@forestadmin/agent 1.86.1 → 1.86.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
6
6
|
const forest_ip_utils_1 = __importDefault(require("forest-ip-utils"));
|
|
7
7
|
const types_1 = require("../../types");
|
|
8
8
|
const base_route_1 = __importDefault(require("../base-route"));
|
|
9
|
+
const LOOPBACK_IPS = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
|
|
9
10
|
class IpWhitelist extends base_route_1.default {
|
|
10
11
|
constructor() {
|
|
11
12
|
super(...arguments);
|
|
@@ -20,6 +21,10 @@ class IpWhitelist extends base_route_1.default {
|
|
|
20
21
|
}
|
|
21
22
|
async checkIp(context, next) {
|
|
22
23
|
if (this.configuration.isFeatureEnabled) {
|
|
24
|
+
if (this.isTrustedInternalCaller(context)) {
|
|
25
|
+
this.options.logger('Debug', 'IP whitelist: exempting trusted internal caller');
|
|
26
|
+
return next();
|
|
27
|
+
}
|
|
23
28
|
const { ipRules } = this.configuration;
|
|
24
29
|
const currentIp = context.request.headers['x-forwarded-for'] ?? context.request.ip;
|
|
25
30
|
const allowed = ipRules.some(ipRule => forest_ip_utils_1.default.isIpMatchesRule(currentIp, ipRule));
|
|
@@ -29,6 +34,14 @@ class IpWhitelist extends base_route_1.default {
|
|
|
29
34
|
}
|
|
30
35
|
return next();
|
|
31
36
|
}
|
|
37
|
+
// A caller reaching us directly over a loopback socket with no proxy hop (no x-forwarded-for) is
|
|
38
|
+
// on this host and already JWT-authenticated (koa-jwt runs before this) — e.g. the embedded
|
|
39
|
+
// executor's loopback call. Keys off the socket peer (req.socket.remoteAddress), never
|
|
40
|
+
// request.ip / x-forwarded-for, which follow the spoofable header once the host app sets app.proxy.
|
|
41
|
+
isTrustedInternalCaller(context) {
|
|
42
|
+
const socketIp = context.req?.socket?.remoteAddress ?? '';
|
|
43
|
+
return LOOPBACK_IPS.includes(socketIp) && !context.request.headers['x-forwarded-for'];
|
|
44
|
+
}
|
|
32
45
|
}
|
|
33
46
|
exports.default = IpWhitelist;
|
|
34
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
47
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXAtd2hpdGVsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3JvdXRlcy9zZWN1cml0eS9pcC13aGl0ZWxpc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFJQSxzRUFBcUM7QUFFckMsdUNBQWtEO0FBQ2xELCtEQUFzQztBQUV0QyxNQUFNLFlBQVksR0FBRyxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQUU5RCxNQUFxQixXQUFZLFNBQVEsb0JBQVM7SUFBbEQ7O1FBQ0UsU0FBSSxHQUFHLGlCQUFTLENBQUMsY0FBYyxDQUFDO0lBMENsQyxDQUFDO0lBdENDLFdBQVcsQ0FBQyxNQUFjO1FBQ3hCLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBRUQscUJBQXFCO0lBQ1osS0FBSyxDQUFDLFNBQVM7UUFDdEIsSUFBSSxDQUFDLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsMkJBQTJCLEVBQUUsQ0FBQztJQUMxRixDQUFDO0lBRUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFnQixFQUFFLElBQVU7UUFDeEMsSUFBSSxJQUFJLENBQUMsYUFBYSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDeEMsSUFBSSxJQUFJLENBQUMsdUJBQXVCLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLGlEQUFpRCxDQUFDLENBQUM7Z0JBRWhGLE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDaEIsQ0FBQztZQUVELE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3ZDLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLHlCQUFNLENBQUMsZUFBZSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBRWxGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDYixPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQVEsQ0FBQyxTQUFTLEVBQUUsd0JBQXdCLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDakYsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxpR0FBaUc7SUFDakcsNEZBQTRGO0lBQzVGLHVGQUF1RjtJQUN2RixvR0FBb0c7SUFDNUYsdUJBQXVCLENBQUMsT0FBZ0I7UUFDOUMsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsYUFBYSxJQUFJLEVBQUUsQ0FBQztRQUUxRCxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7Q0FDRjtBQTNDRCw4QkEyQ0MifQ==
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@forestadmin/agent",
|
|
3
|
-
"version": "1.86.
|
|
3
|
+
"version": "1.86.3",
|
|
4
4
|
"main": "dist/index.js",
|
|
5
5
|
"license": "GPL-3.0",
|
|
6
6
|
"publishConfig": {
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
"@forestadmin/datasource-customizer": "1.69.3",
|
|
18
18
|
"@forestadmin/datasource-toolkit": "1.53.1",
|
|
19
19
|
"@forestadmin/forestadmin-client": "1.40.4",
|
|
20
|
-
"@forestadmin/mcp-server": "1.17.
|
|
20
|
+
"@forestadmin/mcp-server": "1.17.2",
|
|
21
21
|
"@koa/bodyparser": "^6.0.0",
|
|
22
22
|
"@koa/cors": "^5.0.0",
|
|
23
23
|
"@koa/router": "^13.1.0",
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
"devDependencies": {
|
|
49
49
|
"@fastify/express": "^1.1.0",
|
|
50
50
|
"@forestadmin/datasource-sql": "1.17.10",
|
|
51
|
-
"@forestadmin/workflow-executor": "1.
|
|
51
|
+
"@forestadmin/workflow-executor": "1.16.0",
|
|
52
52
|
"@nestjs/common": "^10.4.16",
|
|
53
53
|
"@nestjs/core": "^10.4.16",
|
|
54
54
|
"@nestjs/platform-express": "^10.4.16",
|
|
@@ -71,7 +71,7 @@
|
|
|
71
71
|
},
|
|
72
72
|
"peerDependencies": {
|
|
73
73
|
"@fastify/express": "^1.1.0 || ^2.0.0 || ^3.0.0 || ^4.0.0",
|
|
74
|
-
"@forestadmin/workflow-executor": "1.
|
|
74
|
+
"@forestadmin/workflow-executor": "1.16.0"
|
|
75
75
|
},
|
|
76
76
|
"peerDependenciesMeta": {
|
|
77
77
|
"@fastify/express": {
|