large purgatory improvements

2026-05-22 10:12:40 -05:00
parent ce5095ad61
commit eb75f1a49f
7 changed files with 430 additions and 33 deletions
@@ -31,12 +31,32 @@ const autoAcceptModalConfirm = document.getElementById("auto-accept-modal-confir
 const autoAcceptModalCancel = document.getElementById("auto-accept-modal-cancel");
 const autoAcceptModalBackdrop = document.getElementById("auto-accept-modal-backdrop");
 const approveAllBtn = document.getElementById("approve-all-btn");
+const denyAllBtn = document.getElementById("deny-all-btn");
+const unlessSuspiciousToggle = document.getElementById("unless-suspicious-toggle");
+const unlessSuspiciousRow = document.getElementById("unless-suspicious-row");
+const statSuspicious = document.getElementById("stat-suspicious");
+const denyReasonModal = document.getElementById("deny-reason-modal");
+const denyReasonInput = document.getElementById("deny-reason-input");
+const denyReasonModalConfirm = document.getElementById("deny-reason-modal-confirm");
+const denyReasonModalCancel = document.getElementById("deny-reason-modal-cancel");
+const denyReasonModalBackdrop = document.getElementById("deny-reason-modal-backdrop");

 let currentFilter = "pending";
 let searchQuery = "";
 let clients = [];
 const expandedCells = new Set(); // tracks "clientId:field" keys

+const SUSPICIOUS_FLAG_LABELS = {
+  hwid_flood: "HWID Flood (40+ same hardware ID)",
+  hw_flood: "Hardware Flood (40+ identical specs)",
+  no_hostname: "No Hostname",
+  no_user: "No Username",
+  ip_flood: "IP Flood (40+ from same IP recently)",
+  vm_hardware: "VM Detected (CPU/GPU indicates virtual machine)",
+  vm_ram: "VM Likely (≤4 GB round RAM)",
+  no_monitors: "No Monitors (headless/VM)",
+};
+
 // ── API helpers ────────────────────────────────────────────────────
 async function api(path, opts = {}) {
  const res = await fetch(path, { credentials: "include", ...opts });
@@ -48,6 +68,8 @@ async function loadSettings() {
  try {
    const s = await api("/api/enrollment/settings");
    autoAcceptToggle.checked = !s.requireApproval;
+    unlessSuspiciousToggle.checked = !!s.autoApproveUnlessSuspicious;
+    unlessSuspiciousRow.classList.toggle("hidden", !autoAcceptToggle.checked);
  } catch {}
 }

@@ -82,8 +104,9 @@ async function loadClients() {
  emptyEl.classList.add("hidden");
  body.querySelectorAll("tr:not(#enrollment-loading)").forEach((r) => r.remove());

+  const fetchFilter = currentFilter === "suspicious" ? "all" : currentFilter;
  try {
-    const data = await api(`/api/clients?page=1&pageSize=500&enrollmentFilter=${currentFilter}`);
+    const data = await api(`/api/clients?page=1&pageSize=1000&enrollmentFilter=${fetchFilter}`);
    clients = data.items || [];
  } catch {
    clients = [];
@@ -92,19 +115,31 @@ async function loadClients() {
  // Sort by newest first (highest lastSeen = most recent)
  clients.sort((a, b) => (b.lastSeen || 0) - (a.lastSeen || 0));

+  // Update suspicious stat from full loaded set
+  const suspiciousCount = clients.filter((c) => (c.suspiciousFlags || []).length > 0).length;
+  if (statSuspicious) statSuspicious.textContent = suspiciousCount;
+
+  // Apply suspicious tab filter
+  let base = clients;
+  if (currentFilter === "suspicious") {
+    base = clients.filter((c) => (c.suspiciousFlags || []).length > 0);
+  }
+
  // Apply search filter
  const q = searchQuery.toLowerCase().trim();
  const filtered = q
-    ? clients.filter((c) => {
+    ? base.filter((c) => {
        const fields = [c.host, c.user, c.ip, c.id, c.os, c.country, c.keyFingerprint, c.cpu, c.gpu, c.ram];
        return fields.some((f) => f && String(f).toLowerCase().includes(q));
      })
-    : clients;
+    : base;

  loadingRow.classList.add("hidden");

-  const hasPending = currentFilter === "pending" && filtered.some((c) => (c.enrollmentStatus || "pending") === "pending");
-  approveAllBtn.classList.toggle("hidden", !hasPending);
+  const showBulkActions = (currentFilter === "pending" || currentFilter === "suspicious") &&
+    filtered.some((c) => (c.enrollmentStatus || "pending") === "pending");
+  approveAllBtn.classList.toggle("hidden", !showBulkActions);
+  denyAllBtn.classList.toggle("hidden", !showBulkActions);

  if (filtered.length === 0) {
    emptyEl.classList.remove("hidden");
@@ -116,13 +151,13 @@ async function loadClients() {
    tr.className = "hover:bg-slate-800/40 transition-colors";
    tr.dataset.id = c.id;

-    const statusPill = statusBadge(c.enrollmentStatus || "pending");
+    const statusPill = statusBadgeWithReason(c.enrollmentStatus || "pending", c.denyReason);
    const fp = c.keyFingerprint ? c.keyFingerprint.substring(0, 16) + "..." : "-";
    const lastSeen = c.lastSeen ? timeAgo(c.lastSeen) : "-";

    tr.innerHTML = `
      <td class="px-4 py-3"><input type="checkbox" class="row-check h-4 w-4 rounded border-slate-600" data-id="${esc(c.id)}" /></td>
-      <td class="px-4 py-3 text-sm font-medium text-slate-200">${esc(c.host || c.id)}</td>
+      <td class="px-4 py-3 text-sm font-medium text-slate-200">${esc(c.host || c.id)}${suspiciousBadges(c.suspiciousFlags)}</td>
      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.user || "-")}</td>
      <td class="px-4 py-3 text-sm text-slate-400">${esc(c.os || "-")}</td>
      <td class="px-4 py-3 text-sm text-slate-400">${expandableCell(c.id, "cpu", c.cpu)}</td>
@@ -152,6 +187,24 @@ function statusBadge(status) {
  return map[status] || map.pending;
 }

+function statusBadgeWithReason(status, denyReason) {
+  const pill = statusBadge(status);
+  if (status === "denied" && denyReason) {
+    return `<div class="space-y-0.5">${pill}<div class="text-xs text-slate-500 italic max-w-[140px] truncate" title="${esc(denyReason)}">${esc(denyReason)}</div></div>`;
+  }
+  return pill;
+}
+
+function suspiciousBadges(flags) {
+  if (!flags || flags.length === 0) return "";
+  return flags.map((f) => {
+    const label = SUSPICIOUS_FLAG_LABELS[f] || f;
+    const isFlood = f.endsWith("_flood");
+    const color = isFlood ? "bg-red-500/20 text-red-300 border-red-500/40" : "bg-amber-500/20 text-amber-300 border-amber-500/40";
+    return `<span class="inline-flex items-center gap-1 px-1.5 py-0.5 rounded text-xs ${color} border cursor-help" title="${esc(label)}"><i class="fa-solid fa-triangle-exclamation text-[9px]"></i>${esc(label.split(" ")[0])}</span>`;
+  }).join(" ");
+}
+
 function actionButtons(c) {
  const status = c.enrollmentStatus || "pending";
  let html = "";
@@ -217,6 +270,20 @@ async function setStatus(clientId, action) {
  await Promise.all([loadClients(), loadStats()]);
 }

+async function denyClient(clientId, reason) {
+  try {
+    await api(`/api/enrollment/${encodeURIComponent(clientId)}/deny`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason: reason || undefined }),
+    });
+    if (window.showToast) window.showToast("Client denied", "success");
+  } catch (e) {
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+  await Promise.all([loadClients(), loadStats()]);
+}
+
 async function bulkAction(action) {
  const ids = getSelectedIds();
  if (ids.length === 0) return;
@@ -260,6 +327,7 @@ document.querySelectorAll(".enrollment-tab").forEach((tab) => {
      denied: "bg-red-500/20 text-red-300 border-red-500/40",
      approved: "bg-emerald-500/20 text-emerald-300 border-emerald-500/40",
      "banned-ips": "bg-rose-500/20 text-rose-300 border-rose-500/40",
+      suspicious: "bg-orange-500/20 text-orange-300 border-orange-500/40",
    };
    tab.className = `enrollment-tab px-4 py-2 rounded-lg text-sm font-medium ${colorMap[currentFilter] || ""} border`;

@@ -268,6 +336,7 @@ document.querySelectorAll(".enrollment-tab").forEach((tab) => {
      emptyEl.classList.add("hidden");
      bannedIpsSection.classList.remove("hidden");
      approveAllBtn.classList.add("hidden");
+      denyAllBtn.classList.add("hidden");
      loadBannedIps();
    } else {
      bannedIpsSection.classList.add("hidden");
@@ -298,7 +367,7 @@ body.addEventListener("click", (e) => {
  const id = btn.dataset.id;
  if (!id) return;
  if (btn.classList.contains("act-approve")) setStatus(id, "approve");
-  else if (btn.classList.contains("act-deny")) setStatus(id, "deny");
+  else if (btn.classList.contains("act-deny")) showDenyReasonModal(id);
  else if (btn.classList.contains("act-reset")) setStatus(id, "reset");
  else if (btn.classList.contains("act-ban-ip")) banClientIp(id);
 });
@@ -476,6 +545,7 @@ autoAcceptToggle.addEventListener("change", async () => {
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ requireApproval: true }),
      });
+      unlessSuspiciousRow.classList.add("hidden");
      if (window.showToast) window.showToast("Approval required — purgatory is active", "success");
    } catch (e) {
      autoAcceptToggle.checked = true; // revert on error
@@ -500,31 +570,102 @@ autoAcceptModalConfirm.addEventListener("click", async () => {
      body: JSON.stringify({ requireApproval: false }),
    });
    autoAcceptToggle.checked = true;
+    unlessSuspiciousRow.classList.remove("hidden");
    if (window.showToast) window.showToast("Always Allow enabled — agents auto-approved on connect", "success");
  } catch (e) {
    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
  }
 });

-// ── Approve All Pending ────────────────────────────────────────────
+// ── Unless Suspicious sub-toggle ──────────────────────────────────
+unlessSuspiciousToggle.addEventListener("change", async () => {
+  try {
+    await api("/api/enrollment/settings", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ autoApproveUnlessSuspicious: unlessSuspiciousToggle.checked }),
+    });
+    const msg = unlessSuspiciousToggle.checked
+      ? "Suspicious agents will be held for review"
+      : "All agents auto-approved regardless of flags";
+    if (window.showToast) window.showToast(msg, "success");
+  } catch (e) {
+    unlessSuspiciousToggle.checked = !unlessSuspiciousToggle.checked; // revert
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+});
+
+// ── Approve All / Deny All ────────────────────────────────────────
+function getActionablePendingIds() {
+  const base = currentFilter === "suspicious"
+    ? clients.filter((c) => (c.suspiciousFlags || []).length > 0)
+    : clients;
+  return base.filter((c) => (c.enrollmentStatus || "pending") === "pending").map((c) => c.id);
+}
+
 approveAllBtn.addEventListener("click", async () => {
-  const pendingIds = clients
-    .filter((c) => (c.enrollmentStatus || "pending") === "pending")
-    .map((c) => c.id);
-  if (pendingIds.length === 0) return;
+  const ids = getActionablePendingIds();
+  if (ids.length === 0) return;
  try {
    await api("/api/enrollment/bulk", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ids: pendingIds, action: "approve" }),
+      body: JSON.stringify({ ids, action: "approve" }),
    });
-    if (window.showToast) window.showToast(`Approved ${pendingIds.length} client${pendingIds.length !== 1 ? "s" : ""}`, "success");
+    if (window.showToast) window.showToast(`Approved ${ids.length} client${ids.length !== 1 ? "s" : ""}`, "success");
  } catch (e) {
    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
  }
  await Promise.all([loadClients(), loadStats()]);
 });

+denyAllBtn.addEventListener("click", async () => {
+  const ids = getActionablePendingIds();
+  if (ids.length === 0) return;
+  try {
+    await api("/api/enrollment/bulk", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ ids, action: "deny" }),
+    });
+    if (window.showToast) window.showToast(`Denied ${ids.length} client${ids.length !== 1 ? "s" : ""}`, "success");
+  } catch (e) {
+    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
+  }
+  await Promise.all([loadClients(), loadStats()]);
+});
+
+// ── Deny Reason Modal ──────────────────────────────────────────────
+let _denyTargetId = null;
+
+function showDenyReasonModal(clientId) {
+  _denyTargetId = clientId;
+  denyReasonInput.value = "";
+  denyReasonModal.classList.remove("hidden");
+  setTimeout(() => denyReasonInput.focus(), 50);
+}
+
+function closeDenyReasonModal() {
+  denyReasonModal.classList.add("hidden");
+  _denyTargetId = null;
+}
+
+denyReasonModalCancel.addEventListener("click", closeDenyReasonModal);
+denyReasonModalBackdrop.addEventListener("click", closeDenyReasonModal);
+
+denyReasonInput.addEventListener("keydown", (e) => {
+  if (e.key === "Enter") denyReasonModalConfirm.click();
+  if (e.key === "Escape") closeDenyReasonModal();
+});
+
+denyReasonModalConfirm.addEventListener("click", async () => {
+  const id = _denyTargetId;
+  const reason = denyReasonInput.value.trim() || undefined;
+  closeDenyReasonModal();
+  if (!id) return;
+  await denyClient(id, reason);
+});
+
 // ── Init ───────────────────────────────────────────────────────────
 loadSettings();
 loadStats();
@@ -36,16 +36,28 @@
              <span class="text-amber-400"><i class="fa-solid fa-clock mr-1"></i><span id="stat-pending">0</span> pending</span>
              <span class="text-emerald-400"><i class="fa-solid fa-check mr-1"></i><span id="stat-approved">0</span> approved</span>
              <span class="text-red-400"><i class="fa-solid fa-ban mr-1"></i><span id="stat-denied">0</span> denied</span>
+              <span class="text-orange-400"><i class="fa-solid fa-triangle-exclamation mr-1"></i><span id="stat-suspicious">0</span> suspicious</span>
              <span class="text-rose-400"><i class="fa-solid fa-shield-halved mr-1"></i><span id="stat-banned-ips">0</span> banned IPs</span>
            </div>
-            <div class="flex items-center gap-2 border border-amber-500/30 rounded-lg px-3 py-2 bg-amber-500/5 text-sm" title="When enabled, all connecting agents are approved automatically without review">
-              <i class="fa-solid fa-door-open text-amber-400"></i>
-              <span class="text-slate-300 font-medium">Always Allow</span>
-              <label class="relative inline-flex items-center cursor-pointer ml-1">
-                <input type="checkbox" id="auto-accept-toggle" class="sr-only peer" />
-                <div class="w-9 h-5 bg-slate-700 peer-checked:bg-amber-500 rounded-full transition-colors"></div>
-                <div class="absolute left-0.5 top-0.5 w-4 h-4 bg-white rounded-full transition-transform peer-checked:translate-x-4"></div>
-              </label>
+            <div class="flex flex-col gap-1 border border-amber-500/30 rounded-lg px-3 py-2 bg-amber-500/5 text-sm">
+              <div class="flex items-center gap-2" title="When enabled, all connecting agents are approved automatically without review">
+                <i class="fa-solid fa-door-open text-amber-400"></i>
+                <span class="text-slate-300 font-medium">Always Allow</span>
+                <label class="relative inline-flex items-center cursor-pointer ml-1">
+                  <input type="checkbox" id="auto-accept-toggle" class="sr-only peer" />
+                  <div class="w-9 h-5 bg-slate-700 peer-checked:bg-amber-500 rounded-full transition-colors"></div>
+                  <div class="absolute left-0.5 top-0.5 w-4 h-4 bg-white rounded-full transition-transform peer-checked:translate-x-4"></div>
+                </label>
+              </div>
+              <div id="unless-suspicious-row" class="hidden flex items-center gap-2 pl-1" title="Still quarantine agents that look suspicious (HWID flood, IP flood, no hostname, etc.)">
+                <i class="fa-solid fa-shield-halved text-slate-500 text-xs"></i>
+                <span class="text-slate-400 text-xs">Unless suspicious</span>
+                <label class="relative inline-flex items-center cursor-pointer">
+                  <input type="checkbox" id="unless-suspicious-toggle" class="sr-only peer" />
+                  <div class="w-7 h-4 bg-slate-700 peer-checked:bg-emerald-600 rounded-full transition-colors"></div>
+                  <div class="absolute left-0.5 top-0.5 w-3 h-3 bg-white rounded-full transition-transform peer-checked:translate-x-3"></div>
+                </label>
+              </div>
            </div>
          </div>
        </div>
@@ -68,10 +80,18 @@
            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700">
            <i class="fa-solid fa-shield-halved mr-1"></i>Banned IPs
          </button>
+          <button data-filter="suspicious"
+            class="enrollment-tab px-4 py-2 rounded-lg text-sm font-medium bg-slate-800 text-slate-400 border border-slate-700 hover:bg-slate-700">
+            <i class="fa-solid fa-triangle-exclamation mr-1"></i>Suspicious
+          </button>
          <div class="flex-1"></div>
          <button id="approve-all-btn"
            class="hidden px-3 py-2 rounded-lg text-sm font-medium bg-emerald-700 hover:bg-emerald-800 text-white transition-colors">
-            <i class="fa-solid fa-check-double mr-1"></i>Approve All Pending
+            <i class="fa-solid fa-check-double mr-1"></i>Approve All
+          </button>
+          <button id="deny-all-btn"
+            class="hidden px-3 py-2 rounded-lg text-sm font-medium bg-red-700 hover:bg-red-800 text-white transition-colors">
+            <i class="fa-solid fa-ban mr-1"></i>Deny All
          </button>
          <div class="relative">
            <i class="fa-solid fa-search absolute left-3 top-1/2 -translate-y-1/2 text-slate-500 text-sm pointer-events-none"></i>
@@ -212,6 +232,37 @@
      </div>
    </div>

+    <!-- Deny Reason Modal -->
+    <div id="deny-reason-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center">
+      <div class="absolute inset-0 bg-black/60 backdrop-blur-sm" id="deny-reason-modal-backdrop"></div>
+      <div class="relative bg-slate-900 border border-red-500/40 rounded-2xl shadow-2xl max-w-md w-full mx-4 p-6">
+        <div class="flex items-center gap-3 mb-4">
+          <div class="flex-shrink-0 w-12 h-12 rounded-full bg-red-500/20 flex items-center justify-center">
+            <i class="fa-solid fa-ban text-red-400 text-xl"></i>
+          </div>
+          <div>
+            <h3 class="text-lg font-bold text-slate-100">Deny Client</h3>
+            <p class="text-sm text-slate-400">Optionally record a reason for audit purposes.</p>
+          </div>
+        </div>
+        <div class="mb-5">
+          <label class="block text-sm font-medium text-slate-300 mb-1">Reason <span class="text-slate-500 font-normal">(optional)</span></label>
+          <input type="text" id="deny-reason-input" maxlength="200" placeholder="Suspicious activity, unauthorized machine..."
+            class="w-full px-3 py-2 rounded-lg text-sm bg-slate-800 border border-slate-700 text-slate-200 placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-red-500 focus:border-transparent" />
+        </div>
+        <div class="flex items-center justify-end gap-3">
+          <button id="deny-reason-modal-cancel"
+            class="px-4 py-2 rounded-lg text-sm font-medium bg-slate-700 hover:bg-slate-600 text-white transition-colors">
+            Cancel
+          </button>
+          <button id="deny-reason-modal-confirm"
+            class="px-4 py-2 rounded-lg text-sm font-medium bg-red-600 hover:bg-red-700 text-white transition-colors">
+            <i class="fa-solid fa-ban mr-1"></i>Deny
+          </button>
+        </div>
+      </div>
+    </div>
+
    <!-- Always Allow Warning Modal -->
    <div id="auto-accept-modal" class="hidden fixed inset-0 z-50 flex items-center justify-center">
      <div class="absolute inset-0 bg-black/60 backdrop-blur-sm" id="auto-accept-modal-backdrop"></div>
@@ -58,6 +58,7 @@ export interface Config {
  };
  enrollment: {
    requireApproval: boolean;
+    autoApproveUnlessSuspicious: boolean;
  };
  appearance: {
    customCSS: string;
@@ -142,6 +143,7 @@ const DEFAULT_CONFIG: Config = {
  },
  enrollment: {
    requireApproval: true,
+    autoApproveUnlessSuspicious: false,
  },
  appearance: {
    customCSS: "",
@@ -510,6 +512,8 @@ export function loadConfig(): Config {
        process.env.OVERLORD_ENROLLMENT_REQUIRE_APPROVAL !== undefined
          ? String(process.env.OVERLORD_ENROLLMENT_REQUIRE_APPROVAL).toLowerCase() === "true"
          : (fileConfig.enrollment?.requireApproval ?? DEFAULT_CONFIG.enrollment.requireApproval),
+      autoApproveUnlessSuspicious:
+        fileConfig.enrollment?.autoApproveUnlessSuspicious ?? DEFAULT_CONFIG.enrollment.autoApproveUnlessSuspicious,
    },
    appearance: {
      customCSS: fileConfig.appearance?.customCSS || DEFAULT_CONFIG.appearance.customCSS,
@@ -693,6 +697,7 @@ export async function updateEnrollmentConfig(
    ...current.enrollment,
    ...updates,
    requireApproval: updates.requireApproval !== undefined ? Boolean(updates.requireApproval) : current.enrollment.requireApproval,
+    autoApproveUnlessSuspicious: updates.autoApproveUnlessSuspicious !== undefined ? Boolean(updates.autoApproveUnlessSuspicious) : current.enrollment.autoApproveUnlessSuspicious,
  };

  configCache = {
@@ -133,6 +133,9 @@ try {
 try {
  db.run(`ALTER TABLE clients ADD COLUMN notifications_muted INTEGER NOT NULL DEFAULT 0`);
 } catch {}
+try {
+  db.run(`ALTER TABLE clients ADD COLUMN deny_reason TEXT`);
+} catch {}

 db.run(`
  CREATE TABLE IF NOT EXISTS client_groups (
@@ -1011,6 +1014,155 @@ export function markAllClientsOffline() {
  console.log("[db] marked all clients as offline");
 }

+export const SUSPICIOUS_FLOOD_THRESHOLD = Math.max(2, Number(process.env.OVERLORD_SUSPICIOUS_FLOOD_THRESHOLD || 40));
+const SUSPICIOUS_IP_FLOOD_WINDOW_MS = Math.max(60_000, Number(process.env.OVERLORD_SUSPICIOUS_IP_WINDOW_MS || 300_000));
+
+export function getFloodedHwids(threshold = SUSPICIOUS_FLOOD_THRESHOLD): Set<string> {
+  const rows = db
+    .query<{ hwid: string }>(
+      `SELECT hwid FROM clients WHERE hwid IS NOT NULL AND hwid != '' GROUP BY hwid HAVING COUNT(*) >= ?`,
+    )
+    .all(threshold);
+  return new Set(rows.map((r) => r.hwid));
+}
+
+export function getFloodedHardware(threshold = SUSPICIOUS_FLOOD_THRESHOLD): Set<string> {
+  const rows = db
+    .query<{ cpu: string; gpu: string; ram: string; os: string }>(
+      `SELECT cpu, gpu, ram, os FROM clients
+       WHERE cpu IS NOT NULL AND cpu != '' AND os IS NOT NULL AND os != ''
+       GROUP BY cpu, gpu, ram, os HAVING COUNT(*) >= ?`,
+    )
+    .all(threshold);
+  const keys = new Set<string>();
+  for (const r of rows) keys.add(`${r.cpu}|${r.gpu ?? ""}|${r.ram ?? ""}|${r.os}`);
+  return keys;
+}
+
+export function getFloodedIps(threshold = SUSPICIOUS_FLOOD_THRESHOLD): Set<string> {
+  const since = Date.now() - SUSPICIOUS_IP_FLOOD_WINDOW_MS;
+  const rows = db
+    .query<{ ip: string }>(
+      `SELECT ip FROM clients WHERE ip IS NOT NULL AND ip != '' AND last_seen > ? GROUP BY ip HAVING COUNT(*) >= ?`,
+    )
+    .all(since, threshold);
+  return new Set(rows.map((r) => r.ip));
+}
+
+const FLOOD_CACHE_TTL_MS = 30_000;
+let _floodCacheTs = 0;
+let _cachedFloodedHwids: Set<string> | null = null;
+let _cachedFloodedHardware: Set<string> | null = null;
+let _cachedFloodedIps: Set<string> | null = null;
+
+function getFloodSetsWithCache(): { floodedHwids: Set<string>; floodedHardware: Set<string>; floodedIps: Set<string> } {
+  const now = Date.now();
+  if (now - _floodCacheTs > FLOOD_CACHE_TTL_MS) {
+    _cachedFloodedHwids = getFloodedHwids();
+    _cachedFloodedHardware = getFloodedHardware();
+    _cachedFloodedIps = getFloodedIps();
+    _floodCacheTs = now;
+  }
+  return { floodedHwids: _cachedFloodedHwids!, floodedHardware: _cachedFloodedHardware!, floodedIps: _cachedFloodedIps! };
+}
+
+function parseRamGb(ram: string | null | undefined): number | null {
+  if (!ram) return null;
+  const m = ram.match(/(\d+(?:\.\d+)?)\s*(tb|gb|mb|kb)/i);
+  if (!m) return null;
+  const val = parseFloat(m[1]);
+  const unit = m[2].toLowerCase();
+  if (unit === "tb") return val * 1024;
+  if (unit === "gb") return val;
+  if (unit === "mb") return val / 1024;
+  if (unit === "kb") return val / (1024 * 1024);
+  return null;
+}
+
+export type SuspiciousFlags = string[];
+
+const VM_CPU_PATTERNS = [
+  /\bqemu\b/i,
+  /\bkvm\b/i,
+  /\bvmware\b/i,
+  /\bvirtualbox\b/i,
+  /virtual\s+cpu/i,
+  /\bhyper-v\b/i,
+  /\bbochs\b/i,
+  /\bxen\b/i,
+];
+
+const VM_GPU_PATTERNS = [
+  /vmware/i,
+  /virtualbox/i,
+  /\bqemu\b/i,
+  /microsoft\s+basic\s+(render|display)/i,
+  /cirrus\s+logic/i,
+  /standard\s+vga/i,
+  /\bllvmpipe\b/i,
+  /\bsoftpipe\b/i,
+  /\bqxl\b/i,
+  /\bvirtio\b/i,
+  /hyper-v\s+video/i,
+  /terminal\s+server/i,
+  /remote\s+desktop/i,
+  /parsec\s+display/i,
+];
+
+export function computeClientSuspiciousFlags(
+  client: {
+    id?: string;
+    hwid?: string | null;
+    cpu?: string | null;
+    gpu?: string | null;
+    ram?: string | null;
+    os?: string | null;
+    host?: string | null;
+    user?: string | null;
+    ip?: string | null;
+    monitors?: number | null;
+  },
+  precomputed?: {
+    floodedHwids?: Set<string>;
+    floodedHardware?: Set<string>;
+    floodedIps?: Set<string>;
+  },
+): SuspiciousFlags {
+  const flags: string[] = [];
+  const allProvided = precomputed?.floodedHwids !== undefined && precomputed?.floodedHardware !== undefined && precomputed?.floodedIps !== undefined;
+  const sets = allProvided ? (precomputed as Required<typeof precomputed>) : getFloodSetsWithCache();
+  const fHwids = sets.floodedHwids;
+  const fHardware = sets.floodedHardware;
+  const fIps = sets.floodedIps;
+
+  if (client.hwid && fHwids.has(client.hwid)) flags.push("hwid_flood");
+
+  if (client.cpu && client.os) {
+    const hwKey = `${client.cpu}|${client.gpu ?? ""}|${client.ram ?? ""}|${client.os}`;
+    if (fHardware.has(hwKey)) flags.push("hw_flood");
+  }
+
+  if (!client.host || !client.host.trim()) flags.push("no_hostname");
+  if (!client.user || !client.user.trim()) flags.push("no_user");
+
+  if (client.ip && fIps.has(client.ip)) flags.push("ip_flood");
+
+  const cpuIsVm = !!client.cpu && VM_CPU_PATTERNS.some((p) => p.test(client.cpu!));
+  const gpuIsVm = !!client.gpu && VM_GPU_PATTERNS.some((p) => p.test(client.gpu!));
+  if (cpuIsVm || gpuIsVm) flags.push("vm_hardware");
+
+  const ramGb = parseRamGb(client.ram);
+  if (ramGb !== null && [0.25, 0.5, 1, 2, 4].some((s) => Math.abs(ramGb - s) < 0.05)) {
+    flags.push("vm_ram");
+  }
+
+  if (typeof client.monitors === "number" && client.monitors === 0) {
+    flags.push("no_monitors");
+  }
+
+  return flags;
+}
+
 export function listClients(filters: ListFilters): ListResult {
  const {
    page,
@@ -1141,7 +1293,7 @@ export function listClients(filters: ListFilters): ListResult {

  const rows = db
    .query<any>(
-      `SELECT c.id, c.hwid, c.role, c.ip, c.host, c.os, c.arch, c.version, c.user, c.nickname, c.custom_tag as customTag, c.custom_tag_note as customTagNote, c.monitors, c.country, c.last_seen as lastSeen, c.online, c.ping_ms as pingMs, c.bookmarked, c.build_tag as buildTag, c.built_by_user_id as builtByUserId, c.enrollment_status as enrollmentStatus, c.public_key as publicKey, c.key_fingerprint as keyFingerprint, c.cpu, c.gpu, c.ram, c.is_admin as isAdmin, c.elevation, c.permissions, c.disconnect_reason as disconnectReason, c.disconnect_detail as disconnectDetail, c.group_id as groupId, g.name as groupName, g.color as groupColor, c.notifications_muted as notificationsMuted
+      `SELECT c.id, c.hwid, c.role, c.ip, c.host, c.os, c.arch, c.version, c.user, c.nickname, c.custom_tag as customTag, c.custom_tag_note as customTagNote, c.monitors, c.country, c.last_seen as lastSeen, c.online, c.ping_ms as pingMs, c.bookmarked, c.build_tag as buildTag, c.built_by_user_id as builtByUserId, c.enrollment_status as enrollmentStatus, c.public_key as publicKey, c.key_fingerprint as keyFingerprint, c.cpu, c.gpu, c.ram, c.is_admin as isAdmin, c.elevation, c.permissions, c.disconnect_reason as disconnectReason, c.disconnect_detail as disconnectDetail, c.group_id as groupId, g.name as groupName, g.color as groupColor, c.notifications_muted as notificationsMuted, c.deny_reason as denyReason
       FROM clients c
       LEFT JOIN client_groups g ON g.id = c.group_id
       ${whereSql}
@@ -1150,6 +1302,8 @@ export function listClients(filters: ListFilters): ListResult {
    )
    .all(...params, pageSize, offset);

+  const { floodedHwids, floodedHardware, floodedIps } = getFloodSetsWithCache();
+
  const items = rows.map((c: any) => ({
    id: c.id,
    hwid: c.hwid,
@@ -1186,8 +1340,10 @@ export function listClients(filters: ListFilters): ListResult {
    groupName: c.groupName || null,
    groupColor: c.groupColor || null,
    notificationsMuted: c.notificationsMuted === 1,
+    denyReason: c.denyReason || null,
    hasThumbnail: hasThumbnail(c.id),
    thumbnailVersion: getThumbnailVersion(c.id),
+    suspiciousFlags: computeClientSuspiciousFlags(c, { floodedHwids, floodedHardware, floodedIps }),
  }));

  return { page, pageSize, total: totalRow.c, online: onlineRow.c, items };
@@ -1974,12 +2130,14 @@ export function setClientEnrollmentStatus(
  id: string,
  status: "approved" | "denied" | "pending",
  approvedBy?: string,
+  denyReason?: string,
 ): boolean {
  const result = db.run(
-    `UPDATE clients SET enrollment_status=?, enrolled_at=?, enrolled_by=? WHERE id=?`,
+    `UPDATE clients SET enrollment_status=?, enrolled_at=?, enrolled_by=?, deny_reason=? WHERE id=?`,
    status,
    status === "approved" ? Date.now() : null,
    status === "approved" ? (approvedBy ?? null) : null,
+    status === "denied" ? (denyReason ?? null) : null,
    id,
  );
  return ((result as any)?.changes || 0) > 0;
@@ -111,6 +111,7 @@ export async function handleEnrollmentRoutes(
    const config = getConfig();
    return Response.json({
      requireApproval: config.enrollment?.requireApproval ?? true,
+      autoApproveUnlessSuspicious: config.enrollment?.autoApproveUnlessSuspicious ?? false,
    });
  }

@@ -123,11 +124,15 @@ export async function handleEnrollmentRoutes(
    let body: any;
    try { body = await req.json(); } catch { return Response.json({ error: "Invalid JSON" }, { status: 400 }); }

-    if (typeof body?.requireApproval !== "boolean") {
-      return Response.json({ error: "requireApproval must be a boolean" }, { status: 400 });
+    const updates: { requireApproval?: boolean; autoApproveUnlessSuspicious?: boolean } = {};
+    if (typeof body?.requireApproval === "boolean") updates.requireApproval = body.requireApproval;
+    if (typeof body?.autoApproveUnlessSuspicious === "boolean") updates.autoApproveUnlessSuspicious = body.autoApproveUnlessSuspicious;
+
+    if (Object.keys(updates).length === 0) {
+      return Response.json({ error: "No valid boolean fields provided" }, { status: 400 });
    }

-    const updated = await updateEnrollmentConfig({ requireApproval: body.requireApproval });
+    const updated = await updateEnrollmentConfig(updates);

    logAudit({
      timestamp: Date.now(),
@@ -135,10 +140,10 @@ export async function handleEnrollmentRoutes(
      ip: "server",
      action: AuditAction.ENROLLMENT_SETTINGS,
      success: true,
-      details: JSON.stringify({ requireApproval: body.requireApproval }),
+      details: JSON.stringify(updates),
    });

-    return Response.json({ ok: true, requireApproval: updated.requireApproval });
+    return Response.json({ ok: true, requireApproval: updated.requireApproval, autoApproveUnlessSuspicious: updated.autoApproveUnlessSuspicious });
  }

  // POST /api/enrollment/:id/approve
@@ -200,7 +205,11 @@ export async function handleEnrollmentRoutes(
      return new Response("Forbidden: Client access denied", { status: 403 });
    }

-    setClientEnrollmentStatus(clientId, "denied");
+    let denyBody: any = {};
+    try { denyBody = await req.json(); } catch {}
+    const denyReason = typeof denyBody?.reason === "string" ? denyBody.reason.slice(0, 200).trim() || undefined : undefined;
+
+    setClientEnrollmentStatus(clientId, "denied", undefined, denyReason);

    logAudit({
      timestamp: Date.now(),
@@ -296,6 +305,7 @@ export async function handleEnrollmentRoutes(
      return Response.json({ ok: true, action, updated: banned });
    }

+    const bulkDenyReason = typeof body?.reason === "string" ? body.reason.slice(0, 200).trim() || undefined : undefined;
    const status = action === "approve" ? "approved" : action === "deny" ? "denied" : "pending";
    let updated = 0;
    for (const id of ids) {
@@ -304,6 +314,7 @@ export async function handleEnrollmentRoutes(
        id,
        status as "approved" | "denied" | "pending",
        action === "approve" ? user.username : undefined,
+        action === "deny" ? bulkDenyReason : undefined,
      );
      if (ok) {
        updated++;
@@ -9,7 +9,8 @@ async function getGeoip() {
 }
 import { logAudit, AuditAction } from "../../auditLog";
 import * as clientManager from "../../clientManager";
-import { clientExists, setOnlineState, upsertClientRow, getClientEnrollmentStatus, setClientEnrollmentStatus, lookupClientByPublicKey, getClientPublicKeyById, getBuildByTag } from "../../db";
+import { clientExists, setOnlineState, upsertClientRow, getClientEnrollmentStatus, setClientEnrollmentStatus, lookupClientByPublicKey, getClientPublicKeyById, getBuildByTag, computeClientSuspiciousFlags } from "../../db";
+import { getConfig } from "../../config";
 import { logger } from "../../logger";
 import { metrics } from "../../metrics";
 import { decodeMessage, encodeMessage, type WireMessage, type Hello, type Ping } from "../../protocol";
@@ -419,6 +420,33 @@ export async function handleWebSocketMessage(
        }

        if (enrollmentStatus === "pending") {
+          const enrollConfig = getConfig().enrollment;
+
+          if (!enrollConfig.requireApproval) {
+            let blocked = false;
+            if (enrollConfig.autoApproveUnlessSuspicious) {
+              const flags = computeClientSuspiciousFlags({
+                hwid: typeof (payload as any).hwid === "string" ? (payload as any).hwid : null,
+                cpu: typeof (payload as any).cpu === "string" ? (payload as any).cpu : null,
+                gpu: typeof (payload as any).gpu === "string" ? (payload as any).gpu : null,
+                ram: typeof (payload as any).ram === "string" ? (payload as any).ram : null,
+                os: typeof (payload as any).os === "string" ? (payload as any).os : null,
+                host: typeof (payload as any).host === "string" ? (payload as any).host : null,
+                user: typeof (payload as any).user === "string" ? (payload as any).user : null,
+                ip: ip || null,
+              });
+              if (flags.length > 0) {
+                blocked = true;
+                logger.info(`[purgatory] auto-approve blocked for ${resolvedId} — suspicious: ${flags.join(", ")}`);
+              }
+            }
+            if (!blocked) {
+              enrollmentStatus = "approved";
+              logger.info(`[purgatory] auto-approved ${resolvedId} (requireApproval=false)`);
+            }
+          }
+
+          if (enrollmentStatus !== "approved") {
          const geoip = await getGeoip();
          const geo = ip ? geoip.lookup(ip) : undefined;
          const countryRaw = geo?.country || (payload as any).country || "ZZ";
@@ -476,6 +504,7 @@ export async function handleWebSocketMessage(
          }
          setTimeout(() => { try { ws.close(4001, "pending"); } catch {} }, 100);
          return;
+          }
        }

        const existingClient = clientManager.getClient(resolvedId);
@@ -73,6 +73,8 @@ export type ListItem = Omit<ClientInfo, 'ws'> & {
  online: boolean;
  hasThumbnail: boolean;
  thumbnailVersion: number;
+  suspiciousFlags: string[];
+  denyReason?: string | null;
 };

 export type ListResult = {