has logged ip for anonym and auth users

app/rest/api/middleware.go

@@ -85,7 +85,7 @@ const maxBody = 1024
 var reMultWhtsp = regexp.MustCompile(`[\s\p{Zs}]{2,}`)
 
 // Logger middleware prints http log. Customized by set of LoggerFlag
-func Logger(flags ...LoggerFlag) func(http.Handler) http.Handler {
+func Logger(ipFn func(ip string) string, flags ...LoggerFlag) func(http.Handler) http.Handler {
 
 	f := func(h http.Handler) http.Handler {
 
@@ -111,6 +111,9 @@ func Logger(flags ...LoggerFlag) func(http.Handler) http.Handler {
 				if strings.HasPrefix(r.RemoteAddr, "[") {
 					remoteIP = strings.Split(r.RemoteAddr, "]:")[0] + "]"
 				}
+				if ipFn != nil {
+					remoteIP = ipFn(remoteIP)
+				}
 
 				log.Printf("[INFO] REST %s - %s - %s - %d (%d) - %v %s %s",
 					r.Method, q, remoteIP, ww.Status(), ww.BytesWritten(), t2.Sub(t1), user, body)

app/rest/api/migrator.go

@@ -68,7 +68,7 @@ func (m *Migrator) routes() chi.Router {
 	router.Use(middleware.RealIP, Recoverer)
 	router.Use(middleware.Throttle(1000), middleware.Timeout(15*time.Minute))
 	router.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
-	router.Use(AppInfo("remark42-migrator", m.Version), Ping, Logger(LogAll))
+	router.Use(AppInfo("remark42-migrator", m.Version), Ping, Logger(nil, LogAll))
 	router.Post("/api/v1/admin/import", m.importCtrl)
 	router.Get("/api/v1/admin/export", m.exportCtrl)
 	return router

app/rest/api/rest.go

@@ -108,9 +108,11 @@ func (s *Rest) routes() chi.Router {
 		cache:       s.Cache,
 	}
 
+	ipFn := func(ip string) string { return store.HashValue(ip, s.DataService.Secret)[:8] }
+
 	// auth routes for all providers
 	router.Route("/auth", func(r chi.Router) {
-		r.Use(Logger(LogAll), tollbooth_chi.LimitHandler(tollbooth.NewLimiter(5, nil)))
+		r.Use(Logger(ipFn, LogAll), tollbooth_chi.LimitHandler(tollbooth.NewLimiter(5, nil)))
 		for _, provider := range s.Authenticator.Providers {
 			r.Mount("/"+provider.Name, provider.Routes()) // mount auth providers as /auth/{name}
 		}
@@ -121,7 +123,7 @@ func (s *Rest) routes() chi.Router {
 	})
 
 	avatarMiddlewares := []func(http.Handler) http.Handler{
-		Logger(LogNone),
+		Logger(ipFn, LogNone),
 		tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)),
 	}
 	router.Mount(s.AvatarProxy.Routes(avatarMiddlewares...)) // mount avatars to /api/v1/avatar/{file.img}
@@ -133,7 +135,7 @@ func (s *Rest) routes() chi.Router {
 		// open routes
 		rapi.Group(func(ropen chi.Router) {
 			ropen.Use(s.Authenticator.Auth(false))
-			ropen.Use(Logger(LogAll))
+			ropen.Use(Logger(ipFn, LogAll))
 			ropen.Get("/find", s.findCommentsCtrl)
 			ropen.Get("/id/{id}", s.commentByIDCtrl)
 			ropen.Get("/comments", s.findUserCommentsCtrl)
@@ -152,14 +154,14 @@ func (s *Rest) routes() chi.Router {
 		// protected routes, require auth
 		rapi.Group(func(rauth chi.Router) {
 			rauth.Use(s.Authenticator.Auth(true))
-			rauth.Use(Logger(LogAll))
+			rauth.Use(Logger(ipFn, LogAll))
 			rauth.Post("/comment", s.createCommentCtrl)
 			rauth.Put("/comment/{id}", s.updateCommentCtrl)
 			rauth.Get("/user", s.userInfoCtrl)
 			rauth.Put("/vote/{id}", s.voteCtrl)
 
 			// admin routes, admin users only
-			rauth.Mount("/admin", s.adminService.routes(s.Authenticator.AdminOnly, Logger(LogAll)))
+			rauth.Mount("/admin", s.adminService.routes(s.Authenticator.AdminOnly, Logger(nil, LogAll)))
 		})
 	})
 

app/store/user.go

@@ -24,20 +24,20 @@ var reValidSha = regexp.MustCompile("^[a-fA-F0-9]{40}$")
 
 // HashIP replace IP field with hashed hmac
 func (u *User) HashIP(secret string) {
+	u.IP = HashValue(u.IP, secret)
+}
 
-	hashVal := func(val string) string {
-		if val == "" || reValidSha.Match([]byte(val)) {
-			return val // already hashed or empty
-		}
-		key := []byte(secret)
-		h := hmac.New(sha1.New, key)
-		if _, err := h.Write([]byte(val)); err != nil {
-			log.Printf("[WARN] can't hash ip, %s", err)
-		}
-		return fmt.Sprintf("%x", h.Sum(nil))
+// HashValue makes hmac with secret
+func HashValue(val string, secret string) string {
+	if val == "" || reValidSha.Match([]byte(val)) {
+		return val // already hashed or empty
 	}
-
-	u.IP = hashVal(u.IP)
+	key := []byte(secret)
+	h := hmac.New(sha1.New, key)
+	if _, err := h.Write([]byte(val)); err != nil {
+		log.Printf("[WARN] can't hash ip, %s", err)
+	}
+	return fmt.Sprintf("%x", h.Sum(nil))
 }
 
 // EncodeID hashes id to sha1. The function intentionally left outside of User struct because in some cases