add loger, access log and bans/whitelist

internal/config/config.go

@@ -52,6 +52,13 @@ type Config struct {
 	SMTPPassword string
 	SMTPSender   string
 	SMTPUseTLS   bool
+
+	// Security settings (failed-login thresholds and auto-ban config)
+	PwdFailuresThreshold   int
+	MFAFailuresThreshold   int
+	FailuresWindowMinutes  int
+	AutoBanDurationHours   int
+	AutoBanPermanent       bool
 }
 
 var defaultConfig = map[string]map[string]string{
@@ -96,6 +103,13 @@ var defaultConfig = map[string]map[string]string{
 		"SMTP_SENDER":   "",
 		"SMTP_USE_TLS":  "true",
 	},
+	"SECURITY": {
+		"PWD_FAILURES_THRESHOLD":  "5",
+		"MFA_FAILURES_THRESHOLD":  "10",
+		"FAILURES_WINDOW_MINUTES": "30",
+		"AUTO_BAN_DURATION_HOURS": "12",
+		"AUTO_BAN_PERMANENT":      "false",
+	},
 }
 
 func Load() (*Config, error) {
@@ -194,6 +208,14 @@ func Load() (*Config, error) {
 	config.SMTPSender = emailSection.Key("SMTP_SENDER").String()
 	config.SMTPUseTLS, _ = emailSection.Key("SMTP_USE_TLS").Bool()
 
+	// Load SECURITY section
+	secSection := cfg.Section("SECURITY")
+	config.PwdFailuresThreshold, _ = secSection.Key("PWD_FAILURES_THRESHOLD").Int()
+	config.MFAFailuresThreshold, _ = secSection.Key("MFA_FAILURES_THRESHOLD").Int()
+	config.FailuresWindowMinutes, _ = secSection.Key("FAILURES_WINDOW_MINUTES").Int()
+	config.AutoBanDurationHours, _ = secSection.Key("AUTO_BAN_DURATION_HOURS").Int()
+	config.AutoBanPermanent, _ = secSection.Key("AUTO_BAN_PERMANENT").Bool()
+
 	return config, nil
 }
 
@@ -362,6 +384,27 @@ func (c *Config) SaveSetting(section, key, value string) error {
 		case "SMTP_USE_TLS":
 			c.SMTPUseTLS = value == "true"
 		}
+	case "SECURITY":
+		switch key {
+		case "PWD_FAILURES_THRESHOLD":
+			if v, err := strconv.Atoi(value); err == nil {
+				c.PwdFailuresThreshold = v
+			}
+		case "MFA_FAILURES_THRESHOLD":
+			if v, err := strconv.Atoi(value); err == nil {
+				c.MFAFailuresThreshold = v
+			}
+		case "FAILURES_WINDOW_MINUTES":
+			if v, err := strconv.Atoi(value); err == nil {
+				c.FailuresWindowMinutes = v
+			}
+		case "AUTO_BAN_DURATION_HOURS":
+			if v, err := strconv.Atoi(value); err == nil {
+				c.AutoBanDurationHours = v
+			}
+		case "AUTO_BAN_PERMANENT":
+			c.AutoBanPermanent = value == "true"
+		}
 	}
 
 	return cfg.SaveTo(configPath)