@push.rocks/smartproxy 29.1.0 → 30.0.1

package/dist_ts/proxies/smart-proxy/utils/ip-entry-validation.js

@@ -0,0 +1,200 @@
+import * as plugins from '../../../plugins.js';
+/**
+ * Validation of configured IP entries, one rule per Rust parser that reads them.
+ *
+ * Every check accepts exactly what its Rust reader can match and answers why it refuses anything
+ * else, so a configuration that validates never carries an entry the engine silently ignores:
+ *
+ * - Security lists (`security.ipAllowList`, `security.ipBlockList`, `defaults.security`,
+ *   `securityPolicy.blockedIps`/`blockedCidrs`) are read by `rustproxy-security` `IpPattern::parse`:
+ *   `*`, an address or an `ipnet` prefix, compared as parsed addresses with the client converted
+ *   from IPv4-mapped IPv6 to IPv4. Anything else becomes `0.0.0.0` and never matches.
+ * - Source matches (`match.clientIp`, `trustedProxyIPs` of a route policy or the settings) are read
+ *   by `rustproxy-routing` `matchers::ip_matches`: `*`, an `ipnet` prefix, a four-part IPv4 wildcard,
+ *   or an exact address compared as text against the client's Rust `Display` form, after a leading
+ *   `::ffff:` is stripped from both sides.
+ * - VPN assigned addresses (`security.vpn.allowedAssignedIps`) are compared as text against the
+ *   address the VPN metadata carries.
+ *
+ * A check answers `null` for an entry it accepts, else the reason it refuses it.
+ */
+const ipv4MappedPrefixLength = 96;
+/** An address without a zone index, in any textual form `node:net` and Rust both read. */
+const ipFamilyOf = (value) => {
+    if (value.includes('%'))
+        return 0;
+    return plugins.net.isIP(value);
+};
+/** The eight 16-bit segments of an IPv6 address `node:net` already accepted. */
+const ipv6SegmentsOf = (address) => {
+    const toSegments = (text) => {
+        if (text === '')
+            return [];
+        const segments = [];
+        for (const part of text.split(':')) {
+            if (part.includes('.')) {
+                const [a, b, c, d] = part.split('.').map(Number);
+                segments.push((a << 8) | b, (c << 8) | d);
+            }
+            else {
+                segments.push(parseInt(part, 16));
+            }
+        }
+        return segments;
+    };
+    const compressionAt = address.indexOf('::');
+    if (compressionAt === -1) {
+        return toSegments(address);
+    }
+    const head = toSegments(address.slice(0, compressionAt));
+    const tail = toSegments(address.slice(compressionAt + 2));
+    return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
+};
+/** The IPv4 address an IPv4-mapped IPv6 address (`::ffff:a.b.c.d`) carries, else `null`. */
+const ipv4MappedOf = (segments) => {
+    if (segments.slice(0, 5).some((segment) => segment !== 0) || segments[5] !== 0xffff) {
+        return null;
+    }
+    return [segments[6] >> 8, segments[6] & 0xff, segments[7] >> 8, segments[7] & 0xff].join('.');
+};
+/**
+ * The address as Rust's `Display` writes it: IPv4 unchanged (`node:net` admits only plain decimal
+ * octets), IPv4-mapped IPv6 as `::ffff:a.b.c.d`, any other IPv6 in lowercase hex without leading
+ * zeros and with the first longest run of two or more zero segments written as `::`.
+ */
+export const formatIpAddress = (address) => {
+    if (ipFamilyOf(address) !== 6) {
+        return address;
+    }
+    const segments = ipv6SegmentsOf(address);
+    const mapped = ipv4MappedOf(segments);
+    if (mapped !== null) {
+        return `::ffff:${mapped}`;
+    }
+    let longestStart = 0;
+    let longestLength = 0;
+    let currentStart = 0;
+    let currentLength = 0;
+    segments.forEach((segment, index) => {
+        if (segment === 0) {
+            if (currentLength === 0)
+                currentStart = index;
+            currentLength += 1;
+            if (currentLength > longestLength) {
+                longestStart = currentStart;
+                longestLength = currentLength;
+            }
+        }
+        else {
+            currentLength = 0;
+        }
+    });
+    const hex = (part) => part.map((segment) => segment.toString(16)).join(':');
+    if (longestLength > 1) {
+        return `${hex(segments.slice(0, longestStart))}::${hex(segments.slice(longestStart + longestLength))}`;
+    }
+    return hex(segments);
+};
+/**
+ * An address, `/` and a prefix length as `ipnet` parses it: up to two digits and at most 32 for
+ * IPv4, up to three digits and at most 128 for IPv6. Host bits may be set.
+ */
+const parsePrefix = (value) => {
+    const parts = value.split('/');
+    if (parts.length !== 2)
+        return null;
+    const [address, lengthText] = parts;
+    const family = ipFamilyOf(address);
+    if (family === 4 && /^\d{1,2}$/.test(lengthText) && Number(lengthText) <= 32) {
+        return { address, family, length: Number(lengthText) };
+    }
+    if (family === 6 && /^\d{1,3}$/.test(lengthText) && Number(lengthText) <= 128) {
+        return { address, family, length: Number(lengthText) };
+    }
+    return null;
+};
+/** The IPv4 prefix an IPv4-mapped IPv6 prefix of at least 96 bits covers, else `null`. */
+const ipv4PrefixOfMapped = (prefix) => {
+    if (prefix.family !== 6 || prefix.length < ipv4MappedPrefixLength)
+        return null;
+    const mapped = ipv4MappedOf(ipv6SegmentsOf(prefix.address));
+    return mapped === null ? null : `${mapped}/${prefix.length - ipv4MappedPrefixLength}`;
+};
+/** A four-part IPv4 wildcard with plain decimal octets first and only `*` parts after them. */
+const isIpv4TrailingWildcard = (value) => {
+    const parts = value.split('.');
+    if (parts.length !== 4)
+        return false;
+    const firstWildcard = parts.indexOf('*');
+    if (firstWildcard === -1)
+        return false;
+    return parts.slice(0, firstWildcard).every((part) => /^(0|[1-9]\d{0,2})$/.test(part) && Number(part) <= 255)
+        && parts.slice(firstWildcard).every((part) => part === '*');
+};
+const zoneIndexReason = 'a zone index (%…) is not supported';
+/** Checks an entry of a security list: `ipAllowList`, `ipBlockList` or a global block list. */
+export const checkSecurityIpEntry = (entry) => {
+    if (typeof entry !== 'string')
+        return 'must be a string';
+    if (entry === '*')
+        return null;
+    if (entry.includes('%'))
+        return zoneIndexReason;
+    const family = ipFamilyOf(entry);
+    if (family !== 0) {
+        const mapped = family === 6 ? ipv4MappedOf(ipv6SegmentsOf(entry)) : null;
+        return mapped === null
+            ? null
+            : `an IPv4-mapped address never matches, because clients are compared as IPv4; write ${mapped}`;
+    }
+    const prefix = parsePrefix(entry);
+    if (prefix) {
+        const ipv4Prefix = ipv4PrefixOfMapped(prefix);
+        return ipv4Prefix === null
+            ? null
+            : `an IPv4-mapped prefix never matches, because clients are compared as IPv4; write ${ipv4Prefix}`;
+    }
+    return "must be '*', an IPv4 or IPv6 address, or an address prefix such as 192.0.2.0/24";
+};
+/** Checks a source-match entry: `match.clientIp` or a `trustedProxyIPs` entry. */
+export const checkSourceMatchIpEntry = (entry) => {
+    if (typeof entry !== 'string')
+        return 'must be a string';
+    if (entry === '*')
+        return null;
+    if (entry.includes('%'))
+        return zoneIndexReason;
+    if (ipFamilyOf(entry) !== 0) {
+        const canonical = formatIpAddress(entry);
+        return canonical === entry
+            ? null
+            : `an exact address is compared as text with the client address; write ${canonical}`;
+    }
+    const prefix = parsePrefix(entry);
+    if (prefix) {
+        const ipv4Prefix = ipv4PrefixOfMapped(prefix);
+        return ipv4Prefix === null
+            ? null
+            : `an IPv4-mapped prefix never matches, because clients are compared as IPv4; write ${ipv4Prefix}`;
+    }
+    if (isIpv4TrailingWildcard(entry))
+        return null;
+    return "must be '*', an IPv4 or IPv6 address, an address prefix such as 192.0.2.0/24, "
+        + 'or a four-part IPv4 wildcard such as 192.0.2.*';
+};
+/** Checks a `security.vpn.allowedAssignedIps` entry. */
+export const checkAssignedIpEntry = (entry) => {
+    if (typeof entry !== 'string')
+        return 'must be a string';
+    if (entry.includes('%'))
+        return zoneIndexReason;
+    if (ipFamilyOf(entry) === 0)
+        return 'must be one IPv4 or IPv6 address';
+    const canonical = formatIpAddress(entry);
+    return canonical === entry
+        ? null
+        : `an assigned address is compared as text with the VPN client's address; write ${canonical}`;
+};
+/** Formats one refused entry for a validation message. */
+export const describeRefusedIpEntry = (labelArg, entryArg, reasonArg) => `${labelArg}: ${String(entryArg)} (${reasonArg})`;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXAtZW50cnktdmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL3Byb3hpZXMvc21hcnQtcHJveHkvdXRpbHMvaXAtZW50cnktdmFsaWRhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBRS9DOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFFSCxNQUFNLHNCQUFzQixHQUFHLEVBQUUsQ0FBQztBQUVsQywwRkFBMEY7QUFDMUYsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFhLEVBQWEsRUFBRTtJQUM5QyxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxDQUFDLENBQUM7SUFDbEMsT0FBTyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQWMsQ0FBQztBQUM5QyxDQUFDLENBQUM7QUFFRixnRkFBZ0Y7QUFDaEYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxPQUFlLEVBQVksRUFBRTtJQUNuRCxNQUFNLFVBQVUsR0FBRyxDQUFDLElBQVksRUFBWSxFQUFFO1FBQzVDLElBQUksSUFBSSxLQUFLLEVBQUU7WUFBRSxPQUFPLEVBQUUsQ0FBQztRQUMzQixNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7UUFDOUIsS0FBSyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDakQsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDNUMsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFFBQVEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3BDLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1QyxJQUFJLGFBQWEsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE9BQU8sVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUN6RCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxhQUFhLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRCxPQUFPLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxJQUFJLEtBQUssQ0FBUyxDQUFDLEdBQUcsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7QUFDekYsQ0FBQyxDQUFDO0FBRUYsNEZBQTRGO0FBQzVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBa0IsRUFBaUIsRUFBRTtJQUN6RCxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLENBQUMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUNwRixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNoRyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsT0FBZSxFQUFVLEVBQUU7SUFDekQsSUFBSSxVQUFVLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUIsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN6QyxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdEMsSUFBSSxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDcEIsT0FBTyxVQUFVLE1BQU0sRUFBRSxDQUFDO0lBQzVCLENBQUM7SUFDRCxJQUFJLFlBQVksR0FBRyxDQUFDLENBQUM7SUFDckIsSUFBSSxhQUFhLEdBQUcsQ0FBQyxDQUFDO0lBQ3RCLElBQUksWUFBWSxHQUFHLENBQUMsQ0FBQztJQUNyQixJQUFJLGFBQWEsR0FBRyxDQUFDLENBQUM7SUFDdEIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRTtRQUNsQyxJQUFJLE9BQU8sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNsQixJQUFJLGFBQWEsS0FBSyxDQUFDO2dCQUFFLFlBQVksR0FBRyxLQUFLLENBQUM7WUFDOUMsYUFBYSxJQUFJLENBQUMsQ0FBQztZQUNuQixJQUFJLGFBQWEsR0FBRyxhQUFhLEVBQUUsQ0FBQztnQkFDbEMsWUFBWSxHQUFHLFlBQVksQ0FBQztnQkFDNUIsYUFBYSxHQUFHLGFBQWEsQ0FBQztZQUNoQyxDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixhQUFhLEdBQUcsQ0FBQyxDQUFDO1FBQ3BCLENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sR0FBRyxHQUFHLENBQUMsSUFBYyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3RGLElBQUksYUFBYSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE9BQU8sR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsS0FBSyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLEdBQUcsYUFBYSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3pHLENBQUM7SUFDRCxPQUFPLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUN2QixDQUFDLENBQUM7QUFRRjs7O0dBR0c7QUFDSCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWEsRUFBd0IsRUFBRTtJQUMxRCxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9CLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDcEMsTUFBTSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsR0FBRyxLQUFLLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ25DLElBQUksTUFBTSxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUM5RSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBRUYsMEZBQTBGO0FBQzFGLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxNQUFxQixFQUFpQixFQUFFO0lBQ2xFLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxzQkFBc0I7UUFBRSxPQUFPLElBQUksQ0FBQztJQUMvRSxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQzVELE9BQU8sTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLE1BQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLHNCQUFzQixFQUFFLENBQUM7QUFDeEYsQ0FBQyxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxLQUFhLEVBQVcsRUFBRTtJQUN4RCxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9CLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDckMsTUFBTSxhQUFhLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QyxJQUFJLGFBQWEsS0FBSyxDQUFDLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN2QyxPQUFPLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUM7V0FDdkcsS0FBSyxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixNQUFNLGVBQWUsR0FBRyxvQ0FBb0MsQ0FBQztBQUU3RCwrRkFBK0Y7QUFDL0YsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxLQUFjLEVBQWlCLEVBQUU7SUFDcEUsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxrQkFBa0IsQ0FBQztJQUN6RCxJQUFJLEtBQUssS0FBSyxHQUFHO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDL0IsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ2hELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQyxJQUFJLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqQixNQUFNLE1BQU0sR0FBRyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN6RSxPQUFPLE1BQU0sS0FBSyxJQUFJO1lBQ3BCLENBQUMsQ0FBQyxJQUFJO1lBQ04sQ0FBQyxDQUFDLHFGQUFxRixNQUFNLEVBQUUsQ0FBQztJQUNwRyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxFQUFFLENBQUM7UUFDWCxNQUFNLFVBQVUsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QyxPQUFPLFVBQVUsS0FBSyxJQUFJO1lBQ3hCLENBQUMsQ0FBQyxJQUFJO1lBQ04sQ0FBQyxDQUFDLG9GQUFvRixVQUFVLEVBQUUsQ0FBQztJQUN2RyxDQUFDO0lBQ0QsT0FBTyxpRkFBaUYsQ0FBQztBQUMzRixDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxLQUFjLEVBQWlCLEVBQUU7SUFDdkUsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxrQkFBa0IsQ0FBQztJQUN6RCxJQUFJLEtBQUssS0FBSyxHQUFHO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDL0IsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ2hELElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzVCLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN6QyxPQUFPLFNBQVMsS0FBSyxLQUFLO1lBQ3hCLENBQUMsQ0FBQyxJQUFJO1lBQ04sQ0FBQyxDQUFDLHVFQUF1RSxTQUFTLEVBQUUsQ0FBQztJQUN6RixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxFQUFFLENBQUM7UUFDWCxNQUFNLFVBQVUsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QyxPQUFPLFVBQVUsS0FBSyxJQUFJO1lBQ3hCLENBQUMsQ0FBQyxJQUFJO1lBQ04sQ0FBQyxDQUFDLG9GQUFvRixVQUFVLEVBQUUsQ0FBQztJQUN2RyxDQUFDO0lBQ0QsSUFBSSxzQkFBc0IsQ0FBQyxLQUFLLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUMvQyxPQUFPLGdGQUFnRjtVQUNuRixnREFBZ0QsQ0FBQztBQUN2RCxDQUFDLENBQUM7QUFFRix3REFBd0Q7QUFDeEQsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxLQUFjLEVBQWlCLEVBQUU7SUFDcEUsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxrQkFBa0IsQ0FBQztJQUN6RCxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxlQUFlLENBQUM7SUFDaEQsSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztRQUFFLE9BQU8sa0NBQWtDLENBQUM7SUFDdkUsTUFBTSxTQUFTLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sU0FBUyxLQUFLLEtBQUs7UUFDeEIsQ0FBQyxDQUFDLElBQUk7UUFDTixDQUFDLENBQUMsZ0ZBQWdGLFNBQVMsRUFBRSxDQUFDO0FBQ2xHLENBQUMsQ0FBQztBQUVGLDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWdCLEVBQUUsUUFBaUIsRUFBRSxTQUFpQixFQUFVLEVBQUUsQ0FDdkcsR0FBRyxRQUFRLEtBQUssTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLFNBQVMsR0FBRyxDQUFDIn0=

package/dist_ts/proxies/smart-proxy/utils/route-validation-error.d.ts

@@ -22,3 +22,12 @@ export declare class RouteValidationError extends Error {
     readonly errors: IRouteValidationErrorEntry[];
     constructor(summaryArg: string, errorsArg: IRouteValidationErrorEntry[]);
 }
+/**
+ * Thrown when SmartProxy refuses settings outside its routes because they failed validation.
+ *
+ * `messages` lists every reason. The message names the first reasons only.
+ */
+export declare class SettingsValidationError extends Error {
+    readonly messages: string[];
+    constructor(summaryArg: string, messagesArg: string[]);
+}

package/dist_ts/proxies/smart-proxy/utils/route-validation-error.js

@@ -38,4 +38,22 @@ export class RouteValidationError extends Error {
         this.errors = errorsArg;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUtdmFsaWRhdGlvbi1lcnJvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL3Byb3hpZXMvc21hcnQtcHJveHkvdXRpbHMvcm91dGUtdmFsaWRhdGlvbi1lcnJvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFlQSxNQUFNLHFCQUFxQixHQUFHLEVBQUUsQ0FBQztBQUNqQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsQ0FBQztBQUM1QyxNQUFNLDBCQUEwQixHQUFHLEdBQUcsQ0FBQztBQUV2QyxTQUFTLFlBQVksQ0FBQyxPQUFlO0lBQ25DLE9BQU8sT0FBTyxDQUFDLE1BQU0sR0FBRywwQkFBMEI7UUFDaEQsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsMEJBQTBCLENBQUMsR0FBRztRQUNwRCxDQUFDLENBQUMsT0FBTyxDQUFDO0FBQ2QsQ0FBQztBQUVELFNBQVMsV0FBVyxDQUFDLFFBQW9DO0lBQ3ZELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxRQUFRO1NBQ3BDLEtBQUssQ0FBQyxDQUFDLEVBQUUsaUNBQWlDLENBQUM7U0FDM0MsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3JCLE1BQU0sa0JBQWtCLEdBQUcsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQztJQUMzRSxJQUFJLGtCQUFrQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNCLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxrQkFBa0IsT0FBTyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE9BQU8sVUFBVSxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUNoRixDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsVUFBa0IsRUFBRSxTQUF1QztJQUNoRixNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMvRSxNQUFNLGdCQUFnQixHQUFHLFNBQVMsQ0FBQyxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQztJQUMvRCxJQUFJLGdCQUFnQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxnQkFBZ0IsZ0JBQWdCLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsT0FBTyxHQUFHLFVBQVUsS0FBSyxTQUFTLENBQUMsTUFBTSwwQkFBMEIsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQy9GLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxvQkFBcUIsU0FBUSxLQUFLO0lBQzdCLE1BQU0sQ0FBK0I7SUFFckQsWUFBWSxVQUFrQixFQUFFLFNBQXVDO1FBQ3JFLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxzQkFBc0IsQ0FBQztRQUNuQyxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztJQUMxQixDQUFDO0NBQ0YifQ==
+/**
+ * Thrown when SmartProxy refuses settings outside its routes because they failed validation.
+ *
+ * `messages` lists every reason. The message names the first reasons only.
+ */
+export class SettingsValidationError extends Error {
+    messages;
+    constructor(summaryArg, messagesArg) {
+        const shownMessages = messagesArg.slice(0, MAX_MESSAGES_PER_ROUTE_IN_MESSAGE).map(truncateText);
+        const hiddenMessageCount = messagesArg.length - shownMessages.length;
+        if (hiddenMessageCount > 0) {
+            shownMessages.push(`and ${hiddenMessageCount} more`);
+        }
+        super(`${summaryArg}: ${shownMessages.join('; ')}`);
+        this.name = 'SettingsValidationError';
+        this.messages = messagesArg;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUtdmFsaWRhdGlvbi1lcnJvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL3Byb3hpZXMvc21hcnQtcHJveHkvdXRpbHMvcm91dGUtdmFsaWRhdGlvbi1lcnJvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFlQSxNQUFNLHFCQUFxQixHQUFHLEVBQUUsQ0FBQztBQUNqQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsQ0FBQztBQUM1QyxNQUFNLDBCQUEwQixHQUFHLEdBQUcsQ0FBQztBQUV2QyxTQUFTLFlBQVksQ0FBQyxPQUFlO0lBQ25DLE9BQU8sT0FBTyxDQUFDLE1BQU0sR0FBRywwQkFBMEI7UUFDaEQsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsMEJBQTBCLENBQUMsR0FBRztRQUNwRCxDQUFDLENBQUMsT0FBTyxDQUFDO0FBQ2QsQ0FBQztBQUVELFNBQVMsV0FBVyxDQUFDLFFBQW9DO0lBQ3ZELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxRQUFRO1NBQ3BDLEtBQUssQ0FBQyxDQUFDLEVBQUUsaUNBQWlDLENBQUM7U0FDM0MsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3JCLE1BQU0sa0JBQWtCLEdBQUcsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQztJQUMzRSxJQUFJLGtCQUFrQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNCLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxrQkFBa0IsT0FBTyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE9BQU8sVUFBVSxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUNoRixDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsVUFBa0IsRUFBRSxTQUF1QztJQUNoRixNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMvRSxNQUFNLGdCQUFnQixHQUFHLFNBQVMsQ0FBQyxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQztJQUMvRCxJQUFJLGdCQUFnQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxnQkFBZ0IsZ0JBQWdCLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsT0FBTyxHQUFHLFVBQVUsS0FBSyxTQUFTLENBQUMsTUFBTSwwQkFBMEIsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQy9GLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxvQkFBcUIsU0FBUSxLQUFLO0lBQzdCLE1BQU0sQ0FBK0I7SUFFckQsWUFBWSxVQUFrQixFQUFFLFNBQXVDO1FBQ3JFLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxzQkFBc0IsQ0FBQztRQUNuQyxJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztJQUMxQixDQUFDO0NBQ0Y7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLHVCQUF3QixTQUFRLEtBQUs7SUFDaEMsUUFBUSxDQUFXO0lBRW5DLFlBQVksVUFBa0IsRUFBRSxXQUFxQjtRQUNuRCxNQUFNLGFBQWEsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxpQ0FBaUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNoRyxNQUFNLGtCQUFrQixHQUFHLFdBQVcsQ0FBQyxNQUFNLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQztRQUNyRSxJQUFJLGtCQUFrQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzNCLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxrQkFBa0IsT0FBTyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELEtBQUssQ0FBQyxHQUFHLFVBQVUsS0FBSyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUMsSUFBSSxHQUFHLHlCQUF5QixDQUFDO1FBQ3RDLElBQUksQ0FBQyxRQUFRLEdBQUcsV0FBVyxDQUFDO0lBQzlCLENBQUM7Q0FDRiJ9

package/dist_ts/proxies/smart-proxy/utils/route-validator.d.ts

@@ -1,4 +1,5 @@
 import type { IRouteConfig, IRouteMatch, IRouteAction } from '../models/route-types.js';
+import type { ISmartProxyOptions, ISmartProxySecurityPolicy } from '../models/interfaces.js';
 import { type IRouteValidationErrorEntry } from './route-validation-error.js';
 /**
  * Validates route configurations for correctness and safety
@@ -22,6 +23,14 @@ export declare class RouteValidator {
      * A name or id that several routes share gets `[<index>]` appended, so every label is unique.
      */
     static getRouteLabels(routes: IRouteConfig[]): string[];
+    /**
+     * Validate the IP entries of the settings outside routes: the global `trustedProxyIPs`, the
+     * `defaults.security` lists the engine copies into routes without security, and the global
+     * `securityPolicy`. Answers every reason, empty when the settings are valid.
+     */
+    static validateSettings(settings: Pick<ISmartProxyOptions, 'trustedProxyIPs' | 'defaults' | 'securityPolicy'>): string[];
+    /** Validate the IP entries of a global ingress security policy. */
+    static validateSecurityPolicy(policy: ISmartProxySecurityPolicy): string[];
     /**
      * Validate multiple route configurations.
      *
@@ -54,18 +63,6 @@ export declare class RouteValidator {
      * Validate path pattern
      */
     private static isValidPath;
-    /**
-     * Validate IP pattern
-     */
-    private static isValidIPPattern;
-    /**
-     * Validate IPv4 address
-     */
-    private static isValidIPv4;
-    /**
-     * Validate IPv6 address
-     */
-    private static isValidIPv6;
     /**
      * Log validation errors
      */