feat: add Fail2ban security detection console

api/src/send-chain/gateway-events.controller.spec.ts

@@ -11,7 +11,7 @@ describe('GatewayEventsController protocol logging', () => {
   const protocolLogs = {
     record: jest.fn(),
   };
-  const controller = new GatewayEventsController(sendChain as never, {} as never, protocolLogs as never);
+  const controller = new GatewayEventsController(sendChain as never, {} as never, protocolLogs as never, { recordEvent: jest.fn() } as never);
 
   beforeEach(() => {
     jest.clearAllMocks();

api/src/send-chain/gateway-events.controller.ts

@@ -18,6 +18,7 @@ import { SendChainService } from './send-chain.service';
 import { GatewayDownstreamConnectionEventDto } from '../sms-config/sms-config.contracts';
 import { SmsConfigService } from '../sms-config/sms-config.service';
 import { ProtocolLogsService, type ProtocolLogInput } from '../protocol-logs/protocol-logs.service';
+import { SecurityDetectionService } from '../security-detection/security-detection.service';
 
 @ApiTags('gateway-events')
 @Controller('gateway/events')
@@ -26,6 +27,7 @@ export class GatewayEventsController {
     private readonly sendChain: SendChainService,
     private readonly smsConfig: SmsConfigService,
     private readonly protocolLogs: ProtocolLogsService,
+    private readonly security: SecurityDetectionService,
   ) {}
 
   @Post('submit-result')
@@ -81,8 +83,13 @@ export class GatewayEventsController {
   }
 
   @Post('inbound/authenticate')
-  authenticateInbound(@Body() body: GatewayInboundAuthDto) {
-    return this.trackGatewayEvent('connect', body, () => this.sendChain.authenticateInboundApplication(body), 'client_to_platform');
+  async authenticateInbound(@Body() body: GatewayInboundAuthDto) {
+    try {
+      return await this.trackGatewayEvent('connect', body, () => this.sendChain.authenticateInboundApplication(body), 'client_to_platform');
+    } catch (error) {
+      if (body.remoteIp) await this.security.recordEvent({ ruleCode: 'cmpp_auth_failure', sourceIp: body.remoteIp, account: body.account, protocol: body.version ?? 'cmpp', resultCode: error instanceof Error ? error.name : 'AUTH_FAILED' }).catch(() => undefined);
+      throw error;
+    }
   }
 
   @Post('inbound/submit')

api/src/send-chain/send-chain.module.ts

@@ -9,9 +9,10 @@ import { AdminSendChainController } from './admin-send-chain.controller';
 import { ClientSendChainController } from './client-send-chain.controller';
 import { GatewayEventsController } from './gateway-events.controller';
 import { SendChainService } from './send-chain.service';
+import { SecurityDetectionModule } from '../security-detection/security-detection.module';
 
 @Module({
-  imports: [PrismaModule, BillingModule, DictionariesModule, forwardRef(() => RiskReviewModule), SmsConfigModule, forwardRef(() => OpenApiModule)],
+  imports: [PrismaModule, BillingModule, DictionariesModule, forwardRef(() => RiskReviewModule), SmsConfigModule, forwardRef(() => OpenApiModule), SecurityDetectionModule],
   controllers: [AdminSendChainController, ClientSendChainController, GatewayEventsController],
   providers: [SendChainService],
   exports: [SendChainService],