@forestadmin/agent 1.91.0 → 1.91.1

package/dist/routes/security/ip-whitelist.d.ts

@@ -5,9 +5,11 @@ import BaseRoute from '../base-route';
 export default class IpWhitelist extends BaseRoute {
     type: RouteType;
     private configuration;
+    private allowedIps;
     setupRoutes(router: Router): void;
     /** Load whitelist */
     bootstrap(): Promise<void>;
+    private static allowRule;
     checkIp(context: Context, next: Next): Promise<boolean>;
     private isTrustedInternalCaller;
 }

package/dist/routes/security/ip-whitelist.js

@@ -3,10 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const forest_ip_utils_1 = __importDefault(require("forest-ip-utils"));
+const net_1 = require("net");
 const types_1 = require("../../types");
 const base_route_1 = __importDefault(require("../base-route"));
 const LOOPBACK_IPS = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
+const ipVersion = (ip) => ((0, net_1.isIPv6)(ip) ? 'ipv6' : 'ipv4');
 class IpWhitelist extends base_route_1.default {
     constructor() {
         super(...arguments);
@@ -18,6 +19,27 @@ class IpWhitelist extends base_route_1.default {
     /** Load whitelist */
     async bootstrap() {
         this.configuration = await this.options.forestAdminClient.getIpWhitelistConfiguration();
+        this.allowedIps = new net_1.BlockList();
+        this.configuration.ipRules.forEach(rule => {
+            try {
+                IpWhitelist.allowRule(this.allowedIps, rule);
+            }
+            catch (error) {
+                this.options.logger('Warn', `IP whitelist: ignoring invalid rule ${JSON.stringify(rule)}`);
+            }
+        });
+    }
+    static allowRule(allowedIps, rule) {
+        if (rule.type === 0) {
+            allowedIps.addAddress(rule.ip, ipVersion(rule.ip));
+        }
+        else if (rule.type === 1) {
+            allowedIps.addRange(rule.ipMinimum, rule.ipMaximum, ipVersion(rule.ipMinimum));
+        }
+        else {
+            const [ip, prefix] = rule.range.split('/');
+            allowedIps.addSubnet(ip, Number(prefix), ipVersion(ip));
+        }
     }
     async checkIp(context, next) {
         if (this.configuration.isFeatureEnabled) {
@@ -25,10 +47,8 @@ class IpWhitelist extends base_route_1.default {
                 this.options.logger('Debug', 'IP whitelist: exempting trusted internal caller');
                 return next();
             }
-            const { ipRules } = this.configuration;
-            const currentIp = context.request.headers['x-forwarded-for'] ?? context.request.ip;
-            const allowed = ipRules.some(ipRule => forest_ip_utils_1.default.isIpMatchesRule(currentIp, ipRule));
-            if (!allowed) {
+            const currentIp = `${context.request.headers['x-forwarded-for'] ?? context.request.ip}`;
+            if (!this.allowedIps.check(currentIp, ipVersion(currentIp))) {
                 return context.throw(types_1.HttpCode.Forbidden, `IP address rejected (${currentIp})`);
             }
         }
@@ -44,4 +64,4 @@ class IpWhitelist extends base_route_1.default {
     }
 }
 exports.default = IpWhitelist;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXAtd2hpdGVsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3JvdXRlcy9zZWN1cml0eS9pcC13aGl0ZWxpc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFJQSxzRUFBcUM7QUFFckMsdUNBQWtEO0FBQ2xELCtEQUFzQztBQUV0QyxNQUFNLFlBQVksR0FBRyxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQUU5RCxNQUFxQixXQUFZLFNBQVEsb0JBQVM7SUFBbEQ7O1FBQ0UsU0FBSSxHQUFHLGlCQUFTLENBQUMsY0FBYyxDQUFDO0lBMENsQyxDQUFDO0lBdENDLFdBQVcsQ0FBQyxNQUFjO1FBQ3hCLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBRUQscUJBQXFCO0lBQ1osS0FBSyxDQUFDLFNBQVM7UUFDdEIsSUFBSSxDQUFDLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsMkJBQTJCLEVBQUUsQ0FBQztJQUMxRixDQUFDO0lBRUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFnQixFQUFFLElBQVU7UUFDeEMsSUFBSSxJQUFJLENBQUMsYUFBYSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDeEMsSUFBSSxJQUFJLENBQUMsdUJBQXVCLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLGlEQUFpRCxDQUFDLENBQUM7Z0JBRWhGLE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDaEIsQ0FBQztZQUVELE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3ZDLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLHlCQUFNLENBQUMsZUFBZSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBRWxGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDYixPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQVEsQ0FBQyxTQUFTLEVBQUUsd0JBQXdCLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDakYsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxpR0FBaUc7SUFDakcsNEZBQTRGO0lBQzVGLHVGQUF1RjtJQUN2RixvR0FBb0c7SUFDNUYsdUJBQXVCLENBQUMsT0FBZ0I7UUFDOUMsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsYUFBYSxJQUFJLEVBQUUsQ0FBQztRQUUxRCxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7Q0FDRjtBQTNDRCw4QkEyQ0MifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXAtd2hpdGVsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3JvdXRlcy9zZWN1cml0eS9pcC13aGl0ZWxpc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFJQSw2QkFBd0M7QUFFeEMsdUNBQWtEO0FBQ2xELCtEQUFzQztBQUl0QyxNQUFNLFlBQVksR0FBRyxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQUU5RCxNQUFNLFNBQVMsR0FBRyxDQUFDLEVBQVUsRUFBbUIsRUFBRSxDQUFDLENBQUMsSUFBQSxZQUFNLEVBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUM7QUFFbEYsTUFBcUIsV0FBWSxTQUFRLG9CQUFTO0lBQWxEOztRQUNFLFNBQUksR0FBRyxpQkFBUyxDQUFDLGNBQWMsQ0FBQztJQStEbEMsQ0FBQztJQXpEQyxXQUFXLENBQUMsTUFBYztRQUN4QixNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVELHFCQUFxQjtJQUNaLEtBQUssQ0FBQyxTQUFTO1FBQ3RCLElBQUksQ0FBQyxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLDJCQUEyQixFQUFFLENBQUM7UUFDeEYsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLGVBQVMsRUFBRSxDQUFDO1FBRWxDLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRTtZQUN4QyxJQUFJLENBQUM7Z0JBQ0gsV0FBVyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQy9DLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx1Q0FBdUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0YsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBcUIsRUFBRSxJQUFZO1FBQzFELElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwQixVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7YUFBTSxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDM0IsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUUzQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQWdCLEVBQUUsSUFBVTtRQUN4QyxJQUFJLElBQUksQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN4QyxJQUFJLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsaURBQWlELENBQUMsQ0FBQztnQkFFaEYsT0FBTyxJQUFJLEVBQUUsQ0FBQztZQUNoQixDQUFDO1lBRUQsTUFBTSxTQUFTLEdBQUcsR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLENBQUM7WUFFeEYsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUM1RCxPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQVEsQ0FBQyxTQUFTLEVBQUUsd0JBQXdCLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDakYsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxpR0FBaUc7SUFDakcsNEZBQTRGO0lBQzVGLHVGQUF1RjtJQUN2RixvR0FBb0c7SUFDNUYsdUJBQXVCLENBQUMsT0FBZ0I7UUFDOUMsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsYUFBYSxJQUFJLEVBQUUsQ0FBQztRQUUxRCxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7Q0FDRjtBQWhFRCw4QkFnRUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent",
-  "version": "1.91.0",
+  "version": "1.91.1",
   "main": "dist/index.js",
   "license": "GPL-3.0",
   "publishConfig": {
@@ -23,7 +23,6 @@
     "@koa/router": "^13.1.0",
     "@paralleldrive/cuid2": "2.2.2",
     "@types/koa__router": "^12.0.4",
-    "forest-ip-utils": "^1.0.1",
     "json-api-serializer": "^2.6.6",
     "json-stringify-pretty-compact": "^3.0.0",
     "jsonwebtoken": "^9.0.3",