stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Show failed token sign-in alerts in Security activity #543

New Issue
Closed
opened 2026-08-11 05:24:54 +00:00 by timmy · 0 comments
timmy commented 2026-08-11 05:24:54 +00:00
Owner
Copy Link

Problem

Invalid and rate-blocked operator-token sign-ins are durably throttled, but successful operators cannot see that hostile or accidental attempts occurred. The throttle ledger is cleared per source after success, while Security activity records only successful sign-ins.

Product slice

Aggregate failed and blocked token sign-ins into privacy-preserving, fixed time buckets and surface those summaries in the authenticated Security activity sheet. Keep aggregation independent from the successful-action journal so rotating-source floods cannot evict trusted events.

Acceptance criteria

  • Invalid token attempts increment a durable aggregate without changing the existing 401 response.
  • Rate-blocked attempts increment a distinct blocked count without changing 429, Retry-After, or no-store behavior.
  • Aggregates are atomic across store instances, retained after successful sign-in clears source throttling, bounded, and expire.
  • Security activity returns and renders method, failed count, blocked count, and first/last timestamps.
  • No token, raw/hashed source address, request body, cookie, or CSRF value appears in the aggregate API or storage.
  • Anonymous Security activity access remains denied and no-store.
  • Behavioral backend and frontend tests cover the complete flow.

Implementation will use strict RED-GREEN-REFACTOR.

## Problem Invalid and rate-blocked operator-token sign-ins are durably throttled, but successful operators cannot see that hostile or accidental attempts occurred. The throttle ledger is cleared per source after success, while Security activity records only successful sign-ins. ## Product slice Aggregate failed and blocked token sign-ins into privacy-preserving, fixed time buckets and surface those summaries in the authenticated Security activity sheet. Keep aggregation independent from the successful-action journal so rotating-source floods cannot evict trusted events. ## Acceptance criteria - Invalid token attempts increment a durable aggregate without changing the existing 401 response. - Rate-blocked attempts increment a distinct blocked count without changing 429, Retry-After, or no-store behavior. - Aggregates are atomic across store instances, retained after successful sign-in clears source throttling, bounded, and expire. - Security activity returns and renders method, failed count, blocked count, and first/last timestamps. - No token, raw/hashed source address, request body, cookie, or CSRF value appears in the aggregate API or storage. - Anonymous Security activity access remains denied and no-store. - Behavioral backend and frontend tests cover the complete flow. Implementation will use strict RED-GREEN-REFACTOR.
timmy closed this issue 2026-08-11 05:37:54 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#543
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?