Login-Sicherheit: Account-Lockout, konfigurierbar, Admin-Verwaltung, .env für JWT-Secret

backend/src/routes/admin.js

@@ -93,4 +93,51 @@ router.put('/users/:id/reset-password', authenticate, requireAdmin, (req, res) =
   res.json({ success: true });
 });
 
+// ── Login-Sicherheit Admin-Endpoints ─────────────────────────────────────────
+
+const getSetting = k => db.prepare('SELECT value FROM admin_settings WHERE key=?').get(k)?.value;
+
+// GET gesperrte Konten
+router.get('/lockouts', authenticate, requireAdmin, (req, res) => {
+  const locked = db.prepare(`
+    SELECT id, username, failed_attempts, locked_until, last_failed_at
+    FROM users
+    WHERE locked_until IS NOT NULL
+    ORDER BY locked_until DESC
+  `).all();
+  res.json(locked);
+});
+
+// DELETE Sperre aufheben
+router.delete('/lockouts/:userId', authenticate, requireAdmin, (req, res) => {
+  db.prepare('UPDATE users SET failed_attempts=0, locked_until=NULL, last_failed_at=NULL WHERE id=?')
+    .run(req.params.userId);
+  res.json({ ok: true });
+});
+
+// GET Login-Einstellungen
+router.get('/security-settings', authenticate, requireAdmin, (req, res) => {
+  res.json({
+    login_max_attempts:    getSetting('login_max_attempts')    || '5',
+    login_lockout_minutes: getSetting('login_lockout_minutes') || '30',
+  });
+});
+
+// PUT Login-Einstellungen
+router.put('/security-settings', authenticate, requireAdmin, (req, res) => {
+  const { login_max_attempts, login_lockout_minutes } = req.body;
+  for (const [k, v] of [['login_max_attempts', login_max_attempts], ['login_lockout_minutes', login_lockout_minutes]]) {
+    if (v !== undefined)
+      db.prepare('INSERT OR REPLACE INTO admin_settings (key, value) VALUES (?, ?)').run(k, String(parseInt(v) || 0));
+  }
+  res.json({ ok: true });
+});
+
+// GET Login-Verlauf (letzte 50)
+router.get('/login-log', authenticate, requireAdmin, (req, res) => {
+  res.json(db.prepare(`
+    SELECT * FROM login_attempts ORDER BY created_at DESC LIMIT 50
+  `).all());
+});
+
 module.exports = router;