firewall, @@ -1343,7 +1344,8 @@ ${ips.length ? ` async function wordpress() { return `

Loading…

`; } async function cloudflare() { return `

Loading…

`; } async function twofa() { return `

Loading…

`; } - async function nginxProxy() { return `

Loading…

`; } + async function nginxProxy() { return `

Loading...

`; } + async function sessions() { return `

Loading...

`; } // ── Global action helpers ────────────────────────────────────────────────── window.adminPage = (page) => Nova.loadPage(page, pages); @@ -2168,3 +2170,69 @@ window.proxySetupInstructions = async () => {
`, null, { cancelLabel: 'Close', showConfirm: false }); }; + +// ── #29 Session Manager ─────────────────────────────────────────────────────── +async function sessions() { + const r = await Nova.api('sessions', 'list'); + const rows = r?.data || []; + const fmt = d => new Date(d.replace(' ','T')+'Z').toLocaleString(); + const ua = s => { + if (!s) return '—'; + const m = s.match(/\(([^)]+)\)/); + return m ? m[1].split(';')[0].slice(0,50) : s.slice(0,50); + }; + return ` +
+

Session Manager

+
+ +
+
+
+
Active Sessions
${rows.length}
+
Unique Users
${new Set(rows.map(r=>r.user_id)).size}
+
Unique IPs
${new Set(rows.map(r=>r.ip_address)).size}
+
+
+

Active Sessions

${rows.length} total
+ ${rows.length === 0 + ? '
No active sessions
' + : `
+ + + ${rows.map(s=>` + + + + + + + `).join('')} +
UserRoleIPBrowserCreatedExpiresActions
${Nova.escHtml(s.username)}
${Nova.escHtml(s.email)}		${Nova.badge(s.role, s.role==='admin'?'red':s.role==='reseller'?'yellow':'blue')}${Nova.escHtml(s.ip_address)}${Nova.escHtml(ua(s.user_agent||''))}${fmt(s.created_at)}${fmt(s.expires_at)} + + +
`} +
`; +} + +window.sessionsRevoke = async (id) => { + const r = await Nova.api('sessions','revoke',{method:'DELETE',body:{session_id:id}}); + Nova.toast(r?.success?'Session revoked':'Failed',r?.success?'success':'error'); + if (r?.success) Nova.loadPage('sessions',window._novaPages); +}; + +window.sessionsRevokeUser = (uid,name) => { + Nova.confirm(`Revoke all sessions for ${name}? They will be logged out everywhere.`,async()=>{ + const r=await Nova.api('sessions','revoke-user',{method:'DELETE',body:{user_id:uid}}); + Nova.toast(r?.success?`${r.data?.revoked??'?'} sessions revoked`:'Failed',r?.success?'success':'error'); + if(r?.success) Nova.loadPage('sessions',window._novaPages); + },true); +}; + +window.sessionsRevokeAll = () => { + Nova.confirm('Revoke ALL sessions? Everyone including you will be logged out.',async()=>{ + const r=await Nova.api('sessions','revoke-all',{method:'DELETE',body:{}}); + Nova.toast(r?.success?'All sessions revoked — logging out...':'Failed',r?.success?'success':'error'); + if(r?.success) setTimeout(()=>location.reload(),1500); + },true); +}; diff --git a/panel/public/assets/js/nova.js b/panel/public/assets/js/nova.js index 527b209..976d430 100644 --- a/panel/public/assets/js/nova.js +++ b/panel/public/assets/js/nova.js @@ -127,3 +127,22 @@ window.Nova = (() => { return { api, toast, modal, confirm, initNav, loadPage, progressBar, bytes, relTime, badge, serviceDot, escHtml }; })(); + +// #26 Mobile sidebar toggle — shared across all panels +document.addEventListener('DOMContentLoaded', () => { + const toggle = document.getElementById('sidebar-toggle'); + const sidebar = document.getElementById('sidebar'); + const overlay = document.getElementById('sidebar-overlay'); + if (!toggle || !sidebar) return; + + const open = () => { sidebar.classList.add('open'); overlay?.classList.add('open'); document.body.style.overflow = 'hidden'; }; + const close = () => { sidebar.classList.remove('open'); overlay?.classList.remove('open'); document.body.style.overflow = ''; }; + + toggle.addEventListener('click', () => sidebar.classList.contains('open') ? close() : open()); + overlay?.addEventListener('click', close); + + // Close when a nav link is clicked on mobile + sidebar.querySelectorAll('.sidebar-link').forEach(link => + link.addEventListener('click', () => { if (window.innerWidth <= 768) close(); }) + ); +}); diff --git a/panel/public/errors/404.php b/panel/public/errors/404.php new file mode 100644 index 0000000..7ffc2c8 --- /dev/null +++ b/panel/public/errors/404.php @@ -0,0 +1,39 @@ + + + + + +404 — Page Not Found · NovaCPX + + + +
+ +
404
+

Page Not Found

+

The page you're looking for doesn't exist or has been moved.

+ + + Go Back + +
+ + diff --git a/panel/public/errors/500.php b/panel/public/errors/500.php new file mode 100644 index 0000000..ce2d702 --- /dev/null +++ b/panel/public/errors/500.php @@ -0,0 +1,39 @@ + + + + + +500 — Server Error · NovaCPX + + + +
+ +
500
+

Internal Server Error

+

Something went wrong on our end. The issue has been logged. Please try again in a moment.

+ + + Go Back + +
+ + diff --git a/panel/public/reseller/index.php b/panel/public/reseller/index.php index 79e31fd..cf8297e 100644 --- a/panel/public/reseller/index.php +++ b/panel/public/reseller/index.php @@ -40,6 +40,7 @@
+
Reseller Dashboard
diff --git a/panel/public/user/index.php b/panel/public/user/index.php index b903638..cbd8cb9 100644 --- a/panel/public/user/index.php +++ b/panel/public/user/index.php @@ -158,6 +158,7 @@ svg.ring circle { transition: stroke-dashoffset .5s; }
+
My Hosting