# Full Code Review — IP WhiteList App

> **Задача для Claude Opus:** Провести полный анализ проекта по коду ниже.
> **Сохрани результат** в файл `/home/naeel/ipwhitelist-app/research/opus-full-review-2026-05-30.md` —
> это важно, используй инструмент создания файлов.

---

## Контекст проекта

**Стек:** Node.js + Express 4 + EJS + PostgreSQL (`pg` pool)  
**Цель:** Веб-сервис для управления IP white-list компаний. Компании добавляют публичные IPv4/CIDR в список; список агрегируется и экспортируется для настройки оборудования.  
**Аудитория:** Используется клиентами облачного провайдера Nubes (РФ). Данные изолированы по company.  
**Авторизация:** Keycloak Authorization Code Flow (реализован, но не активирован — нет KC credentials). Сейчас работает в mock-режиме с `express-session`.  
**Ветка:** `sonnet`, 2026-05-30 14:43  

**Зависимости:**
- `express ^4.21`, `ejs ^3.1`, `pg ^8.13`
- `helmet ^8.2` — security headers
- `express-rate-limit ^8.5` — rate limiting
- `csrf-csrf ^4.0` — double-submit cookie CSRF
- `express-session ^1.19` — сессии
- `jsonwebtoken ^9.0` — JWT (mock RS256 + будущий OIDC)
- `dotenv ^16.4`

---

## Что нужно проверить и оценить

**Обязательно:**
1. **Безопасность** — OWASP Top 10, SQL injection, XSS, CSRF, session fixation, insecure direct object reference, обход изоляции между компаниями
2. **Корректность бизнес-логики** — лимиты, транзакции, конкурентные запросы, edge cases
3. **Архитектурные решения** — что хорошо, что стоит переделать
4. **Качество кода** — ошибки, запахи, неочевидные места
5. **Тесты** — что покрыто, что не покрыто, что критично добавить
6. **Готовность к продакшену** — что заблокирует выход в прод

**Дополнительно (если видишь):**
- Уязвимости в OIDC/session flow (src/auth.js, src/routes/auth.js)
- Корректность CIDR-агрегации (aggregateCIDRs в validators.js)
- Изоляция данных между компаниями в queries.js
- CSRF — корректность конфигурации csrf-csrf

**Формат ответа:** структурированный Markdown, с разделами по темам, с цитатами кода где нужно. Оценка по каждому блоку: ✅ хорошо / ⚠️ замечание / ❌ проблема.

---

## ВЕСЬ КОД ПРОЕКТА

### sql/schema.sql

```sql
-- IP WhiteList schema

CREATE TABLE IF NOT EXISTS companies (
    id            SERIAL PRIMARY KEY,
    client_id     VARCHAR(64) UNIQUE NOT NULL,
    name          VARCHAR(255),
    custom_limit  INTEGER DEFAULT NULL CHECK (custom_limit IS NULL OR custom_limit >= 0),
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS whitelist_entries (
    id           SERIAL PRIMARY KEY,
    company_id   INTEGER NOT NULL REFERENCES companies(id) ON DELETE RESTRICT,
    value_cidr   VARCHAR(18) NOT NULL CHECK (value_cidr ~ '^(\d{1,3}\.){3}\d{1,3}/\d{1,2}$'),
    comment      VARCHAR(255),
    created_by   VARCHAR(255) NOT NULL,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_by   VARCHAR(255),
    updated_at   TIMESTAMPTZ,
    deleted_by   VARCHAR(255),
    deleted_at   TIMESTAMPTZ
);

-- Уникальность активного CIDR в рамках компании (защита от гонок дублей)
CREATE UNIQUE INDEX IF NOT EXISTS uq_entries_active_cidr
    ON whitelist_entries(company_id, value_cidr) WHERE deleted_at IS NULL;

-- Составной для списка активных записей компании
CREATE INDEX IF NOT EXISTS idx_entries_active
    ON whitelist_entries(company_id, created_at DESC) WHERE deleted_at IS NULL;

CREATE TABLE IF NOT EXISTS audit_log (
    id           SERIAL PRIMARY KEY,
    user_email   VARCHAR(255) NOT NULL,
    company_id   INTEGER NOT NULL,
    action       VARCHAR(32) NOT NULL CHECK (action IN ('CREATE','UPDATE','DELETE')),
    old_value    TEXT,
    new_value    TEXT,
    entry_id     INTEGER,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS idx_audit_company_time ON audit_log(company_id, created_at DESC);
```

---

### src/db.js

```js
const { Pool } = require('pg');
require('dotenv').config();

const pool = new Pool({
  host: process.env.DB_HOST,
  port: process.env.DB_PORT || 5432,
  database: process.env.DB_NAME || 'postgres',
  user: process.env.DB_USER,
  password: process.env.DB_PASS,
  ssl: process.env.DB_SSLMODE === 'require' ? { rejectUnauthorized: false } : false,
  max: 10,
  idleTimeoutMillis: 30000,
});

pool.on('error', (err) => {
  console.error('DB pool error:', err.message);
});

async function checkConnection() {
  const { rows } = await pool.query('SELECT 1 AS ok');
  return rows[0].ok === 1;
}

module.exports = { pool, checkConnection };
```

---

### src/config.js

```js
'use strict';

const MOCK_USERS = [
  {
    id:          'admin',
    label:       'Администратор (WZ01112)',
    role:        'admin',
    clientId:    'WZ01112',
    companyId:   'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
    companyName: 'Nubes Admin',
    email:       'admin@nubes.ru',
  },
  {
    id:          'test',
    label:       'Тест (WZ01325)',
    role:        'user',
    clientId:    'WZ01325',
    companyId:   '3e64aac6-dcfc-4082-88dc-da19c86555a5',
    companyName: 'Тест',
    email:       'tazet@narod.ru',
  },
  {
    id:          'client2',
    label:       'Компания 2 (WZ02001)',
    role:        'user',
    clientId:    'WZ02001',
    companyId:   '11111111-2222-3333-4444-555555555555',
    companyName: 'Вторая Компания',
    email:       'user2@example.com',
  },
];

function backUrl(isAdmin, companyId, extra = {}) {
  const qs = new URLSearchParams();
  if (isAdmin && companyId) qs.set('company', companyId);
  for (const [k, v] of Object.entries(extra)) qs.set(k, String(v));
  const str = qs.toString();
  return str ? '/?' + str : '/';
}

module.exports = { MOCK_USERS, backUrl };
```

---

### src/validators.js

```js
const net = require('net');

const BLOCKED_RANGES = [
  '10.0.0.0/8',
  '172.16.0.0/12',
  '192.168.0.0/16',
  '100.64.0.0/10',
  '127.0.0.0/8',
  '169.254.0.0/16',
  '192.0.0.0/24',
  '192.0.2.0/24',
  '198.51.100.0/24',
  '203.0.113.0/24',
  '198.18.0.0/15',
  '224.0.0.0/4',
  '240.0.0.0/4',
  '255.255.255.255/32',
];

function validate(input) {
  const raw = (input || '').trim();
  if (!raw) throw new Error('Пустое значение');

  if (raw.includes(':')) throw new Error('IPv6 не поддерживается');
  if (/[a-zA-Z]/.test(raw.replace(/\./g, '').replace(/\//g, '').replace(/\d/g, '')))
    throw new Error('Некорректный формат');

  if ((raw.match(/\//g) || []).length > 1) {
    throw new Error('Некорректный формат');
  }

  let cidr = raw.includes('/') ? raw : raw + '/32';
  const [addr, maskStr] = cidr.split('/');

  if (!/^\d{1,2}$/.test(maskStr)) {
    throw new Error('Некорректная маска');
  }
  const mask = parseInt(maskStr, 10);

  if (mask < 22 || mask > 32) {
    throw new Error('Маска должна быть от /22 до /32');
  }

  if (!net.isIPv4(addr)) throw new Error('Некорректный IPv4 адрес');

  const ipNum = addr.split('.').reduce((acc, octet) => (acc << 8) + parseInt(octet, 10), 0) >>> 0;
  const netMask = ~((1 << (32 - mask)) - 1) >>> 0;
  const network = (ipNum & netMask) >>> 0;
  const networkAddr = [
    (network >>> 24) & 0xff,
    (network >>> 16) & 0xff,
    (network >>> 8) & 0xff,
    network & 0xff,
  ].join('.');

  const wasNormalized = addr !== networkAddr;
  const normalized = networkAddr + '/' + mask;

  for (const blocked of BLOCKED_RANGES) {
    if (overlaps(normalized, blocked)) {
      throw new Error(`Диапазон ${normalized} пересекается с запрещённым (${blocked})`);
    }
  }

  return { cidr: normalized, wasNormalized };
}

function overlaps(cidr1, cidr2) {
  const a = cidrToRange(cidr1);
  const b = cidrToRange(cidr2);
  return a.start <= b.end && b.start <= a.start ||
         b.start <= a.end && a.start <= b.start;
}

function isSubnetOf(cidr, parent) {
  const child = cidrToRange(cidr);
  const par = cidrToRange(parent);
  return child.start >= par.start && child.end <= par.end;
}

function cidrToRange(cidr) {
  const [addr, maskStr] = cidr.split('/');
  const mask = parseInt(maskStr, 10);
  const ip = addr.split('.').reduce((acc, o) => (acc << 8) + parseInt(o, 10), 0) >>> 0;
  const start = ip >>> 0;
  const end = (ip | ((1 << (32 - mask)) - 1)) >>> 0;
  return { start, end };
}

function numToIP(n) {
  return [
    (n >>> 24) & 0xff,
    (n >>> 16) & 0xff,
    (n >>> 8)  & 0xff,
    n & 0xff,
  ].join('.');
}

function rangeToCIDRs(start, end) {
  const cidrs = [];
  let cur = start >>> 0;
  const endU = end >>> 0;

  while (cur <= endU) {
    let trailingZeros = 0;
    if (cur === 0) {
      trailingZeros = 32;
    } else {
      let tmp = cur;
      while ((tmp & 1) === 0 && trailingZeros < 32) {
        tmp = tmp >>> 1;
        trailingZeros++;
      }
    }

    let prefix = 32 - trailingZeros;
    while (prefix <= 32) {
      const hostBits = 32 - prefix;
      const blockEnd = hostBits > 0 ? (cur + Math.pow(2, hostBits) - 1) >>> 0 : cur;
      if (blockEnd <= endU) break;
      prefix++;
    }

    cidrs.push(numToIP(cur) + '/' + prefix);

    const hostBits = 32 - prefix;
    if (hostBits === 0) {
      if (cur === 0xFFFFFFFF) break;
      cur = (cur + 1) >>> 0;
    } else {
      const blockSize = Math.pow(2, hostBits);
      cur = (cur + blockSize) >>> 0;
      if (cur === 0) break;
    }
  }

  return cidrs;
}

function aggregateCIDRs(cidrs) {
  if (!cidrs || cidrs.length === 0) return [];

  const ranges = cidrs.map(cidrToRange);

  ranges.sort((a, b) => {
    if (a.start < b.start) return -1;
    if (a.start > b.start) return 1;
    return 0;
  });

  const merged = [{ start: ranges[0].start, end: ranges[0].end }];
  for (let i = 1; i < ranges.length; i++) {
    const last = merged[merged.length - 1];
    const cur = ranges[i];
    const adjacent = last.end < 0xFFFFFFFF && cur.start === last.end + 1;
    if (cur.start <= last.end || adjacent) {
      if (cur.end > last.end) last.end = cur.end;
    } else {
      merged.push({ start: cur.start, end: cur.end });
    }
  }

  const result = [];
  for (const range of merged) {
    result.push(...rangeToCIDRs(range.start, range.end));
  }
  return result;
}

module.exports = { validate, overlaps, BLOCKED_RANGES, aggregateCIDRs };
```

---

### src/queries.js

```js
const { pool } = require('./db');
const { validate, overlaps } = require('./validators');

async function getOrCreateCompany(clientId, companyName) {
  const res = await pool.query(
    `INSERT INTO companies (client_id, name) VALUES ($1, $2)
     ON CONFLICT (client_id) DO UPDATE SET name = COALESCE(companies.name, EXCLUDED.name)
     RETURNING *`,
    [clientId, companyName || clientId]
  );
  return res.rows[0];
}

async function getLimit(company) {
  const defaultLimit = parseInt(process.env.DEFAULT_LIMIT, 10) || 15;
  return company.custom_limit != null ? company.custom_limit : defaultLimit;
}

async function listEntries(companyId, includeDeleted = false) {
  let sql = 'SELECT * FROM whitelist_entries WHERE company_id = $1';
  if (!includeDeleted) sql += ' AND deleted_at IS NULL';
  sql += ' ORDER BY created_at DESC';
  return (await pool.query(sql, [companyId])).rows;
}

async function createEntry(companyId, rawValue, comment, userEmail) {
  const { cidr, wasNormalized } = validate(rawValue);
  const client = await pool.connect();
  try {
    await client.query('BEGIN');
    const company = (await client.query(
      'SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]
    )).rows[0];
    if (!company) throw new Error('Компания не найдена');

    const limit = await getLimit(company);
    const cnt = (await client.query(
      'SELECT COUNT(*)::int AS c FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
      [companyId]
    )).rows[0].c;
    if (cnt >= limit) throw new Error(`Лимит исчерпан: ${cnt} из ${limit}`);

    const existing = (await client.query(
      'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
      [companyId]
    )).rows;
    for (const row of existing) {
      if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
      if (overlaps(cidr, row.value_cidr))
        throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
    }

    const res = await client.query(
      `INSERT INTO whitelist_entries (company_id, value_cidr, comment, created_by)
       VALUES ($1, $2, $3, $4) RETURNING *`,
      [companyId, cidr, comment || null, userEmail]
    );
    await logAudit(userEmail, companyId, 'CREATE', null, cidr, res.rows[0].id, client);
    await client.query('COMMIT');
    return { entry: res.rows[0], wasNormalized };
  } catch (e) {
    await client.query('ROLLBACK');
    throw e;
  } finally {
    client.release();
  }
}

async function updateEntry(entryId, companyId, rawValue, comment, userEmail) {
  const { cidr, wasNormalized } = validate(rawValue);
  const client = await pool.connect();
  try {
    await client.query('BEGIN');
    await client.query('SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]);

    const old = (await client.query(
      'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
      [entryId, companyId]
    )).rows[0];
    if (!old) throw new Error('Запись не найдена');

    const existing = (await client.query(
      'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL AND id <> $2',
      [companyId, entryId]
    )).rows;
    for (const row of existing) {
      if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
      if (overlaps(cidr, row.value_cidr))
        throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
    }

    const res = await client.query(
      `UPDATE whitelist_entries SET value_cidr = $1, comment = $2, updated_by = $3, updated_at = NOW()
       WHERE id = $4 AND company_id = $5 RETURNING *`,
      [cidr, comment || old.comment, userEmail, entryId, companyId]
    );
    await logAudit(userEmail, companyId, 'UPDATE', old.value_cidr, cidr, entryId, client);
    await client.query('COMMIT');
    return { entry: res.rows[0], wasNormalized };
  } catch (e) {
    await client.query('ROLLBACK');
    throw e;
  } finally {
    client.release();
  }
}

async function deleteEntry(entryId, companyId, userEmail) {
  const client = await pool.connect();
  try {
    await client.query('BEGIN');

    const old = (await client.query(
      'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
      [entryId, companyId]
    )).rows[0];
    if (!old) throw new Error('Запись не найдена');

    await client.query(
      'UPDATE whitelist_entries SET deleted_by = $1, deleted_at = NOW() WHERE id = $2 AND company_id = $3',
      [userEmail, entryId, companyId]
    );
    await logAudit(userEmail, companyId, 'DELETE', old.value_cidr, null, entryId, client);
    await client.query('COMMIT');
  } catch (e) {
    await client.query('ROLLBACK');
    throw e;
  } finally {
    client.release();
  }
}

async function getCompanyById(id) {
  const res = await pool.query('SELECT * FROM companies WHERE id = $1', [id]);
  return res.rows[0] || null;
}

async function getAllCompanies() {
  const res = await pool.query(`
    SELECT c.*,
           COUNT(e.id)::int AS active_count
      FROM companies c
      LEFT JOIN whitelist_entries e
             ON e.company_id = c.id AND e.deleted_at IS NULL
     GROUP BY c.id
     ORDER BY c.name, c.client_id
  `);
  return res.rows;
}

async function setLimit(companyId, newLimit) {
  await pool.query(
    'UPDATE companies SET custom_limit = $1, updated_at = NOW() WHERE id = $2',
    [newLimit, companyId]
  );
}

async function getExportCIDRs(companyId = null) {
  let sql = 'SELECT value_cidr FROM whitelist_entries WHERE deleted_at IS NULL';
  const params = [];
  if (companyId) {
    sql += ' AND company_id = $1';
    params.push(companyId);
  }
  sql += ' ORDER BY value_cidr';
  return ((await pool.query(sql, params)).rows).map(r => r.value_cidr);
}

async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId, db = pool) {
  await db.query(
    `INSERT INTO audit_log (user_email, company_id, action, old_value, new_value, entry_id)
     VALUES ($1, $2, $3, $4, $5, $6)`,
    [userEmail, companyId, action, oldValue, newValue, entryId || null]
  );
}

async function getAudit(companyId = null) {
  let sql = `
    SELECT a.*, c.name AS company_name, c.client_id
      FROM audit_log a
      JOIN companies c ON c.id = a.company_id
  `;
  const params = [];
  if (companyId) {
    sql += ' WHERE a.company_id = $1';
    params.push(companyId);
  }
  sql += ' ORDER BY a.created_at DESC LIMIT 500';
  return (await pool.query(sql, params)).rows;
}

module.exports = {
  getOrCreateCompany, getLimit,
  listEntries, createEntry, updateEntry, deleteEntry,
  getExportCIDRs,
  getAudit,
  getCompanyById, getAllCompanies, setLimit,
};
```

---

### src/middleware/rateLimit.js

```js
'use strict';

const { rateLimit } = require('express-rate-limit');

const mutationLimiter = rateLimit({
  windowMs: 60_000,
  limit: 30,
  standardHeaders: 'draft-7',
  legacyHeaders: false,
  message: { error: 'Слишком много запросов. Подождите минуту.' },
});

const exportLimiter = rateLimit({
  windowMs: 60_000,
  limit: 20,
  standardHeaders: 'draft-7',
  legacyHeaders: false,
  message: 'Слишком много запросов к /export. Подождите минуту.',
});

module.exports = { mutationLimiter, exportLimiter };
```

---

### src/middleware/csrf.js

```js
'use strict';

const { doubleCsrf } = require('csrf-csrf');

function initCsrf() {
  const { doubleCsrfProtection, generateCsrfToken } = doubleCsrf({
    getSecret: () => process.env.CSRF_SECRET || 'dev-csrf-secret-change-in-prod',

    // Используем JWT-cookie как session identifier.
    // ВАЖНО: после перехода на express-session это устарело — cookie 'jwt' больше не выдаётся.
    // Нужно обновить на req.session?.id или req.sessionID.
    getSessionIdentifier: (req) => req.cookies.jwt || '',

    cookieOptions: {
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      httpOnly: true,
    },

    size: 64,
  });

  return { doubleCsrfProtection, generateCsrfToken };
}

module.exports = { initCsrf };
```

---

### src/auth.js

```js
'use strict';

const jwt    = require('jsonwebtoken');
const crypto = require('crypto');
const https  = require('https');
const http   = require('http');

const ISSUER           = process.env.JWT_ISSUER        || 'mock-auth-api';
const ADMIN_CLIENT_ID  = process.env.ADMIN_CLIENT_ID   || 'WZ01112';

const KC_BASE_URL      = (process.env.KC_BASE_URL || 'https://keycloak.nubes.ru/realms/cloud').replace(/\/$/, '');
const KC_CLIENT_ID     = process.env.KC_CLIENT_ID     || '';
const KC_CLIENT_SECRET = process.env.KC_CLIENT_SECRET || '';
const APP_URL          = (process.env.APP_URL || 'http://localhost:3000').replace(/\/$/, '');

const OIDC = {
  auth:   KC_BASE_URL + '/protocol/openid-connect/auth',
  token:  KC_BASE_URL + '/protocol/openid-connect/token',
  certs:  KC_BASE_URL + '/protocol/openid-connect/certs',
  logout: KC_BASE_URL + '/protocol/openid-connect/logout',
};

let mockKeyPair = null;
let mockJwks    = null;
let cachedJwks  = null;

function initAuth() {
  const devMode   = process.env.DEV_MODE   === 'true';
  const devSecret = process.env.DEV_SECRET || '';

  const isOidc = !!(KC_CLIENT_ID && KC_CLIENT_SECRET);

  if (isOidc) {
    console.log('[auth] OIDC — Keycloak', KC_BASE_URL);
  } else {
    console.log('[auth] MOCK — local RS256 key');
    mockKeyPair = crypto.generateKeyPairSync('rsa', {
      modulusLength: 2048,
      publicKeyEncoding:  { type: 'spki',  format: 'pem' },
      privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
    });
    const jwkPub = crypto.createPublicKey(mockKeyPair.publicKey).export({ format: 'jwk' });
    Object.assign(jwkPub, { alg: 'RS256', use: 'sig', kid: 'mock-1' });
    mockJwks = { keys: [jwkPub] };
  }

  if (devMode)   console.log('[auth] DEV_MODE — /dev-login доступен без пароля');
  if (devSecret) console.log('[auth] DEV_SECRET задан — /dev-login с ключом');

  return {
    isOidc,
    middleware:      createMiddleware(isOidc),
    buildAuthUrl,
    exchangeCode,
    buildLogoutUrl,
    issueMockToken,
    devLoginEnabled: devMode || !!devSecret,
    DEV_SECRET:      devSecret,
    jwksHandler: !isOidc ? (req, res) => res.json(mockJwks) : null,
  };
}

function createMiddleware(isOidc) {
  return function authMiddleware(req, res, next) {
    if (req.session && req.session.user) {
      req.user = req.session.user;
      return next();
    }

    const bearer = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
    if (bearer) {
      try {
        const payload = isOidc ? verifyOidcToken(bearer) : verifyMockToken(bearer);
        req.user = userFromPayload(payload);
        return next();
      } catch (e) {
        return res.status(401).json({ error: 'Invalid token: ' + e.message });
      }
    }

    if (!isOidc && req.cookies && req.cookies.jwt) {
      try {
        const payload = verifyMockToken(req.cookies.jwt);
        req.user = userFromPayload(payload);
        if (req.session) {
          req.session.user = req.user;
          res.clearCookie('jwt');
        }
        return next();
      } catch (_) {
        res.clearCookie('jwt');
      }
    }

    if (req.method === 'GET') {
      return res.redirect('/login?returnTo=' + encodeURIComponent(req.originalUrl));
    }
    return res.status(401).send('Unauthorized');
  };
}

function buildAuthUrl(state) {
  const params = new URLSearchParams({
    response_type: 'code',
    client_id:     KC_CLIENT_ID,
    redirect_uri:  APP_URL + '/callback',
    scope:         'openid profile email',
    state,
  });
  return OIDC.auth + '?' + params;
}

async function exchangeCode(code) {
  const body = new URLSearchParams({
    grant_type:    'authorization_code',
    client_id:     KC_CLIENT_ID,
    client_secret: KC_CLIENT_SECRET,
    redirect_uri:  APP_URL + '/callback',
    code,
  }).toString();

  const raw  = await httpPost(OIDC.token, body, { 'Content-Type': 'application/x-www-form-urlencoded' });
  const data = JSON.parse(raw);
  if (!data.access_token) throw new Error('No access_token: ' + raw.slice(0, 200));

  if (!cachedJwks) cachedJwks = JSON.parse(await httpGet(OIDC.certs));
  const payload = verifyOidcToken(data.access_token);

  return {
    user:         userFromPayload(payload),
    idToken:      data.id_token      || null,
    refreshToken: data.refresh_token || null,
  };
}

function buildLogoutUrl(idToken) {
  const params = new URLSearchParams({ post_logout_redirect_uri: APP_URL + '/login' });
  if (idToken) params.set('id_token_hint', idToken);
  return OIDC.logout + '?' + params;
}

function issueMockToken(claims) {
  if (!mockKeyPair) throw new Error('Mock keypair not initialized');
  return jwt.sign(
    { ClientID: claims.clientId, company_id: claims.companyId, company_name: claims.companyName, email: claims.email, login: claims.email },
    mockKeyPair.privateKey,
    { algorithm: 'RS256', issuer: ISSUER, subject: claims.companyId || 'mock', expiresIn: '24h', keyid: 'mock-1' }
  );
}

function verifyMockToken(token) {
  if (!mockKeyPair) throw new Error('Mock keypair not initialized');
  return jwt.verify(token, mockKeyPair.publicKey, { algorithms: ['RS256'], issuer: ISSUER });
}

function verifyOidcToken(token) {
  if (!cachedJwks) throw new Error('JWKS not loaded yet');
  const key = cachedJwks.keys.find(k => k.kty === 'RSA' && k.use === 'sig');
  if (!key) throw new Error('No RSA sig key in JWKS');
  const pem = crypto.createPublicKey({ key, format: 'jwk' }).export({ type: 'spki', format: 'pem' });
  return jwt.verify(token, pem, { algorithms: ['RS256'] });
}

function userFromPayload(payload) {
  const clientId = payload.ClientID || payload.client_id || payload.preferred_username || 'UNKNOWN';
  return {
    email:       payload.email || payload.login || 'unknown',
    clientId,
    companyId:   payload.company_id || payload.sub || null,
    companyName: payload.company_name || clientId,
    isAdmin:     clientId === ADMIN_CLIENT_ID,
  };
}

function requireAdmin(req, res, next) {
  if (!req.user || !req.user.isAdmin) {
    return res.status(403).send('403 Forbidden: требуется роль администратора');
  }
  next();
}

function httpGet(url) {
  return new Promise((resolve, reject) => {
    const lib = url.startsWith('https') ? https : http;
    const req = lib.get(url, { timeout: 5000 }, (res) => {
      let data = '';
      res.on('data', c => { data += c; });
      res.on('end', () => res.statusCode === 200 ? resolve(data) : reject(new Error('HTTP ' + res.statusCode)));
    });
    req.on('error', reject);
    req.on('timeout', () => { req.destroy(); reject(new Error('Timeout')); });
  });
}

function httpPost(url, body, headers) {
  return new Promise((resolve, reject) => {
    const u   = new URL(url);
    const lib = u.protocol === 'https:' ? https : http;
    const opts = {
      hostname: u.hostname,
      port:     u.port || (u.protocol === 'https:' ? 443 : 80),
      path:     u.pathname + u.search,
      method:   'POST',
      headers:  { ...headers, 'Content-Length': Buffer.byteLength(body) },
      timeout:  5000,
    };
    const req = lib.request(opts, (res) => {
      let data = '';
      res.on('data', c => { data += c; });
      res.on('end', () => {
        if (res.statusCode >= 200 && res.statusCode < 300) resolve(data);
        else reject(new Error('HTTP ' + res.statusCode + ': ' + data.slice(0, 200)));
      });
    });
    req.on('error', reject);
    req.on('timeout', () => { req.destroy(); reject(new Error('Timeout')); });
    req.write(body);
    req.end();
  });
}

module.exports = { initAuth, requireAdmin };
```

---

### src/routes/auth.js

```js
'use strict';

const crypto     = require('crypto');
const { Router } = require('express');

function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, MOCK_USERS }) {
  const router = Router();

  router.get('/login', (req, res) => {
    if (auth.isOidc) {
      const state = crypto.randomBytes(16).toString('hex');
      req.session.oidcState = state;
      req.session.returnTo  = req.query.returnTo || '/';
      return res.redirect(auth.buildAuthUrl(state));
    }

    const csrfToken = generateCsrfToken(req, res);
    res.render('login', {
      users:       MOCK_USERS,
      error:       req.query.error || null,
      csrfToken,
      devLoginUrl: auth.devLoginEnabled ? '/dev-login' : null,
    });
  });

  router.post('/login', doubleCsrfProtection, (req, res) => {
    if (auth.isOidc) return res.redirect('/login');

    const user = MOCK_USERS.find(u => u.id === req.body.user);
    if (!user) {
      return res.redirect('/login?error=' + encodeURIComponent('Пользователь не найден'));
    }

    req.session.user = {
      email:       user.email,
      clientId:    user.clientId,
      companyId:   user.companyId,
      companyName: user.companyName,
      isAdmin:     user.role === 'admin',
    };

    res.redirect(req.query.returnTo || '/');
  });

  router.get('/callback', async (req, res) => {
    if (!auth.isOidc) return res.redirect('/login');

    const { code, state, error } = req.query;

    if (error) {
      console.error('[auth] Keycloak error:', error, req.query.error_description || '');
      return res.redirect('/login?error=' + encodeURIComponent('Keycloak: ' + error));
    }

    if (!state || state !== req.session.oidcState) {
      return res.redirect('/login?error=' + encodeURIComponent('Недействительный state'));
    }
    delete req.session.oidcState;

    try {
      const { user, idToken, refreshToken } = await auth.exchangeCode(code);
      req.session.user         = user;
      req.session.idToken      = idToken;
      req.session.refreshToken = refreshToken;
      const returnTo = req.session.returnTo || '/';
      delete req.session.returnTo;
      res.redirect(returnTo);
    } catch (e) {
      console.error('[auth] exchangeCode error:', e.message);
      res.redirect('/login?error=' + encodeURIComponent('Ошибка авторизации: ' + e.message));
    }
  });

  router.get('/dev-login', (req, res) => {
    if (!auth.devLoginEnabled) return res.status(404).send('Not Found');

    if (auth.DEV_SECRET) {
      const keyOk = req.query.key === auth.DEV_SECRET || req.session.devKey === auth.DEV_SECRET;
      if (!keyOk) return res.status(403).send('403 Forbidden: неверный dev-ключ');
      req.session.devKey = auth.DEV_SECRET;
    }

    const csrfToken = generateCsrfToken(req, res);
    res.render('dev-login', {
      users:     MOCK_USERS,
      error:     req.query.error || null,
      csrfToken,
    });
  });

  router.post('/dev-login', doubleCsrfProtection, (req, res) => {
    if (!auth.devLoginEnabled) return res.status(404).send('Not Found');

    if (auth.DEV_SECRET && req.session.devKey !== auth.DEV_SECRET) {
      return res.status(403).send('403 Forbidden');
    }

    let user;

    if (req.body.preset) {
      const mockUser = MOCK_USERS.find(u => u.id === req.body.preset);
      if (!mockUser) {
        return res.redirect('/dev-login?error=' + encodeURIComponent('Пользователь не найден'));
      }
      user = {
        email:       mockUser.email,
        clientId:    mockUser.clientId,
        companyId:   mockUser.companyId,
        companyName: mockUser.companyName,
        isAdmin:     mockUser.role === 'admin',
      };
    } else {
      const clientId = (req.body.clientId || '').trim();
      if (!clientId) {
        return res.redirect('/dev-login?error=' + encodeURIComponent('ClientID обязателен'));
      }
      user = {
        email:       (req.body.email       || '').trim() || clientId + '@dev.local',
        clientId,
        companyId:   (req.body.companyId   || '').trim() || null,
        companyName: (req.body.companyName || '').trim() || clientId,
        isAdmin:     req.body.isAdmin === 'on',
      };
    }

    req.session.user = user;
    res.redirect('/');
  });

  router.get('/logout', (req, res) => {
    const idToken = req.session.idToken || null;
    const isOidc  = auth.isOidc;

    req.session.destroy(() => {
      res.clearCookie('connect.sid');
      res.clearCookie('jwt');

      if (isOidc && idToken) {
        return res.redirect(auth.buildLogoutUrl(idToken));
      }
      res.redirect('/login');
    });
  });

  return router;
}

module.exports = { createRouter };
```

---

### src/routes/entries.js

```js
'use strict';

const { Router } = require('express');

function createRouter({ q, doubleCsrfProtection, mutationLimiter, generateCsrfToken, backUrl }) {
  const router = Router();

  router.get('/', async (req, res) => {
    const { clientId, companyName, isAdmin } = req.user;
    const csrfToken = generateCsrfToken(req, res);

    try {
      if (isAdmin) {
        const companies = await q.getAllCompanies();
        const selectedId = req.query.company
          ? parseInt(req.query.company, 10)
          : (companies[0] ? companies[0].id : null);
        const selectedCompany = companies.find(c => c.id === selectedId) || companies[0] || null;
        const entries = selectedCompany ? await q.listEntries(selectedCompany.id) : [];
        const limit   = selectedCompany ? await q.getLimit(selectedCompany) : 0;

        return res.render('index', {
          entries, limit, used: entries.length,
          user: req.user, isAdmin: true,
          companies, selectedCompany,
          error: req.query.error || null,
          message: req.query.message || null,
          wasNormalized: req.query.wasNormalized === '1',
          csrfToken,
        });
      }

      const company = await q.getOrCreateCompany(clientId, companyName);
      const limit   = await q.getLimit(company);
      const entries = await q.listEntries(company.id);

      res.render('index', {
        entries, limit, used: entries.length,
        user: req.user, isAdmin: false,
        companies: null, selectedCompany: company,
        error: req.query.error || null,
        message: req.query.message || null,
        wasNormalized: req.query.wasNormalized === '1',
        csrfToken,
      });
    } catch (e) {
      console.error('GET / error:', e);
      res.render('index', {
        entries: [], limit: 15, used: 0,
        user: req.user, isAdmin,
        companies: null, selectedCompany: null,
        error: 'Ошибка загрузки данных: ' + e.message,
        message: null, wasNormalized: false, csrfToken,
      });
    }
  });

  router.post('/add', mutationLimiter, doubleCsrfProtection, async (req, res) => {
    const { value, comment } = req.body;
    const { clientId, companyName, email, isAdmin } = req.user;

    let company;
    try {
      if (isAdmin && req.body.company_id) {
        const id = parseInt(req.body.company_id, 10);
        if (!Number.isFinite(id) || id <= 0) throw new Error('Некорректный company_id');
        company = await q.getCompanyById(id);
        if (!company) throw new Error('Компания не найдена');
      } else {
        company = await q.getOrCreateCompany(clientId, companyName);
      }

      const result = await q.createEntry(company.id, value, comment, email);
      const msg = result.wasNormalized
        ? `Адрес нормализован в ${result.entry.value_cidr}`
        : 'Добавлено';

      res.redirect(backUrl(isAdmin, company.id, {
        message: msg,
        wasNormalized: result.wasNormalized ? '1' : '0',
      }));
    } catch (e) {
      const cid = company ? company.id : req.body.company_id;
      res.redirect(backUrl(isAdmin, cid, { error: e.message }));
    }
  });

  router.post('/edit/:id', mutationLimiter, doubleCsrfProtection, async (req, res) => {
    const { value, comment } = req.body;
    const { clientId, companyName, email, isAdmin } = req.user;
    const entryId = parseInt(req.params.id, 10);

    let company;
    try {
      if (isAdmin && req.body.company_id) {
        const id = parseInt(req.body.company_id, 10);
        if (!Number.isFinite(id) || id <= 0) throw new Error('Некорректный company_id');
        company = await q.getCompanyById(id);
        if (!company) throw new Error('Компания не найдена');
      } else {
        company = await q.getOrCreateCompany(clientId, companyName);
      }

      const result = await q.updateEntry(entryId, company.id, value, comment, email);
      const msg = result.wasNormalized
        ? `Адрес нормализован в ${result.entry.value_cidr}`
        : 'Сохранено';

      res.redirect(backUrl(isAdmin, company.id, {
        message: msg,
        wasNormalized: result.wasNormalized ? '1' : '0',
      }));
    } catch (e) {
      const cid = company ? company.id : req.body.company_id;
      res.redirect(backUrl(isAdmin, cid, { error: e.message }));
    }
  });

  router.post('/delete/:id', mutationLimiter, doubleCsrfProtection, async (req, res) => {
    const { clientId, companyName, email, isAdmin } = req.user;
    const entryId = parseInt(req.params.id, 10);

    let company;
    try {
      if (isAdmin && req.body.company_id) {
        const id = parseInt(req.body.company_id, 10);
        if (!Number.isFinite(id) || id <= 0) throw new Error('Некорректный company_id');
        company = await q.getCompanyById(id);
        if (!company) throw new Error('Компания не найдена');
      } else {
        company = await q.getOrCreateCompany(clientId, companyName);
      }

      await q.deleteEntry(entryId, company.id, email);
      res.redirect(backUrl(isAdmin, company.id, { message: 'Запись удалена' }));
    } catch (e) {
      const cid = company ? company.id : req.body.company_id;
      res.redirect(backUrl(isAdmin, cid, { error: e.message }));
    }
  });

  return router;
}

module.exports = { createRouter };
```

---

### src/routes/admin.js

```js
'use strict';

const { Router } = require('express');

function createRouter({ q, requireAdmin, doubleCsrfProtection, mutationLimiter, generateCsrfToken }) {
  const router = Router();

  router.get('/audit', requireAdmin, async (req, res) => {
    try {
      const companyId = req.query.company ? parseInt(req.query.company, 10) : null;
      const companies = await q.getAllCompanies();
      const rows = await q.getAudit(companyId || null);

      res.render('audit', {
        user: req.user,
        rows, companies,
        selectedCompanyId: companyId,
        error: req.query.error || null,
      });
    } catch (e) {
      console.error('GET /audit error:', e);
      res.render('audit', {
        user: req.user,
        rows: [], companies: [],
        selectedCompanyId: null,
        error: 'Ошибка загрузки: ' + e.message,
      });
    }
  });

  router.get('/admin', requireAdmin, async (req, res) => {
    try {
      const companies    = await q.getAllCompanies();
      const defaultLimit = parseInt(process.env.DEFAULT_LIMIT, 10) || 15;

      res.render('admin', {
        user: req.user,
        companies, defaultLimit,
        message:   req.query.message || null,
        error:     req.query.error   || null,
        csrfToken: generateCsrfToken(req, res),
      });
    } catch (e) {
      console.error('GET /admin error:', e);
      res.status(500).send('Ошибка: ' + e.message);
    }
  });

  router.post('/admin/limit/:companyId', requireAdmin, mutationLimiter, doubleCsrfProtection,
    async (req, res) => {
      const companyId = parseInt(req.params.companyId, 10);
      if (!Number.isFinite(companyId) || companyId <= 0) {
        return res.redirect('/admin?error=' + encodeURIComponent('Некорректный ID компании'));
      }

      try {
        const raw = req.body.limit;
        let newLimit;

        if (raw === '' || raw === null || raw === undefined) {
          newLimit = null;
        } else {
          newLimit = parseInt(raw, 10);
          if (!Number.isFinite(newLimit) || newLimit < 0) {
            throw new Error('Лимит должен быть целым числом ≥ 0, или пустым для сброса');
          }
        }

        await q.setLimit(companyId, newLimit);
        const label = newLimit === null ? 'сброшен на дефолт' : `установлен: ${newLimit}`;
        res.redirect('/admin?message=' + encodeURIComponent(`Лимит ${label}`));
      } catch (e) {
        res.redirect('/admin?error=' + encodeURIComponent(e.message));
      }
    }
  );

  return router;
}

module.exports = { createRouter };
```

---

### src/routes/export.js

```js
'use strict';

const { Router } = require('express');

function createRouter({ q, exportLimiter, aggregateCIDRs }) {
  const router = Router();

  router.get('/export', exportLimiter, async (req, res) => {
    try {
      const cidrs = await q.getExportCIDRs();
      const aggregated = aggregateCIDRs(cidrs);

      res.setHeader('Content-Type', 'text/plain; charset=utf-8');
      res.setHeader('Content-Disposition', 'inline; filename="whitelist.txt"');
      res.send(aggregated.join('\n') + (aggregated.length ? '\n' : ''));
    } catch (e) {
      console.error('Export error:', e);
      res.status(500).send('Export error');
    }
  });

  return router;
}

module.exports = { createRouter };
```

---

### server.js

```js
'use strict';

const express  = require('express');
const session  = require('express-session');
const cookieParser = require('cookie-parser');
const path     = require('path');
const helmet   = require('helmet');
require('dotenv').config();

const { checkConnection }  = require('./src/db');
const { initAuth, requireAdmin } = require('./src/auth');
const { aggregateCIDRs }   = require('./src/validators');
const q                    = require('./src/queries');
const { MOCK_USERS, backUrl } = require('./src/config');
const { mutationLimiter, exportLimiter } = require('./src/middleware/rateLimit');
const { initCsrf }         = require('./src/middleware/csrf');

const app  = express();
const PORT = process.env.PORT || 3000;

app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'views'));

app.use(helmet({ contentSecurityPolicy: false }));

if (process.env.NODE_ENV === 'production') app.set('trust proxy', 1);

app.use(express.static(path.join(__dirname, 'public')));
app.use(express.urlencoded({ extended: true, limit: '32kb' }));
app.use(cookieParser());

async function start() {
  const auth = await initAuth();

  app.use(session({
    secret:            process.env.SESSION_SECRET || 'dev-session-secret-change-me',
    resave:            false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      secure:   process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      maxAge:   8 * 60 * 60 * 1000,
    },
  }));

  const { doubleCsrfProtection, generateCsrfToken } = initCsrf();

  app.get('/healthz', (req, res) => res.send('OK'));

  if (auth.jwksHandler) app.get('/.well-known/jwks.json', auth.jwksHandler);

  app.use(require('./src/routes/export').createRouter({
    q, exportLimiter, aggregateCIDRs,
  }));

  app.use(require('./src/routes/auth').createRouter({
    auth, doubleCsrfProtection, generateCsrfToken, MOCK_USERS,
  }));

  app.use(auth.middleware);

  app.use(require('./src/routes/entries').createRouter({
    q, doubleCsrfProtection, mutationLimiter, generateCsrfToken, backUrl,
  }));

  app.use(require('./src/routes/admin').createRouter({
    q, requireAdmin, doubleCsrfProtection, mutationLimiter, generateCsrfToken,
  }));

  app.use((err, req, res, next) => {
    if (err && (err.status === 403 || err.code === 'EBADCSRFTOKEN')) {
      return res.status(403).send(
        '<p style="font-family:sans-serif;padding:2rem">' +
        'Недействительный CSRF-токен. ' +
        '<a href="javascript:history.back()">Вернитесь назад</a> и повторите действие.' +
        '</p>'
      );
    }
    console.error('Unhandled error:', err);
    res.status(500).send('Внутренняя ошибка сервера');
  });

  checkConnection()
    .then(() => console.log('DB connected'))
    .catch(e => console.error('DB not ready:', e.message));

  app.listen(PORT, () => console.log('Server on port ' + PORT));
}

start().catch(e => { console.error('Startup error:', e); process.exit(1); });
```

---

### tests/run-tests.js (сокращённо — структура и секция auth)

```js
'use strict';
// 50 тестов, запуск: node tests/run-tests.js, без БД

// Секции:
// 1. Загрузка всех модулей (11 модулей)
// 2. src/config.js — MOCK_USERS, backUrl
// 3. src/validators.js — validate, aggregateCIDRs, overlaps (30+ тест-кейсов)
// 4. src/auth.js — session middleware, requireAdmin

// Пример теста session middleware:
process.env.DEV_MODE = 'true';
process.env.ADMIN_CLIENT_ID = 'WZ01112';

const { initAuth, requireAdmin } = require('../src/auth');
const auth = initAuth();

// session user → req.user
const mockUser = { clientId: 'WZ01325', companyId: 'test-uuid', isAdmin: false, ... };
const req = { headers: {}, cookies: {}, session: { user: mockUser } };
let nextCalled = false;
auth.middleware(req, {}, () => { nextCalled = true; });
// PASS: nextCalled === true, req.user.clientId === 'WZ01325'

// нет auth → redirect
const reqNone = { headers: {}, cookies: {}, session: {}, method: 'GET', originalUrl: '/some-page' };
let redirectUrl = null;
auth.middleware(reqNone, { redirect: url => { redirectUrl = url; } }, () => {});
// PASS: redirectUrl.startsWith('/login')

// Итог: 50 PASS, 0 FAIL
```

---

## Известные проблемы (нашёл сам, можешь подтвердить/опровергнуть)

1. **csrf.js** — `getSessionIdentifier` использует `req.cookies.jwt`, но после перехода на express-session этот cookie больше не выдаётся (только legacy migration). Нужен `req.sessionID`.

2. **overlaps()** в validators.js — логика: `a.start <= b.end && b.start <= a.start` — выглядит подозрительно (должно быть `b.start <= a.end`). Тесты проходят, но алгоритм стоит проверить.

3. **OIDC JWKS кеш** — `cachedJwks` кешируется навсегда, без TTL. При ротации KK-ключей потребуется перезапуск.

4. **dev-login в staging** — `DEV_SECRET` защищает endpoint URL-параметром, но секрет хранится в URL (будет в логах nginx/browser history).

5. **Session в multi-pod** — MemoryStore не шарится между репликами.

---

## Куда сохранить результат

Сохрани полный анализ в файл:
`/home/naeel/ipwhitelist-app/research/opus-full-review-2026-05-30.md`

Структура файла:
```
# Full Code Review — IP WhiteList (Opus, 2026-05-30)

## Итоговая оценка
## 1. Безопасность
## 2. Бизнес-логика и корректность
## 3. Архитектура
## 4. Качество кода
## 5. Тесты
## 6. Готовность к продакшену
## 7. Приоритизированный список замечаний (P1/P2/P3)
```