@nascencestudio/ipguard 0.0.0-stage → 0.1.0

package/dist/runtime/IpGuardPage.astro

@@ -0,0 +1,408 @@
+---
+/**
+ * Dashboard → IP Guard (ADR 0001 §7), admins only: Flagged (the review queue), Blacklist, Banned,
+ * Whitelist, Settings and Check an address. Server-rendered with plain forms posting to
+ * /_ipguard/admin, which redirects back with `saved` or `error=<code>`. Row buttons belong to a small form
+ * per row (`form="…"`), since forms can't nest inside the bulk-selection form.
+ */
+/// <reference types="studiocms/v/types" />
+import { type AdminError, ERRORS } from '../admin.js';
+import { formatCidr, formatIp, parseIp, subjectOf } from '../ip.js';
+import { decide, type IndexedEntry, type ListName, listsOf, WINDOWS } from '../model.js';
+import { abuseIpDb, apiKeyOf, clientIp, disabledByEnvironment } from './guard.js';
+import { countAttempts, loadEntries, loadSettings, scoreStore } from './store.js';
+import { getIpGuardViewer } from './viewer.js';
+
+const ROUTE = '/_ipguard/admin';
+const here = Astro.url.pathname;
+const viewer = await getIpGuardViewer(Astro);
+const VIEWS = ['flagged', 'blacklist', 'banned', 'whitelist', 'settings', 'check'] as const;
+type View = (typeof VIEWS)[number];
+const requested = Astro.url.searchParams.get('view');
+const view: View = VIEWS.includes(requested as View) ? (requested as View) : 'flagged';
+const back = view === 'flagged' ? here : `${here}?view=${view}`;
+const errorCode = Astro.url.searchParams.get('error');
+const error = errorCode && errorCode in ERRORS ? ERRORS[errorCode as AdminError] : null;
+const saved = Astro.url.searchParams.has('saved');
+
+const entries = viewer.isAdmin ? await loadEntries() : [];
+const settings = await loadSettings();
+const yours = clientIp(Astro);
+const now = Date.now();
+const of = (list: ListName) =>
+	entries.filter((e) => e.list === list).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+const on = (list: ListName, range: string) => entries.some((e) => e.list === list && e.range === range);
+const when = (iso: string) =>
+	`${new Date(iso).toLocaleString('en-GB', { dateStyle: 'medium', timeStyle: 'short', timeZone: 'UTC' })} UTC`;
+const SOURCE = { manual: 'Manual', abuseipdb: 'AbuseIPDB', rate_limit: 'Rate limit' } as const;
+const WINDOW_LABEL: Record<number, string> = {
+	300: '5 minutes',
+	900: '15 minutes',
+	1800: '30 minutes',
+	3600: '1 hour',
+	7200: '2 hours',
+	21600: '6 hours',
+	43200: '12 hours',
+	86400: '24 hours',
+};
+const envKey = Boolean(process.env.ABUSEIPDB_API_KEY?.trim());
+const pausedUntil = viewer.isAdmin ? await abuseIpDb().pausedUntil() : null;
+
+// "Check an address": what each step would decide (the Drupal module's pipeline report).
+const checkedText = Astro.url.searchParams.get('ip') ?? '';
+const checked = view === 'check' && checkedText ? parseIp(checkedText) : null;
+let report: null | {
+	address: string;
+	subject: string;
+	lists: ReturnType<typeof listsOf>;
+	attempts: number;
+	score: number | null;
+	decision: ReturnType<typeof decide>;
+} = null;
+if (checked && viewer.isAdmin) {
+	const lists = listsOf(entries, checked, now);
+	const subject = formatCidr(subjectOf(checked));
+	const attempts = await countAttempts(subject, settings.windowSeconds, now);
+	const score = await scoreStore.getScore(formatIp(checked)).catch(() => null);
+	report = {
+		address: formatIp(checked),
+		subject,
+		lists,
+		attempts,
+		score,
+		decision: decide({ on: lists, attempts, score, settings }),
+	};
+}
+const OUTCOME: Record<string, string> = {
+	allow: 'Allowed: the submission goes through and is counted.',
+	ban: 'Banned (and blacklisted): over the rate limit with a high AbuseIPDB score.',
+	blacklist: 'Blacklisted: the AbuseIPDB score is at or above the threshold.',
+	flag: 'Flagged and blocked until reviewed: over the rate limit.',
+};
+Astro.response.headers.set('Cache-Control', 'private, no-store');
+
+const rowForm = (id: string) => `ig-row-${id}`;
+type Row = IndexedEntry;
+---
+
+<div class="ipguard" data-ipguard data-view={view}>
+	{!viewer.isAdmin && <p class="ipguard__notice ipguard__notice--error" role="alert">Only admins can use IP Guard.</p>}
+	{viewer.isAdmin && (
+		<>
+			{disabledByEnvironment() && (
+				<p class="ipguard__notice ipguard__notice--error" role="alert" data-ipguard-env-off>
+					IP Guard is switched off by the <code>IPGUARD_DISABLE</code> environment variable: nothing is checked or banned.
+				</p>
+			)}
+			{!settings.enabled && !disabledByEnvironment() && (
+				<p class="ipguard__notice" role="note">IP Guard is turned off in Settings: nothing is checked or banned.</p>
+			)}
+			{saved && <p class="ipguard__notice" role="status" data-ipguard-saved>Saved.</p>}
+			{error && <p class="ipguard__notice ipguard__notice--error" role="alert" data-ipguard-error={errorCode}>{error}</p>}
+			{yours && (
+				<p class="ipguard__muted">
+					Your current address: <code data-ipguard-yours>{formatIp(yours)}</code> (it can't be banned, blacklisted or flagged).
+				</p>
+			)}
+
+			{view === 'flagged' && (
+				<section class="ipguard__group" aria-labelledby="ig-flagged">
+					<h2 class="ipguard__title" id="ig-flagged">Flagged</h2>
+					<p class="ipguard__muted">
+						Addresses that went over the rate limit ({settings.maxAttempts} attempts per {WINDOW_LABEL[settings.windowSeconds]}).
+						They <strong>can't submit forms until you decide</strong>: ban (no access to the site at all), blacklist (no
+						form submissions), whitelist (never checked again) or dismiss (they can submit again).
+					</p>
+					{of('flagged').length === 0 ? (
+						<p class="ipguard__muted" data-ipguard-empty>Nothing to review.</p>
+					) : (
+						<form method="post" action={ROUTE} data-ipguard-bulk="flagged">
+							<input type="hidden" name="action" value="review" />
+							<input type="hidden" name="return" value={back} />
+							<table class="ipguard__table">
+								<thead>
+									<tr><th scope="col"><span class="ipguard__sr">Select</span></th><th scope="col">Address</th><th scope="col">Reason</th><th scope="col">Flagged</th><th scope="col">Also on</th><th scope="col">Actions</th></tr>
+								</thead>
+								<tbody>
+									{of('flagged').map((row: Row) => (
+										<tr data-ipguard-row={row.id} data-ipguard-range={row.range}>
+											<td><input type="checkbox" name="ids" value={row.id} aria-label={`Select ${row.range}`} /></td>
+											<td><code>{row.range}</code></td>
+											<td>{row.reason}</td>
+											<td>{when(row.createdAt)}</td>
+											<td>{[on('blacklist', row.range) && 'Blacklist', on('banned', row.range) && 'Banned'].filter(Boolean).join(', ') || '—'}</td>
+											<td class="ipguard__actions">
+												<button type="submit" form={rowForm(row.id)} name="op" value="ban" class="ipguard__button ipguard__button--danger" data-ipguard-op="ban">Ban</button>
+												<button type="submit" form={rowForm(row.id)} name="op" value="blacklist" class="ipguard__button ipguard__button--danger" data-ipguard-op="blacklist">Blacklist</button>
+												<button type="submit" form={rowForm(row.id)} name="op" value="whitelist" class="ipguard__button" data-ipguard-op="whitelist">Whitelist</button>
+												<button type="submit" form={rowForm(row.id)} name="op" value="dismiss" class="ipguard__button" data-ipguard-op="dismiss">Dismiss</button>
+											</td>
+										</tr>
+									))}
+								</tbody>
+							</table>
+							<div class="ipguard__bulk">
+								<span class="ipguard__muted">Selected:</span>
+								<button type="submit" name="op" value="dismiss" class="ipguard__button">Dismiss</button>
+								<button type="submit" name="op" value="whitelist" class="ipguard__button">Whitelist</button>
+								<button type="submit" name="op" value="blacklist" class="ipguard__button ipguard__button--danger">Blacklist</button>
+								<button type="submit" name="op" value="ban" class="ipguard__button ipguard__button--danger">Ban</button>
+							</div>
+						</form>
+					)}
+					{of('flagged').map((row: Row) => (
+						<form method="post" action={ROUTE} id={rowForm(row.id)} hidden>
+							<input type="hidden" name="action" value="review" />
+							<input type="hidden" name="return" value={back} />
+							<input type="hidden" name="ids" value={row.id} />
+						</form>
+					))}
+				</section>
+			)}
+
+			{(view === 'blacklist' || view === 'banned' || view === 'whitelist') && (
+				<section class="ipguard__group" aria-labelledby="ig-list">
+					<h2 class="ipguard__title" id="ig-list">{view === 'blacklist' ? 'Blacklist' : view === 'banned' ? 'Banned' : 'Whitelist'}</h2>
+					<p class="ipguard__muted">
+						{view === 'blacklist' && 'These addresses can’t submit forms; the site stays reachable. A block can end on a date.'}
+						{view === 'banned' && 'These addresses get “Access denied” for every page of the site.'}
+						{view === 'whitelist' && 'These addresses are never checked, flagged, blacklisted or banned (your office, for testing).'}
+					</p>
+					{of(view).length === 0 ? (
+						<p class="ipguard__muted" data-ipguard-empty>None yet.</p>
+					) : (
+						<form method="post" action={ROUTE} data-ipguard-bulk={view}>
+							<input type="hidden" name="return" value={back} />
+							<table class="ipguard__table">
+								<thead>
+									<tr>
+										<th scope="col"><span class="ipguard__sr">Select</span></th>
+										<th scope="col">Address</th>
+										<th scope="col">{view === 'whitelist' ? 'Note' : 'Reason'}</th>
+										{view === 'blacklist' && <><th scope="col">Source</th><th scope="col">Expires</th></>}
+										<th scope="col">Added</th>
+										<th scope="col">Actions</th>
+									</tr>
+								</thead>
+								<tbody>
+									{of(view).map((row: Row) => {
+										const expired = Boolean(row.expiresAt && Date.parse(row.expiresAt) <= now);
+										return (
+											<tr data-ipguard-row={row.id} data-ipguard-range={row.range}>
+												<td><input type="checkbox" name="ids" value={row.id} aria-label={`Select ${row.range}`} /></td>
+												<td><code>{row.range}</code></td>
+												<td>{row.reason || '—'}</td>
+												{view === 'blacklist' && (
+													<>
+														<td>{SOURCE[row.source]}{row.score !== undefined ? ` (${row.score}%)` : ''}</td>
+														<td>{row.expiresAt ? `${when(row.expiresAt)}${expired ? ' (ended)' : ''}` : 'Never'}</td>
+													</>
+												)}
+												<td>{when(row.createdAt)} · {row.createdBy ?? 'Automatic'}</td>
+												<td class="ipguard__actions">
+													<button type="submit" form={rowForm(row.id)} name="action" value="remove" class="ipguard__button" data-ipguard-op="remove">Remove</button>
+													{view === 'blacklist' && !on('banned', row.range) && (
+														<button type="submit" form={rowForm(row.id)} name="action" value="ban" class="ipguard__button ipguard__button--danger" data-ipguard-op="ban">Ban</button>
+													)}
+												</td>
+											</tr>
+										);
+									})}
+								</tbody>
+							</table>
+							<div class="ipguard__bulk">
+								<span class="ipguard__muted">Selected:</span>
+								<button type="submit" name="action" value="remove" class="ipguard__button">Remove</button>
+								{view === 'blacklist' && <button type="submit" name="action" value="ban" class="ipguard__button ipguard__button--danger">Ban</button>}
+							</div>
+						</form>
+					)}
+					{of(view).map((row: Row) => (
+						<form method="post" action={ROUTE} id={rowForm(row.id)} hidden>
+							<input type="hidden" name="return" value={back} />
+							<input type="hidden" name="ids" value={row.id} />
+						</form>
+					))}
+
+					<form method="post" action={ROUTE} class="ipguard__add" data-ipguard-add={view}>
+						<input type="hidden" name="action" value="add" />
+						<input type="hidden" name="list" value={view} />
+						<input type="hidden" name="return" value={back} />
+						<h3 class="ipguard__subtitle">Add an address</h3>
+						{view === 'banned' && (
+							<p class="ipguard__muted">A banned address can't load any page. Your own address and whitelisted ones are refused.</p>
+						)}
+						<div class="ipguard__fields">
+							<label class="ipguard__field">
+								<span>Address or range</span>
+								<input class="ipguard__input" name="range" required maxlength="64" placeholder="203.0.113.7 or 203.0.113.0/24" autocomplete="off" spellcheck="false" />
+							</label>
+							<label class="ipguard__field ipguard__field--wide">
+								<span>{view === 'whitelist' ? 'Note' : 'Reason'}</span>
+								<input class="ipguard__input" name="reason" maxlength="255" placeholder={view === 'whitelist' ? 'e.g. Office' : 'For admins only; never shown to visitors'} />
+							</label>
+							{view === 'blacklist' && (
+								<label class="ipguard__field">
+									<span>Ends on (optional)</span>
+									<input class="ipguard__input" type="date" name="expires" />
+								</label>
+							)}
+							<button type="submit" class="ipguard__button ipguard__button--primary">Add</button>
+						</div>
+					</form>
+				</section>
+			)}
+
+			{view === 'settings' && (
+				<section class="ipguard__group" aria-labelledby="ig-settings">
+					<h2 class="ipguard__title" id="ig-settings">Settings</h2>
+					<form method="post" action={ROUTE} class="ipguard__settings" data-ipguard-settings>
+						<input type="hidden" name="action" value="settings" />
+						<input type="hidden" name="return" value={back} />
+						<label class="ipguard__check">
+							<input type="checkbox" name="enabled" checked={settings.enabled} />
+							<span>Check protected actions and enforce bans</span>
+						</label>
+						<fieldset class="ipguard__fieldset">
+							<legend>Rate limit</legend>
+							<div class="ipguard__fields">
+								<label class="ipguard__field">
+									<span>Attempts allowed</span>
+									<input class="ipguard__input" type="number" name="maxAttempts" min="1" max="1000" required value={settings.maxAttempts} />
+								</label>
+								<label class="ipguard__field">
+									<span>Per</span>
+									<select class="ipguard__input" name="windowSeconds">
+										{WINDOWS.map((w) => <option value={w} selected={w === settings.windowSeconds}>{WINDOW_LABEL[w]}</option>)}
+									</select>
+								</label>
+							</div>
+							<p class="ipguard__muted">An address over the limit is flagged and blocked until you review it.</p>
+						</fieldset>
+						<fieldset class="ipguard__fieldset">
+							<legend>AbuseIPDB</legend>
+							<p class="ipguard__muted">
+								With a key, each submitting address is checked against <a href="https://www.abuseipdb.com/" rel="noopener noreferrer">AbuseIPDB</a>
+								(results kept 24 hours; the free plan allows 1,000 checks a day). Addresses at or above the score are
+								blacklisted; banned if they're also over the rate limit. If AbuseIPDB can't answer, nobody is blocked.
+								Mention the check in the site's privacy policy.
+							</p>
+							{envKey ? (
+								<p class="ipguard__muted" data-ipguard-env-key>The key comes from the <code>ABUSEIPDB_API_KEY</code> environment variable.</p>
+							) : (
+								<div class="ipguard__fields">
+									<label class="ipguard__field ipguard__field--wide">
+										<span>API key {settings.apiKey ? '(saved; leave empty to keep it)' : ''}</span>
+										<input class="ipguard__input" type="password" name="apiKey" autocomplete="off" maxlength="200" />
+									</label>
+									{settings.apiKey && (
+										<label class="ipguard__check"><input type="checkbox" name="clearKey" /><span>Remove the saved key</span></label>
+									)}
+								</div>
+							)}
+							<div class="ipguard__fields">
+								<label class="ipguard__field">
+									<span>Blacklist at score (0–100)</span>
+									<input class="ipguard__input" type="number" name="minScore" min="0" max="100" required value={settings.minScore} />
+								</label>
+							</div>
+							{pausedUntil && (
+								<p class="ipguard__notice" data-ipguard-paused>
+									Lookups are paused until {when(new Date(pausedUntil).toISOString())} (the key was refused or the daily limit was reached).
+									<button type="submit" form="ig-resume" class="ipguard__button">Resume now</button>
+								</p>
+							)}
+						</fieldset>
+						<label class="ipguard__field">
+							<span>Message for refused visitors (never says why)</span>
+							<textarea class="ipguard__input" name="blockMessage" rows="3" maxlength="512" required>{settings.blockMessage}</textarea>
+						</label>
+						<div><button type="submit" class="ipguard__button ipguard__button--primary">Save settings</button></div>
+					</form>
+					<form method="post" action={ROUTE} id="ig-resume" hidden>
+						<input type="hidden" name="action" value="resume" />
+						<input type="hidden" name="return" value={back} />
+					</form>
+				</section>
+			)}
+
+			{view === 'check' && (
+				<section class="ipguard__group" aria-labelledby="ig-check">
+					<h2 class="ipguard__title" id="ig-check">Check an address</h2>
+					<p class="ipguard__muted">What would happen to a form submission from this address right now, step by step.</p>
+					<form method="get" action={here} class="ipguard__fields" data-ipguard-check>
+						<input type="hidden" name="view" value="check" />
+						<label class="ipguard__field">
+							<span>Address</span>
+							<input class="ipguard__input" name="ip" required maxlength="64" value={checkedText} autocomplete="off" spellcheck="false" />
+						</label>
+						<button type="submit" class="ipguard__button ipguard__button--primary">Check</button>
+					</form>
+					{checkedText && !checked && <p class="ipguard__notice ipguard__notice--error" role="alert">That isn't a valid address.</p>}
+					{report && (
+						<ol class="ipguard__report" data-ipguard-report>
+							<li>Address <code>{report.address}</code>; automatic actions apply to <code>{report.subject}</code>.</li>
+							<li>{report.lists.whitelist ? `Whitelisted (${report.lists.whitelist.range}): always allowed.` : 'Not whitelisted.'}</li>
+							<li>{report.lists.banned ? `Banned (${report.lists.banned.range}): no access to the site.` : 'Not banned.'}</li>
+							<li>{report.lists.blacklist ? `Blacklisted (${report.lists.blacklist.range}): submissions refused.` : 'Not blacklisted.'}</li>
+							<li>{report.lists.flagged ? `Flagged (${report.lists.flagged.range}): blocked until reviewed.` : 'Not flagged.'}</li>
+							<li>Rate limit: {report.attempts} of {settings.maxAttempts} attempts in the last {WINDOW_LABEL[settings.windowSeconds]}.</li>
+							<li>
+								AbuseIPDB: {report.score !== null ? `score ${report.score}% (threshold ${settings.minScore}%).` : 'not looked up yet.'}
+								{report.score === null && apiKeyOf(settings) && (
+									<form method="post" action={ROUTE} class="ipguard__inline">
+										<input type="hidden" name="action" value="lookup" />
+										<input type="hidden" name="ip" value={report.address} />
+										<input type="hidden" name="return" value={`${here}?view=check`} />
+										<button type="submit" class="ipguard__button" data-ipguard-lookup>Ask AbuseIPDB now (uses one lookup)</button>
+									</form>
+								)}
+							</li>
+							<li data-ipguard-outcome={report.decision.action}>
+								<strong>Outcome: {report.decision.action === 'refuse' ? `refused (${report.decision.because}).` : OUTCOME[report.decision.action]}</strong>
+							</li>
+						</ol>
+					)}
+				</section>
+			)}
+		</>
+	)}
+</div>
+
+<style>
+	.ipguard { display: flex; flex-direction: column; gap: 1rem; padding-bottom: 2rem; color: var(--text-normal, inherit); }
+	.ipguard__group { display: flex; flex-direction: column; gap: 0.75rem; padding: 1rem; background: var(--background-step-1); border: 1px solid var(--border); border-radius: var(--radius-md, 0.5rem); }
+	.ipguard__title { margin: 0; font-size: 1.125rem; }
+	.ipguard__subtitle { margin: 0.5rem 0 0; font-size: 1rem; }
+	.ipguard__muted { margin: 0; color: var(--text-muted, inherit); font-size: 0.875rem; line-height: 1.5; }
+	.ipguard__notice { margin: 0; padding: 0.6rem 0.8rem; background: var(--background-step-1); border: 1px solid var(--border); border-radius: var(--radius-md, 0.5rem); }
+	.ipguard__notice--error { border-left: 4px solid var(--danger-base, hsl(339 80% 45%)); }
+	.ipguard__table { width: 100%; border-collapse: collapse; font-size: 0.875rem; }
+	.ipguard__table th, .ipguard__table td { padding: 0.45rem 0.5rem; text-align: left; vertical-align: middle; border-bottom: 1px solid var(--border); }
+	.ipguard__table th { font-weight: 600; }
+.ipguard code {
+		font-size: 0.8125rem;
+		overflow-wrap: anywhere;
+	}
+	.ipguard__table code {
+		white-space: nowrap;
+	}
+	.ipguard__actions { display: flex; flex-wrap: wrap; gap: 0.35rem; }
+	.ipguard__bulk { display: flex; flex-wrap: wrap; align-items: center; gap: 0.5rem; margin-top: 0.5rem; }
+	.ipguard__add, .ipguard__settings { display: flex; flex-direction: column; gap: 0.75rem; }
+	.ipguard__fields { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 0.75rem; }
+	.ipguard__field { display: flex; flex-direction: column; gap: 0.25rem; font-size: 0.875rem; min-width: 12rem; }
+	.ipguard__field--wide { flex: 1 1 18rem; }
+	.ipguard__input { padding: 0.45rem 0.6rem; font: inherit; color: inherit; background: var(--background-base); border: 1px solid var(--border); border-radius: calc(var(--radius-md, 0.5rem) - 0.125rem); }
+	.ipguard__check { display: flex; gap: 0.5rem; align-items: center; font-size: 0.875rem; }
+	.ipguard__fieldset { display: flex; flex-direction: column; gap: 0.6rem; margin: 0; padding: 0.75rem; border: 1px solid var(--border); border-radius: var(--radius-md, 0.5rem); }
+	.ipguard__fieldset legend { padding: 0 0.25rem; font-weight: 600; }
+	.ipguard__button { padding: 0.35rem 0.7rem; font: inherit; font-size: 0.8125rem; color: inherit; background: var(--background-base); border: 1px solid var(--border); border-radius: calc(var(--radius-md, 0.5rem) - 0.125rem); cursor: pointer; }
+	.ipguard__button:hover { border-color: var(--primary-base); }
+	.ipguard__button--primary { color: var(--text-inverted, #fff); background: var(--primary-base); border-color: var(--primary-base); }
+	.ipguard__button--danger { color: #fff; background: var(--danger-base, hsl(339 80% 45%)); border-color: var(--danger-base, hsl(339 80% 45%)); }
+	.ipguard__button:focus-visible, .ipguard__input:focus-visible, .ipguard__check input:focus-visible { outline: 2px solid var(--primary-base); outline-offset: 2px; }
+	.ipguard__report { display: flex; flex-direction: column; gap: 0.4rem; margin: 0; padding-left: 1.25rem; font-size: 0.9375rem; }
+	.ipguard__inline { display: inline; margin-left: 0.5rem; }
+	.ipguard__sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; }
+</style>

package/dist/runtime/admin-endpoint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `POST /_ipguard/admin`: the dashboard's forms (ADR 0001 §7). Admins only, same origin. Each form names
+ * an `action` and where to go back (`return`, a path on this site); the answer redirects there with
+ * `saved` or `error=<code>` (admin.ts). Every way of blocking an address goes through the lockout guard
+ * (`refusalFor`): never the admin's own address, never a whitelisted one.
+ */
+import type { APIRoute } from 'astro';
+export declare const prerender = false;
+export declare const POST: APIRoute;
+//# sourceMappingURL=admin-endpoint.d.ts.map

package/dist/runtime/admin-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-endpoint.d.ts","sourceRoot":"","sources":["../../src/runtime/admin-endpoint.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAiBtC,eAAO,MAAM,SAAS,QAAQ,CAAC;AAwD/B,eAAO,MAAM,IAAI,EAAE,QA4HlB,CAAC"}

package/dist/runtime/admin-endpoint.js

@@ -0,0 +1,168 @@
+import { parseAdd, parseSettingsForm, selectedIds } from '../admin.js';
+import { formatCidr, formatIp, isSingleAddress, parseCidr, parseIp, subjectOf } from '../ip.js';
+import { refusalFor } from '../model.js';
+import { abuseIpDb, apiKeyOf, clientIp } from './guard.js';
+import { clearAttempts, deleteEntries, forgetScore, loadEntries, loadSettings, newEntryId, saveEntry, saveSettings, } from './store.js';
+import { getIpGuardViewer } from './viewer.js';
+export const prerender = false;
+const MAX_BODY = 64 * 1024;
+const safeReturn = (value) => typeof value === 'string' && /^\/(?!\/)[^\s\\]{0,500}$/.test(value) ? value : '/';
+function redirect(back, outcome) {
+    const url = new URL(back, 'http://x');
+    url.searchParams.delete('saved');
+    url.searchParams.delete('error');
+    if ('saved' in outcome)
+        url.searchParams.set('saved', '');
+    else if ('error' in outcome)
+        url.searchParams.set('error', outcome.error);
+    else
+        for (const [k, v] of Object.entries(outcome.params))
+            url.searchParams.set(k, v);
+    return new Response(null, {
+        status: 303,
+        headers: { Location: `${url.pathname}${url.search}`, 'Cache-Control': 'no-store' },
+    });
+}
+/** Why this range can't be blocked, as an error code, or null. */
+function guard(list, range, adminIp, entries) {
+    return refusalFor(list, range, { adminIp, entries })?.code ?? null;
+}
+const entryFor = (list, range, reason, by, extra = {}) => ({
+    id: newEntryId(),
+    list,
+    range,
+    reason,
+    source: 'manual',
+    createdAt: new Date().toISOString(),
+    createdBy: by,
+    ...extra,
+});
+/** After a review, forget the flagged range's attempts, so a dismissed address can submit again. */
+async function forgetAttempts(range) {
+    await clearAttempts(range);
+    const cidr = parseCidr(range);
+    if (cidr && cidr.version === 6 && isSingleAddress(cidr)) {
+        await clearAttempts(formatCidr(subjectOf({ version: 6, value: cidr.network })));
+    }
+}
+export const POST = async (context) => {
+    if (context.request.headers.get('origin') !== context.url.origin) {
+        return new Response('Cross-origin request refused', { status: 403 });
+    }
+    const viewer = await getIpGuardViewer(context);
+    if (!viewer.isAdmin)
+        return new Response('Admins only', { status: 403 });
+    if (Number(context.request.headers.get('content-length') ?? 0) > MAX_BODY) {
+        return new Response('Too large', { status: 413 });
+    }
+    let form;
+    try {
+        form = await context.request.formData();
+    }
+    catch {
+        return new Response('Bad form', { status: 400 });
+    }
+    const back = safeReturn(form.get('return'));
+    const by = viewer.name ?? 'admin';
+    const adminIp = clientIp(context);
+    try {
+        const entries = await loadEntries();
+        const action = form.get('action');
+        if (action === 'add') {
+            const request = parseAdd(form);
+            if ('error' in request)
+                return redirect(back, request);
+            const range = formatCidr(request.range);
+            if (entries.some((e) => e.list === request.list && e.range === range))
+                return redirect(back, { error: 'exists' });
+            const refused = guard(request.list, request.range, adminIp, entries);
+            if (refused)
+                return redirect(back, { error: refused });
+            await saveEntry(entryFor(request.list, range, request.reason, by, request.list === 'blacklist' ? { expiresAt: request.expiresAt } : {}));
+            return redirect(back, { saved: true });
+        }
+        if (action === 'remove') {
+            const ids = selectedIds(form);
+            if (ids.length === 0)
+                return redirect(back, { error: 'nothing-selected' });
+            await deleteEntries(ids);
+            return redirect(back, { saved: true });
+        }
+        // Flagged review: ban, blacklist, whitelist or dismiss the selected entries.
+        if (action === 'review') {
+            const op = form.get('op');
+            const picked = entries.filter((e) => e.list === 'flagged' && selectedIds(form).includes(e.id));
+            if (picked.length === 0)
+                return redirect(back, { error: 'nothing-selected' });
+            const lists = op === 'ban'
+                ? ['banned', 'blacklist']
+                : op === 'blacklist'
+                    ? ['blacklist']
+                    : op === 'whitelist'
+                        ? ['whitelist']
+                        : [];
+            if (op !== 'dismiss' && lists.length === 0)
+                return redirect(back, { error: 'unknown' });
+            for (const flag of picked) {
+                for (const list of lists) {
+                    const refused = guard(list, flag.cidr, adminIp, entries);
+                    if (refused)
+                        return redirect(back, { error: refused });
+                }
+            }
+            for (const flag of picked) {
+                for (const list of lists) {
+                    if (entries.some((e) => e.list === list && e.range === flag.range))
+                        continue;
+                    await saveEntry(entryFor(list, flag.range, `Flagged: ${flag.reason}`, by, list === 'blacklist' ? { expiresAt: null } : {}));
+                }
+                await forgetAttempts(flag.range);
+            }
+            await deleteEntries(picked.map((e) => e.id));
+            return redirect(back, { saved: true });
+        }
+        // Ban blacklisted entries (they stay on the blacklist).
+        if (action === 'ban') {
+            const picked = entries.filter((e) => e.list === 'blacklist' && selectedIds(form).includes(e.id));
+            if (picked.length === 0)
+                return redirect(back, { error: 'nothing-selected' });
+            for (const entry of picked) {
+                const refused = guard('banned', entry.cidr, adminIp, entries);
+                if (refused)
+                    return redirect(back, { error: refused });
+            }
+            for (const entry of picked) {
+                if (!entries.some((e) => e.list === 'banned' && e.range === entry.range)) {
+                    await saveEntry(entryFor('banned', entry.range, entry.reason || 'From the blacklist', by));
+                }
+            }
+            return redirect(back, { saved: true });
+        }
+        if (action === 'settings') {
+            const settings = parseSettingsForm(form, await loadSettings());
+            if ('error' in settings)
+                return redirect(back, settings);
+            await saveSettings(settings);
+            return redirect(back, { saved: true });
+        }
+        if (action === 'resume') {
+            await abuseIpDb().resume();
+            return redirect(back, { saved: true });
+        }
+        // "Check an address": ask AbuseIPDB now (uses one lookup; the answer is cached for the report).
+        if (action === 'lookup') {
+            const ip = parseIp(form.get('ip'));
+            if (!ip)
+                return redirect(back, { error: 'bad-range' });
+            await forgetScore(formatIp(ip));
+            await abuseIpDb().check(ip, apiKeyOf(await loadSettings()));
+            return redirect(back, { params: { view: 'check', ip: formatIp(ip), looked: '' } });
+        }
+        return redirect(back, { error: 'unknown' });
+    }
+    catch (error) {
+        console.error('[ipguard] admin action failed', error);
+        return redirect(back, { error: 'failed' });
+    }
+};
+//# sourceMappingURL=admin-endpoint.js.map

package/dist/runtime/admin-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-endpoint.js","sourceRoot":"","sources":["../../src/runtime/admin-endpoint.ts"],"names":[],"mappings":"AAQA,OAAO,EAAmB,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EAAgD,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,UAAU,EACV,SAAS,EACT,YAAY,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAE/B,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3B,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CACrC,OAAO,KAAK,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAEnF,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAqF;IACpH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,OAAO;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SACrD,IAAI,OAAO,IAAI,OAAO;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;KAClF,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,SAAS,KAAK,CACb,IAAc,EACd,KAA2B,EAC3B,OAAoC,EACpC,OAAuB;IAEvB,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,QAAQ,GAAG,CAChB,IAAc,EACd,KAAa,EACb,MAAc,EACd,EAAiB,EACjB,QAAwB,EAAE,EAClB,EAAE,CAAC,CAAC;IACZ,EAAE,EAAE,UAAU,EAAE;IAChB,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACnC,SAAS,EAAE,EAAE;IACb,GAAG,KAAK;CACR,CAAC,CAAC;AAEH,oGAAoG;AACpG,KAAK,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAa,KAAK,EAAE,OAAO,EAAE,EAAE;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CACd,QAAQ,CACP,OAAO,CAAC,IAAI,EACZ,KAAK,EACL,OAAO,CAAC,MAAM,EACd,EAAE,EACF,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CACpE,CACD,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3E,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,6EAA6E;QAC7E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9E,MAAM,KAAK,GACV,EAAE,KAAK,KAAK;gBACX,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC;gBACzB,CAAC,CAAC,EAAE,KAAK,WAAW;oBACnB,CAAC,CAAC,CAAC,WAAW,CAAC;oBACf,CAAC,CAAC,EAAE,KAAK,WAAW;wBACnB,CAAC,CAAC,CAAC,WAAW,CAAC;wBACf,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACxF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBACzD,IAAI,OAAO;wBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxD,CAAC;YACF,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAC7E,MAAM,SAAS,CACd,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1G,CAAC;gBACH,CAAC;gBACD,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,wDAAwD;QACxD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,OAAO;oBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1E,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5F,CAAC;YACF,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,gGAAgG;QAChG,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;AACF,CAAC,CAAC","sourcesContent":["/// <reference types=\"studiocms/v/types\" />\n/**\n * `POST /_ipguard/admin`: the dashboard's forms (ADR 0001 §7). Admins only, same origin. Each form names\n * an `action` and where to go back (`return`, a path on this site); the answer redirects there with\n * `saved` or `error=<code>` (admin.ts). Every way of blocking an address goes through the lockout guard\n * (`refusalFor`): never the admin's own address, never a whitelisted one.\n */\nimport type { APIRoute } from 'astro';\nimport { type AdminError, parseAdd, parseSettingsForm, selectedIds } from '../admin.js';\nimport { formatCidr, formatIp, isSingleAddress, parseCidr, parseIp, subjectOf } from '../ip.js';\nimport { type Entry, type IndexedEntry, type ListName, refusalFor } from '../model.js';\nimport { abuseIpDb, apiKeyOf, clientIp } from './guard.js';\nimport {\n\tclearAttempts,\n\tdeleteEntries,\n\tforgetScore,\n\tloadEntries,\n\tloadSettings,\n\tnewEntryId,\n\tsaveEntry,\n\tsaveSettings,\n} from './store.js';\nimport { getIpGuardViewer } from './viewer.js';\n\nexport const prerender = false;\n\nconst MAX_BODY = 64 * 1024;\n\nconst safeReturn = (value: unknown) =>\n\ttypeof value === 'string' && /^\\/(?!\\/)[^\\s\\\\]{0,500}$/.test(value) ? value : '/';\n\nfunction redirect(back: string, outcome: { saved: true } | { error: AdminError } | { params: Record<string, string> }) {\n\tconst url = new URL(back, 'http://x');\n\turl.searchParams.delete('saved');\n\turl.searchParams.delete('error');\n\tif ('saved' in outcome) url.searchParams.set('saved', '');\n\telse if ('error' in outcome) url.searchParams.set('error', outcome.error);\n\telse for (const [k, v] of Object.entries(outcome.params)) url.searchParams.set(k, v);\n\treturn new Response(null, {\n\t\tstatus: 303,\n\t\theaders: { Location: `${url.pathname}${url.search}`, 'Cache-Control': 'no-store' },\n\t});\n}\n\n/** Why this range can't be blocked, as an error code, or null. */\nfunction guard(\n\tlist: ListName,\n\trange: IndexedEntry['cidr'],\n\tadminIp: ReturnType<typeof clientIp>,\n\tentries: IndexedEntry[],\n) {\n\treturn refusalFor(list, range, { adminIp, entries })?.code ?? null;\n}\n\nconst entryFor = (\n\tlist: ListName,\n\trange: string,\n\treason: string,\n\tby: string | null,\n\textra: Partial<Entry> = {},\n): Entry => ({\n\tid: newEntryId(),\n\tlist,\n\trange,\n\treason,\n\tsource: 'manual',\n\tcreatedAt: new Date().toISOString(),\n\tcreatedBy: by,\n\t...extra,\n});\n\n/** After a review, forget the flagged range's attempts, so a dismissed address can submit again. */\nasync function forgetAttempts(range: string) {\n\tawait clearAttempts(range);\n\tconst cidr = parseCidr(range);\n\tif (cidr && cidr.version === 6 && isSingleAddress(cidr)) {\n\t\tawait clearAttempts(formatCidr(subjectOf({ version: 6, value: cidr.network })));\n\t}\n}\n\nexport const POST: APIRoute = async (context) => {\n\tif (context.request.headers.get('origin') !== context.url.origin) {\n\t\treturn new Response('Cross-origin request refused', { status: 403 });\n\t}\n\tconst viewer = await getIpGuardViewer(context);\n\tif (!viewer.isAdmin) return new Response('Admins only', { status: 403 });\n\tif (Number(context.request.headers.get('content-length') ?? 0) > MAX_BODY) {\n\t\treturn new Response('Too large', { status: 413 });\n\t}\n\tlet form: FormData;\n\ttry {\n\t\tform = await context.request.formData();\n\t} catch {\n\t\treturn new Response('Bad form', { status: 400 });\n\t}\n\tconst back = safeReturn(form.get('return'));\n\tconst by = viewer.name ?? 'admin';\n\tconst adminIp = clientIp(context);\n\n\ttry {\n\t\tconst entries = await loadEntries();\n\t\tconst action = form.get('action');\n\n\t\tif (action === 'add') {\n\t\t\tconst request = parseAdd(form);\n\t\t\tif ('error' in request) return redirect(back, request);\n\t\t\tconst range = formatCidr(request.range);\n\t\t\tif (entries.some((e) => e.list === request.list && e.range === range)) return redirect(back, { error: 'exists' });\n\t\t\tconst refused = guard(request.list, request.range, adminIp, entries);\n\t\t\tif (refused) return redirect(back, { error: refused });\n\t\t\tawait saveEntry(\n\t\t\t\tentryFor(\n\t\t\t\t\trequest.list,\n\t\t\t\t\trange,\n\t\t\t\t\trequest.reason,\n\t\t\t\t\tby,\n\t\t\t\t\trequest.list === 'blacklist' ? { expiresAt: request.expiresAt } : {},\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\tif (action === 'remove') {\n\t\t\tconst ids = selectedIds(form);\n\t\t\tif (ids.length === 0) return redirect(back, { error: 'nothing-selected' });\n\t\t\tawait deleteEntries(ids);\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\t// Flagged review: ban, blacklist, whitelist or dismiss the selected entries.\n\t\tif (action === 'review') {\n\t\t\tconst op = form.get('op');\n\t\t\tconst picked = entries.filter((e) => e.list === 'flagged' && selectedIds(form).includes(e.id));\n\t\t\tif (picked.length === 0) return redirect(back, { error: 'nothing-selected' });\n\t\t\tconst lists: ListName[] =\n\t\t\t\top === 'ban'\n\t\t\t\t\t? ['banned', 'blacklist']\n\t\t\t\t\t: op === 'blacklist'\n\t\t\t\t\t\t? ['blacklist']\n\t\t\t\t\t\t: op === 'whitelist'\n\t\t\t\t\t\t\t? ['whitelist']\n\t\t\t\t\t\t\t: [];\n\t\t\tif (op !== 'dismiss' && lists.length === 0) return redirect(back, { error: 'unknown' });\n\t\t\tfor (const flag of picked) {\n\t\t\t\tfor (const list of lists) {\n\t\t\t\t\tconst refused = guard(list, flag.cidr, adminIp, entries);\n\t\t\t\t\tif (refused) return redirect(back, { error: refused });\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const flag of picked) {\n\t\t\t\tfor (const list of lists) {\n\t\t\t\t\tif (entries.some((e) => e.list === list && e.range === flag.range)) continue;\n\t\t\t\t\tawait saveEntry(\n\t\t\t\t\t\tentryFor(list, flag.range, `Flagged: ${flag.reason}`, by, list === 'blacklist' ? { expiresAt: null } : {}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait forgetAttempts(flag.range);\n\t\t\t}\n\t\t\tawait deleteEntries(picked.map((e) => e.id));\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\t// Ban blacklisted entries (they stay on the blacklist).\n\t\tif (action === 'ban') {\n\t\t\tconst picked = entries.filter((e) => e.list === 'blacklist' && selectedIds(form).includes(e.id));\n\t\t\tif (picked.length === 0) return redirect(back, { error: 'nothing-selected' });\n\t\t\tfor (const entry of picked) {\n\t\t\t\tconst refused = guard('banned', entry.cidr, adminIp, entries);\n\t\t\t\tif (refused) return redirect(back, { error: refused });\n\t\t\t}\n\t\t\tfor (const entry of picked) {\n\t\t\t\tif (!entries.some((e) => e.list === 'banned' && e.range === entry.range)) {\n\t\t\t\t\tawait saveEntry(entryFor('banned', entry.range, entry.reason || 'From the blacklist', by));\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\tif (action === 'settings') {\n\t\t\tconst settings = parseSettingsForm(form, await loadSettings());\n\t\t\tif ('error' in settings) return redirect(back, settings);\n\t\t\tawait saveSettings(settings);\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\tif (action === 'resume') {\n\t\t\tawait abuseIpDb().resume();\n\t\t\treturn redirect(back, { saved: true });\n\t\t}\n\n\t\t// \"Check an address\": ask AbuseIPDB now (uses one lookup; the answer is cached for the report).\n\t\tif (action === 'lookup') {\n\t\t\tconst ip = parseIp(form.get('ip'));\n\t\t\tif (!ip) return redirect(back, { error: 'bad-range' });\n\t\t\tawait forgetScore(formatIp(ip));\n\t\t\tawait abuseIpDb().check(ip, apiKeyOf(await loadSettings()));\n\t\t\treturn redirect(back, { params: { view: 'check', ip: formatIp(ip), looked: '' } });\n\t\t}\n\n\t\treturn redirect(back, { error: 'unknown' });\n\t} catch (error) {\n\t\tconsole.error('[ipguard] admin action failed', error);\n\t\treturn redirect(back, { error: 'failed' });\n\t}\n};\n"]}