feat: base-domain auth restriction, email templates, structured logging, and UI improvements

- Restrict public auth endpoints to base domain only (baseOnlyMiddleware)
- Add HTML email templates (login alert, MFA code, password reset, verify email)
- Add structured logging (log/slog) across MFA, auth, email, and password reset flows
- Add logger package with configurable level/format and OTel-ready FromContext()
- Add OpenTelemetry metrics middleware with Prometheus /metrics endpoint
- Add health check endpoints (/healthz, /readyz) on top-level mux
- Add Valkey (Redis) cache client for session management
- Add projects page, org switcher, token management dialog in UI
- Add auth page redirect for subdomain auth flows
- Fix SMTP_HOST for Docker Compose (use service name, not localhost)
- Add CWE/CVE display and CVSS badge to finding detail page

Author: ngoyal16

docker-compose.yml

@@ -64,13 +64,17 @@ services:
       AEGIS_BIND: "0.0.0.0"
       AEGIS_PORT: "8080"
       AEGIS_ALLOWED_ORIGINS: ${AEGIS_ALLOWED_ORIGINS:-http://localhost:8080}
+      AEGIS_BASE_DOMAIN: ${AEGIS_BASE_DOMAIN:-}
       # SMTP — defaults to MailDev for local dev
       SMTP_HOST: ${SMTP_HOST:-maildev}
       SMTP_PORT: ${SMTP_PORT:-1025}
       SMTP_USERNAME: ${SMTP_USERNAME:-}
       SMTP_PASSWORD: ${SMTP_PASSWORD:-}
       SMTP_FROM: ${SMTP_FROM:-noreply@aegis.local}
       SMTP_TLS: ${SMTP_TLS:-false}
+      # Logging
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      LOG_FORMAT: ${LOG_FORMAT:-text}
     depends_on:
       postgres:
         condition: service_healthy

server/cmd/aegis-server/main.go

@@ -13,7 +13,7 @@ package main
 import (
 	"context"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -25,12 +25,14 @@ import (
 	"github.com/pixelvide/aegis/server/internal/cache"
 	"github.com/pixelvide/aegis/server/internal/config"
 	"github.com/pixelvide/aegis/server/internal/email"
+	"github.com/pixelvide/aegis/server/internal/logger"
 	"github.com/pixelvide/aegis/server/internal/store"
 )
 
 func main() {
 	if err := run(); err != nil {
-		log.Fatalf("aegis-server: %v", err)
+		slog.Error("server fatal error", "error", err)
+		os.Exit(1)
 	}
 }
 
@@ -40,6 +42,10 @@ func run() error {
 		return fmt.Errorf("config: %w", err)
 	}
 
+	// Initialize structured logger first — all subsequent code uses slog
+	logger.Init(cfg.LogLevel, cfg.LogFormat)
+	slog.Info("configuration loaded", "log_level", cfg.LogLevel, "log_format", cfg.LogFormat)
+
 	// Open PostgreSQL connection pool
 	if cfg.DatabaseURL == "" {
 		return fmt.Errorf("DATABASE_URL is required (e.g. postgres://aegis:aegis@localhost:5432/aegis?sslmode=disable)")
@@ -50,21 +56,21 @@ func run() error {
 		return fmt.Errorf("postgres: %w", err)
 	}
 	defer db.Close()
-	log.Printf("📦 Connected to PostgreSQL")
+	slog.Info("connected to PostgreSQL", "component", "database")
 
 	// Initialize common schema (users, orgs, memberships)
 	common, err := store.NewCommonStore(db)
 	if err != nil {
 		return fmt.Errorf("common store: %w", err)
 	}
-	log.Printf("📋 Common schema ready")
+	slog.Info("common schema ready", "component", "store")
 
 	// Initialize auth service (JWT + password hashing)
 	authSvc, err := auth.New()
 	if err != nil {
 		return fmt.Errorf("auth: %w", err)
 	}
-	log.Printf("🔐 Auth service ready")
+	slog.Info("auth service ready", "component", "auth")
 
 	// Initialize email service (SMTP)
 	emailSvc := email.New(cfg.SMTP)
@@ -74,20 +80,21 @@ func run() error {
 	if cfg.ValkeyURL != "" {
 		cacheClient, err = cache.New(cfg.ValkeyURL)
 		if err != nil {
-			log.Printf("⚠️  Valkey unavailable (%v) — falling back to DB-only session checks", err)
+			slog.Warn("valkey unavailable, falling back to DB-only session checks",
+				"error", err, "component", "cache")
 			cacheClient = nil
 		} else {
 			defer cacheClient.Close()
-			log.Printf("⚡ Valkey connected (%s)", cfg.ValkeyURL)
+			slog.Info("valkey connected", "addr", cfg.ValkeyURL, "component", "cache")
 		}
 	} else {
-		log.Printf("⚡ Valkey not configured — using DB-only session checks")
+		slog.Info("valkey not configured, using DB-only session checks", "component", "cache")
 	}
 
 	// Initialize OTel metrics with Prometheus exporter
 	metrics, metricsHandler, metricsShutdown := api.InitMetrics(db)
 	defer metricsShutdown(context.Background())
-	log.Printf("📊 Metrics ready (Prometheus at /metrics)")
+	slog.Info("metrics ready", "endpoint", "/metrics", "component", "otel")
 
 	// Create API server
 	apiSrv := api.New(common, authSvc, emailSvc, cacheClient, cfg)
@@ -103,8 +110,9 @@ func run() error {
 	mux.Handle("GET /metrics", metricsHandler)
 	mux.Handle("/", uiHandler())
 
-	// Wrap with metrics middleware
-	handler := metrics.Middleware(mux)
+	// Wrap with auth page redirect (302 for /login etc. on non-base-domain)
+	// then metrics middleware
+	handler := metrics.Middleware(api.AuthPageRedirect(cfg)(mux))
 
 	// HTTP server
 	httpServer := &http.Server{
@@ -120,7 +128,7 @@ func run() error {
 	// Graceful shutdown
 	errCh := make(chan error, 1)
 	go func() {
-		log.Printf("🛡️  Aegis server listening on %s", cfg.Addr())
+		slog.Info("server listening", "addr", cfg.Addr())
 		errCh <- httpServer.ListenAndServe()
 	}()
 
@@ -129,7 +137,7 @@ func run() error {
 
 	select {
 	case sig := <-quit:
-		log.Printf("Received %s, shutting down...", sig)
+		slog.Info("received signal, shutting down", "signal", sig.String())
 	case err := <-errCh:
 		return err
 	}

server/cmd/aegis-server/ui.go

@@ -3,8 +3,9 @@ package main
 import (
 	"embed"
 	"io/fs"
-	"log"
+	"log/slog"
 	"net/http"
+	"os"
 	"strings"
 )
 
@@ -18,7 +19,8 @@ func uiHandler() http.Handler {
 	// Strip the "ui" prefix from the embedded filesystem
 	sub, err := fs.Sub(uiFS, "ui")
 	if err != nil {
-		log.Fatalf("ui embed: %v", err)
+		slog.Error("ui embed failed", "error", err)
+		os.Exit(1)
 	}
 
 	fileServer := http.FileServer(http.FS(sub))

server/internal/api/auth.go

@@ -6,13 +6,16 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/mail"
 	"strings"
 	"time"
 	"unicode"
 
 	authpkg "github.com/pixelvide/aegis/server/internal/auth"
+	"github.com/pixelvide/aegis/server/internal/config"
+	"github.com/pixelvide/aegis/server/internal/email/templates"
 	"github.com/pixelvide/aegis/server/internal/middleware"
 	"github.com/pixelvide/aegis/server/internal/models"
 	"github.com/pixelvide/aegis/server/internal/store"
@@ -88,9 +91,11 @@ func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
 		PasswordHash: hash,
 	}
 	if err := s.common.CreateUser(r.Context(), user); err != nil {
+		slog.Error("failed to create user", "email", req.Email, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to create user")
 		return
 	}
+	slog.Info("user registered", "user_id", user.ID, "email", req.Email)
 
 	// Create primary email entry + send verification
 	primaryEmail, err := s.common.AddPrimaryUserEmail(r.Context(), user.ID, req.Email)
@@ -128,7 +133,7 @@ func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
 	}
 
 	s.createSession(r, user.ID, jti)
-	setAuthCookie(w, token)
+	setAuthCookie(w, token, s.config)
 
 	writeJSON(w, http.StatusCreated, map[string]any{
 		"user":    user,
@@ -215,7 +220,7 @@ issueToken:
 	}
 
 	s.createSession(r, user.ID, jti)
-	setAuthCookie(w, token)
+	setAuthCookie(w, token, s.config)
 
 	// Send login notification email
 	ip := extractIP(r)
@@ -242,6 +247,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 		SameSite: http.SameSiteLaxMode,
 		Path:     "/",
 		MaxAge:   -1, // delete immediately
+		Domain:   cookieDomain(s.config),
 	})
 	writeJSON(w, http.StatusOK, map[string]string{"message": "logged out"})
 }
@@ -270,18 +276,32 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
 
-func setAuthCookie(w http.ResponseWriter, token string) {
+func setAuthCookie(w http.ResponseWriter, token string, cfg *config.Config) {
 	http.SetCookie(w, &http.Cookie{
 		Name:     middleware.CookieName,
 		Value:    token,
 		HttpOnly: true,
-		// Secure: true, // enable in production with HTTPS
 		SameSite: http.SameSiteLaxMode,
 		Path:     "/",
 		MaxAge:   86400, // 24 hours
+		// When BaseDomain is set, scope cookie to parent domain for cross-subdomain sharing
+		Domain: cookieDomain(cfg),
+		// TODO(security): Enable Secure: true in production with HTTPS
+		// TODO(security): Consider __Secure- cookie prefix when Secure is enabled
 	})
 }
 
+// cookieDomain returns the domain to set on auth cookies.
+// When BaseDomain is set, returns ".aegis.io" (leading dot) so the cookie
+// is shared across all subdomains. When empty, returns "" (browser defaults
+// to the exact host — standard dev mode behavior).
+func cookieDomain(cfg *config.Config) string {
+	if cfg.BaseDomain != "" {
+		return "." + cfg.BaseDomain
+	}
+	return ""
+}
+
 // createSession creates a session row for the given user and JTI.
 func (s *Server) createSession(r *http.Request, userID, jti string) {
 	ua := r.UserAgent()
@@ -373,24 +393,12 @@ func parseUserAgent(ua string) (browser, os, deviceType string) {
 }
 
 // sendLoginNotification sends an email alert about a new login.
-func (s *Server) sendLoginNotification(email, name, ip, browser, os, deviceType string) {
+func (s *Server) sendLoginNotification(emailAddr, name, ip, browser, os, deviceType string) {
 	loginTime := time.Now().UTC().Format("Jan 02, 2006 at 15:04 UTC")
-	subject := "Aegis — New sign-in to your account"
-	body := fmt.Sprintf(`<h2>New Sign-In Detected</h2>
-<p>Hi %s,</p>
-<p>We noticed a new sign-in to your Aegis account:</p>
-<table style="border-collapse:collapse;margin:16px 0;">
-  <tr><td style="padding:4px 16px 4px 0;color:#666;">Browser</td><td style="padding:4px 0;">%s</td></tr>
-  <tr><td style="padding:4px 16px 4px 0;color:#666;">Operating System</td><td style="padding:4px 0;">%s</td></tr>
-  <tr><td style="padding:4px 16px 4px 0;color:#666;">Device</td><td style="padding:4px 0;">%s</td></tr>
-  <tr><td style="padding:4px 16px 4px 0;color:#666;">IP Address</td><td style="padding:4px 0;">%s</td></tr>
-  <tr><td style="padding:4px 16px 4px 0;color:#666;">Time</td><td style="padding:4px 0;">%s</td></tr>
-</table>
-<p>If this was you, no action is needed.</p>
-<p>If you don't recognize this activity, please <strong>change your password immediately</strong> and review your active sessions.</p>
-<p style="color:#666;font-size:12px;">Aegis Security Platform</p>
-`, name, browser, os, deviceType, ip, loginTime)
-	_ = s.email.Send(email, subject, body)
+	subject, body := templates.LoginAlert(name, ip, browser, os, deviceType, loginTime)
+	if err := s.email.Send(emailAddr, subject, body); err != nil {
+		slog.Error("failed to send login notification email", "email", emailAddr, "error", err)
+	}
 }
 
 // maskEmail masks an email for privacy (e.g., "j***@example.com").
@@ -435,19 +443,22 @@ func (s *Server) sendVerificationEmail(userID, emailID, emailAddr string) {
 
 	tokenBytes := make([]byte, 32)
 	if _, err := rand.Read(tokenBytes); err != nil {
+		slog.Error("failed to generate verification token", "user_id", userID, "email", emailAddr, "error", err)
 		return
 	}
 	token := hex.EncodeToString(tokenBytes)
 	tokenHash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
 	expiresAt := time.Now().UTC().Add(24 * time.Hour)
 
 	if err := s.common.CreatePasswordResetToken(ctx, userID, tokenHash, expiresAt); err != nil {
+		slog.Error("failed to create verification token", "user_id", userID, "email", emailAddr, "error", err)
 		return
 	}
 
 	verifyURL := fmt.Sprintf("%s/verify-email?token=%s&email_id=%s", s.config.BaseURL, token, emailID)
-	subject := "Verify your email address"
-	body := fmt.Sprintf("Click the following link to verify your email:\n\n%s\n\nThis link expires in 24 hours.", verifyURL)
+	subject, body := templates.VerifyEmail(verifyURL)
 
-	_ = s.email.Send(emailAddr, subject, body)
+	if err := s.email.Send(emailAddr, subject, body); err != nil {
+		slog.Error("failed to send verification email", "user_id", userID, "email", emailAddr, "error", err)
+	}
 }

server/internal/api/metrics.go

@@ -3,7 +3,7 @@ package api
 import (
 	"context"
 	"database/sql"
-	"log"
+	"log/slog"
 	"net/http"
 	"strconv"
 	"time"
@@ -31,7 +31,7 @@ func InitMetrics(db *sql.DB) (*Metrics, http.Handler, func(context.Context) erro
 		prometheus.WithNamespace("aegis"),
 	)
 	if err != nil {
-		log.Printf("⚠️  Failed to create Prometheus exporter: %v — metrics disabled", err)
+		slog.Warn("failed to create Prometheus exporter, metrics disabled", "error", err)
 		return nil, http.NotFoundHandler(), func(context.Context) error { return nil }
 	}
 
@@ -115,15 +115,35 @@ func (m *Metrics) Middleware(next http.Handler) http.Handler {
 
 		next.ServeHTTP(rw, r)
 
-		duration := time.Since(start).Seconds()
+		duration := time.Since(start)
+		durationSec := duration.Seconds()
 		attrs := []attribute.KeyValue{
 			attribute.String("method", r.Method),
 			attribute.String("path", routePattern(r)),
 			attribute.String("status", strconv.Itoa(rw.statusCode)),
 		}
 
 		m.requestsTotal.Add(r.Context(), 1, otelmetric.WithAttributes(attrs...))
-		m.requestDuration.Record(r.Context(), duration, otelmetric.WithAttributes(attrs...))
+		m.requestDuration.Record(r.Context(), durationSec, otelmetric.WithAttributes(attrs...))
+
+		// Structured request logging — skip noisy health/metrics endpoints
+		path := r.URL.Path
+		if path != "/healthz" && path != "/readyz" && path != "/metrics" {
+			logLevel := slog.LevelDebug
+			if rw.statusCode >= 500 {
+				logLevel = slog.LevelError
+			} else if rw.statusCode >= 400 {
+				logLevel = slog.LevelWarn
+			}
+
+			slog.LogAttrs(r.Context(), logLevel, "http request",
+				slog.String("method", r.Method),
+				slog.String("path", path),
+				slog.Int("status", rw.statusCode),
+				slog.Duration("duration", duration),
+				slog.String("ip", r.RemoteAddr),
+			)
+		}
 	})
 }