Plan: Enhance Login Protection and Fix Email Bypass

This plan addresses a security gap where login protection is bypassed when using email addresses for login, and improves the IP whitelist to support CIDR ranges.

User Review Required

[!IMPORTANT]
The fix for email-based login protection will now block failed login attempts against a specific email address, which was previously missing. This enhances security but may change behavior for users who frequently mistype their passwords when logging in with email.

Proposed Changes

Authentication Logic

[MODIFY] restrictLoginAttempts.ts

• Update isValidAttemptByUser to extract either username or email from login.methodArguments[0].user.
• Update saveFailedLoginAttempts to capture the email if username is unavailable in the method arguments.
• Import isIpInCidrRange from @rocket.chat/server-fetch to support CIDR matching in isValidLoginAttemptByIp.

Verification Plan

Automated Tests

• I will create or update unit tests for restrictLoginAttempts.ts to verify:
  • Failed logins with email are correctly blocked after the threshold.
  • CIDR ranges in the whitelist correctly allow access.

Manual Verification

• I'll simulate failed login attempts using the LoginProtection logger to verify that the correct identifiers are being processed.

Start with apps/meteor/app/authentication/server/lib/restrictLoginAttempts.ts and read isValidAttemptByUser, saveFailedLoginAttempts, and isValidLoginAttemptByIp. Review the existing unit tests for restrictLoginAttempts.ts before running them. Done means email-based failed logins are blocked at the threshold and CIDR ranges in the whitelist allow access, with logger-based manual verification of identifiers.