Nachrichten: Senden-Button entfernt, Login-Sicherheit: IPs bei Lockout, Attempts-Bereinigung

backend/src/routes/admin.js

@@ -97,7 +97,7 @@ router.put('/users/:id/reset-password', authenticate, requireAdmin, (req, res) =
 
 const getSetting = k => db.prepare('SELECT value FROM admin_settings WHERE key=?').get(k)?.value;
 
-// GET gesperrte Konten
+// GET gesperrte Konten mit IPs
 router.get('/lockouts', authenticate, requireAdmin, (req, res) => {
   const locked = db.prepare(`
     SELECT id, username, failed_attempts, locked_until, last_failed_at
@@ -105,11 +105,25 @@ router.get('/lockouts', authenticate, requireAdmin, (req, res) => {
     WHERE locked_until IS NOT NULL
     ORDER BY locked_until DESC
   `).all();
-  res.json(locked);
+
+  // IPs aus login_attempts hinzufügen
+  const result = locked.map(u => {
+    const ips = db.prepare(`
+      SELECT DISTINCT ip FROM login_attempts
+      WHERE username=? AND success=0
+      ORDER BY created_at DESC LIMIT 10
+    `).all(u.username).map(r => r.ip).filter(Boolean);
+    return { ...u, ips };
+  });
+  res.json(result);
 });
 
-// DELETE Sperre aufheben
+// DELETE Sperre aufheben + Login-Versuche löschen
 router.delete('/lockouts/:userId', authenticate, requireAdmin, (req, res) => {
+  const user = db.prepare('SELECT username FROM users WHERE id=?').get(req.params.userId);
+  if (user) {
+    db.prepare('DELETE FROM login_attempts WHERE username=?').run(user.username);
+  }
   db.prepare('UPDATE users SET failed_attempts=0, locked_until=NULL, last_failed_at=NULL WHERE id=?')
     .run(req.params.userId);
   res.json({ ok: true });