@zuplo/runtime 6.74.7 → 6.74.10

package/out/types/index.d.ts

@@ -145,10 +145,12 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
  * Authenticates requests to an AI Gateway v2 endpoint with application API
  * keys.
  *
- * Place this policy first in the inbound chain. The policies that follow can
- * read the authenticated application from `request.user` (`sub` is the
- * application name, `data` its metadata), and the application's AI Gateway
- * configuration takes effect for the request. Use `authHeader` and
+ * Add this policy to an application's `inboundPolicyChain` to require a key
+ * for that app only, or place it on the route before the configuration
+ * executor to require a key for every application on the route. The policies
+ * that follow can read the authenticated application from `request.user`
+ * (`sub` is the application name, `data` its metadata), and the application's
+ * AI Gateway configuration takes effect for the request. Use `authHeader` and
  * `authScheme` when clients send their app key somewhere other than the
  * default `Authorization: Bearer` header.
  *
@@ -7187,6 +7189,60 @@ declare interface InRule {
   in: [string | number | boolean, ...(string | number | boolean)[]];
 }
 
+/**
+ * Restricts which client IP addresses can call a route using an allow list, a
+ * deny list, or both. Entries are individual IP addresses or CIDR ranges, in
+ * IPv4 or IPv6.
+ *
+ * @title IP Address Restriction
+ * @product api-gateway
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class IpAddressRestrictionInboundPolicy extends InboundPolicy<IpAddressRestrictionInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ip-address-restriction";
+  constructor(
+    options: IpAddressRestrictionInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface IpAddressRestrictionInboundPolicyOptions {
+  /**
+   * The IP addresses and CIDR ranges that are allowed to call the route. When set, requests from every other address are rejected with a `403 Forbidden`.
+   *
+   * @minItems 1
+   */
+  allow?: [string, ...string[]];
+  /**
+   * The IP addresses and CIDR ranges that are rejected with a `403 Forbidden`. Evaluated before `allow`, so an address matching both lists is rejected.
+   *
+   * @minItems 1
+   */
+  deny?: [string, ...string[]];
+  /**
+   * Read the client IP address from this header instead of the standard forwarding headers (`x-real-ip`, `true-client-ip`, `cf-connecting-ip`, then the first entry of `x-forwarded-for`). Only set this when a proxy in front of the gateway reports the client address in a non-standard header.
+   */
+  clientIpHeader?: string;
+  /**
+   * Allow requests whose client IP address cannot be determined. By default these requests are rejected when an `allow` list is set, because an unknown address cannot be on it.
+   */
+  allowUnknownIpAddress?: boolean;
+}
+
 /**
  * ISO 3166-1 Alpha-2 codes
  * @public

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.74.7",
+  "version": "6.74.10",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {