From 85de6adfd6fc0f3722adf5905b82f23ed6abb11d Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 28 Jun 2026 14:37:30 -0700
Subject: auth: log evicted-account auth attempts with source IP

Emit a greppable EVICTED_AUTH line (username + cf-connecting-ip) when an
evicted account's JWT is used, so the real-time auto-banner can block the
source IP at the edge immediately rather than waiting for the hourly scan.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 lib/auth.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/auth.ts b/lib/auth.ts
index cae73a46..b299715b 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -65,8 +65,14 @@ export const jwtStrategy = new jwt.Strategy(
       user &&
       ((await db.sIsMember("evicted", user.id)) ||
         (await db.sIsMember("evicted", user.username?.toLowerCase?.().trim())))
-    )
+    ) {
+      // Distinctive, greppable line carrying the real source IP so the realtime
+      // auto-banner (scripts/atk-autoban.sh) can insta-ban it at Cloudflare.
+      console.error(
+        `EVICTED_AUTH ${user.username} ${req.headers["cf-connecting-ip"] || req.ip}`,
+      );
       return next(null, false);
+    }
 
     next(null, user);
   },
-- 
cgit v1.2.3