`app/api/security/dashboard/route.ts`

134 lines
import { NextRequest, NextResponse } from 'next/server';
import { getSecurityDashboard } from '@/lib/securityMonitoring';
import { getAdvancedSecurityStats } from '@/lib/advancedSecurity';
import { verifyJWT } from '@/lib/jwtAuth';

export async function GET(request: NextRequest) {
  try {
    // Require authentication for security dashboard
    const authHeader = request.headers.get('authorization');
    if (!authHeader) {
      return NextResponse.json({
        success: false,
        error: 'Authentication required'
      }, { status: 401 });
    }

    const token = authHeader.replace('Bearer ', '');
    const verification = verifyJWT(token);

    if (!verification.valid || verification.payload?.role !== 'admin') {
      return NextResponse.json({
        success: false,
        error: 'Admin access required'
      }, { status: 403 });
    }

    // Get comprehensive security data
    const basicSecurity = getSecurityDashboard();
    const advancedSecurity = getAdvancedSecurityStats();

    const dashboard = {
      timestamp: new Date().toISOString(),

      // Basic security metrics
      recentEvents: basicSecurity.recentEvents.slice(-20), // Last 20 events
      suspiciousIPs: basicSecurity.suspiciousIPs,
      blockedIPs: basicSecurity.blockedIPs,

      // Stats
      stats: {
        ...basicSecurity.stats,

        // Advanced stats
        totalFingerprints: advancedSecurity.totalFingerprints,
        activeBots: advancedSecurity.activeBots,
        highRiskRequests: advancedSecurity.highRiskRequests,
        ddosAttempts: advancedSecurity.ddosAttempts,
        averageRiskScore: advancedSecurity.averageRiskScore
      },

      // Security alerts (critical events from last hour)
      alerts: basicSecurity.recentEvents
        .filter(e => e.severity === 'critical' || e.severity === 'high')
        .slice(-10)
        .map(e => ({
          type: e.type,
          severity: e.severity,
          ipAddress: e.ipAddress,
          timestamp: e.timestamp,
          details: e.details
        })),

      // Top threat IPs
      topThreats: basicSecurity.suspiciousIPs
        .sort((a, b) => b.score - a.score)
        .slice(0, 10)
        .map(ip => ({
          ip: ip.ip,
          score: ip.score,
          lastSeen: ip.lastSeen,
          blocked: basicSecurity.blockedIPs.includes(ip.ip)
        })),

      // Security health score
      healthScore: calculateSecurityHealth(basicSecurity, advancedSecurity)
    };

    return NextResponse.json({
      success: true,
      data: dashboard
    });
  } catch (error) {
    console.error('[SECURITY DASHBOARD ERROR]', error);
    return NextResponse.json({
      success: false,
      error: 'Failed to generate security dashboard'
    }, { status: 500 });
  }
}

function calculateSecurityHealth(basicSecurity: any, advancedSecurity: any): {
  score: number;
  status: string;
  issues: string[];
} {
  let score = 100;
  const issues: string[] = [];

  // Deduct points for threats
  if (basicSecurity.blockedIPs.length > 10) {
    score -= 20;
    issues.push(`${basicSecurity.blockedIPs.length} IPs blocked`);
  }

  if (basicSecurity.stats.last24h > 100) {
    score -= 15;
    issues.push(`${basicSecurity.stats.last24h} security events in 24h`);
  }

  if (advancedSecurity.activeBots > 5) {
    score -= 25;
    issues.push(`${advancedSecurity.activeBots} active bots detected`);
  }

  if (advancedSecurity.highRiskRequests > 50) {
    score -= 20;
    issues.push(`${advancedSecurity.highRiskRequests} high-risk requests`);
  }

  if (advancedSecurity.averageRiskScore > 40) {
    score -= 10;
    issues.push(`Average risk score: ${advancedSecurity.averageRiskScore.toFixed(1)}`);
  }

  // Determine status
  let status: string;
  if (score >= 90) status = 'EXCELLENT';
  else if (score >= 75) status = 'GOOD';
  else if (score >= 50) status = 'WARNING';
  else status = 'CRITICAL';

  return { score: Math.max(0, score), status, issues };
}