admin logs for IP stuff

server/src/helpers/ipResolver.js

@@ -0,0 +1,45 @@
+function extractForwardedIp(value) {
+  if (typeof value === 'string' && value.trim()) {
+    return value.split(',')[0].trim();
+  }
+  if (Array.isArray(value) && value.length) {
+    return String(value[0]).trim();
+  }
+  return null;
+}
+
+function getSocketIp(socket) {
+  if (!socket) return null;
+  const headers = socket.handshake?.headers || {};
+  const forwarded = extractForwardedIp(headers['x-forwarded-for']);
+  if (forwarded) return forwarded;
+  const realIp = headers['x-real-ip'];
+  if (typeof realIp === 'string' && realIp.trim()) {
+    return realIp.trim();
+  }
+  return (
+    socket.handshake?.address ||
+    socket.conn?.remoteAddress ||
+    socket.request?.connection?.remoteAddress ||
+    null
+  );
+}
+
+function getRequestIp(req, override) {
+  const fromOverride = extractForwardedIp(override);
+  if (fromOverride) return fromOverride;
+  if (!req) return null;
+  const headers = req.headers || {};
+  const forwarded = extractForwardedIp(headers['x-forwarded-for']);
+  if (forwarded) return forwarded;
+  const realIp = headers['x-real-ip'];
+  if (typeof realIp === 'string' && realIp.trim()) {
+    return realIp.trim();
+  }
+  return req.ip || req.connection?.remoteAddress || null;
+}
+
+module.exports = {
+  getSocketIp,
+  getRequestIp,
+};

server/src/services/adminLogService.js

@@ -0,0 +1,84 @@
+const { v4: uuidv4 } = require('uuid');
+const io = require('../globals/io');
+const { getRole, roleEvents } = require('./roleService');
+const { getSocketIp } = require('../helpers/ipResolver');
+
+const ADMIN_ROLES = new Set(['admin', 'lockdown', 'lockdown-admin']);
+const MAX_HISTORY = 200;
+const history = [];
+
+function isAdminRole(role) {
+  return ADMIN_ROLES.has(role);
+}
+
+function isAdminSocket(socket) {
+  return isAdminRole(getRole(socket));
+}
+
+function pushEntry(entry) {
+  history.push(entry);
+  if (history.length > MAX_HISTORY) {
+    history.shift();
+  }
+}
+
+function emitToAdmins(event, payload) {
+  io.sockets.sockets.forEach((socket) => {
+    if (!isAdminSocket(socket)) return;
+    socket.emit(event, payload);
+  });
+}
+
+function logAdminEvent({ label, message, ip, meta = null, socketId = null }) {
+  const entry = {
+    id: uuidv4(),
+    ts: Date.now(),
+    label: label || null,
+    message: message || '',
+    ip: ip || null,
+    meta: meta || null,
+    socketId: socketId || null,
+  };
+  pushEntry(entry);
+  emitToAdmins('adminlog:entry', entry);
+}
+
+function hydrateSocket(socket) {
+  if (!socket || !isAdminSocket(socket)) return;
+  socket.emit('adminlog:init', history);
+}
+
+io.on('connection', (socket) => {
+  hydrateSocket(socket);
+  const ip = getSocketIp(socket);
+  if (ip) {
+    logAdminEvent({
+      label: 'socket',
+      message: 'Socket connected',
+      ip,
+      meta: { role: getRole(socket) },
+      socketId: socket.id,
+    });
+  }
+  socket.on('disconnect', () => {
+    const disconnectIp = getSocketIp(socket);
+    if (!disconnectIp) return;
+    logAdminEvent({
+      label: 'socket',
+      message: 'Socket disconnected',
+      ip: disconnectIp,
+      meta: { role: getRole(socket) },
+      socketId: socket.id,
+    });
+  });
+});
+
+roleEvents.on('change', ({ socket, role }) => {
+  if (!socket) return;
+  if (!isAdminRole(role)) return;
+  hydrateSocket(socket);
+});
+
+module.exports = {
+  logAdminEvent,
+};

server/src/services/videoAuthService.js

@@ -6,6 +6,8 @@ const { getMode, MODES } = require('./modeManager');
 const { isAdmin, isLockdownAdmin, getRole } = require('./roleService');
 const roverManager = require('./roverManager');
 const { loadConfig } = require('../helpers/configLoader');
+const { getRequestIp } = require('../helpers/ipResolver');
+const { logAdminEvent } = require('./adminLogService');
 
 const config = loadConfig();
 const mediaConfig = config.media || {};
@@ -76,10 +78,18 @@ app.post('/mediamtx/auth', (req, res) => {
   const sessionId = body.user;
   const action = (body.action || '').toLowerCase();
   const protocol = (body.protocol || '').toLowerCase();
-  const ip = body.ip || req.ip || '';
+  const ip = getRequestIp(req, body.ip);
   const streamInfo = extractStreamInfo(path);
 
-  logger.info('video auth request', { path: body.path, sessionId, stream: streamInfo, action, protocol, ip });
+  logger.info('video auth request', { path: body.path, sessionId, stream: streamInfo, action, protocol });
+  if (ip) {
+    logAdminEvent({
+      label: 'mediamtx',
+      message: 'Media auth request',
+      ip,
+      meta: { path: body.path, sessionId, stream: streamInfo, action, protocol },
+    });
+  }
 
   if (action === 'read' && protocol === 'srt' && streamInfo?.id) {
     return res.status(200).end();