acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/src/core/middleware/ip-restriction/index.test.ts

@@ -0,0 +1,217 @@
+import { ipRestriction } from './index.ts'
+import type { IPRestrictionRule } from './index.ts'
+import { Context } from '../../context.ts'
+import type { AddressType, GetConnInfo } from '../../helper/conninfo/index.ts'
+import { App } from '../../app.ts'
+
+describe('ipRestriction middleware', () => {
+  it('Should restrict', async () => {
+    const getConnInfo: GetConnInfo = (c) => {
+      return {
+        remote: {
+          address: c.env.ip,
+        },
+      }
+    }
+    const app = new App<{
+      Bindings: {
+        ip: string
+      }
+    }>()
+    app.use(
+      '/basic',
+      ipRestriction(getConnInfo, {
+        allowList: ['192.168.1.0', '192.168.2.0/24'],
+        denyList: ['192.168.2.10'],
+      })
+    )
+    app.get('/basic', (c) => c.text('Hello World!'))
+
+    app.use(
+      '/allow-empty',
+      ipRestriction(getConnInfo, {
+        denyList: ['192.168.1.0'],
+      })
+    )
+    app.get('/allow-empty', (c) => c.text('Hello World!'))
+
+    expect((await app.request('/basic', {}, { ip: '0.0.0.0' })).status).toBe(403)
+
+    expect((await app.request('/basic', {}, { ip: '192.168.1.0' })).status).toBe(200)
+
+    expect((await app.request('/basic', {}, { ip: '192.168.2.5' })).status).toBe(200)
+    expect((await app.request('/basic', {}, { ip: '192.168.2.10' })).status).toBe(403)
+
+    expect((await app.request('/allow-empty', {}, { ip: '0.0.0.0' })).status).toBe(200)
+
+    expect((await app.request('/allow-empty', {}, { ip: '192.168.1.0' })).status).toBe(403)
+
+    expect((await app.request('/allow-empty', {}, { ip: '192.168.2.5' })).status).toBe(200)
+    expect((await app.request('/allow-empty', {}, { ip: '192.168.2.10' })).status).toBe(200)
+  })
+  it('Custom onerror', async () => {
+    const res = await ipRestriction(
+      () => '0.0.0.0',
+      { denyList: ['0.0.0.0'] },
+      () => new Response('error')
+    )(new Context(new Request('http://localhost/')), async () => void 0)
+    expect(res).toBeTruthy()
+    if (res) {
+      expect(await res.text()).toBe('error')
+    }
+  })
+
+  test.each(['999.999.999.999', '2001:db8::1%eth0', '1234:::5678'])(
+    'Should reject invalid remote address: %s',
+    async (ip) => {
+      const app = new App<{
+        Bindings: {
+          ip: string
+        }
+      }>()
+      app.use(
+        '/invalid',
+        ipRestriction(
+          (c) => ({
+            remote: {
+              address: c.env.ip,
+            },
+          }),
+          {
+            allowList: ['127.0.0.1'],
+          }
+        )
+      )
+      app.get('/invalid', (c) => c.text('Hello World!'))
+
+      expect((await app.request('/invalid', {}, { ip })).status).toBe(403)
+    }
+  )
+
+  it('Should not call onError for invalid remote addresses', async () => {
+    const app = new App<{
+      Bindings: {
+        ip: string
+      }
+    }>()
+    app.use(
+      '/invalid',
+      ipRestriction(
+        (c) => ({
+          remote: {
+            address: c.env.ip,
+          },
+        }),
+        {
+          allowList: ['127.0.0.1'],
+        },
+        () => new Response('custom error', { status: 418 })
+      )
+    )
+    app.get('/invalid', (c) => c.text('Hello World!'))
+
+    const res = await app.request('/invalid', {}, { ip: '1234:::5678' })
+    expect(res.status).toBe(403)
+    expect(await res.text()).toBe('Forbidden')
+  })
+})
+
+describe('isMatchForRule', () => {
+  const isMatch = async (info: { addr: string; type: AddressType }, rule: IPRestrictionRule) => {
+    const middleware = ipRestriction(
+      () => ({
+        remote: {
+          address: info.addr,
+          addressType: info.type,
+        },
+      }),
+      {
+        allowList: [rule],
+      }
+    )
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      await middleware(undefined as any, () => Promise.resolve())
+    } catch {
+      return false
+    }
+    return true
+  }
+
+  test.each(['192.168.0.0/33', '::/129', '127.0.0.1/', '::ffff:127.0.0.1/129'])(
+    'Should throw for invalid CIDR rule: %s',
+    (rule) => {
+      expect(() =>
+        ipRestriction(() => '127.0.0.1', {
+          allowList: [rule],
+        })
+      ).toThrow(`Invalid rule: ${rule}`)
+    }
+  )
+
+  it('star', async () => {
+    expect(await isMatch({ addr: '192.168.2.0', type: 'IPv4' }, '*')).toBeTruthy()
+    expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '*')).toBeTruthy()
+    expect(await isMatch({ addr: '::0', type: 'IPv6' }, '*')).toBeTruthy()
+  })
+  it('CIDR Notation', async () => {
+    expect(await isMatch({ addr: '192.168.2.0', type: 'IPv4' }, '192.168.2.0/24')).toBeTruthy()
+    expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '192.168.2.0/24')).toBeTruthy()
+    expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '192.168.2.1/32')).toBeTruthy()
+    expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '192.168.2.2/32')).toBeFalsy()
+
+    expect(await isMatch({ addr: '::0', type: 'IPv6' }, '::0/1')).toBeTruthy()
+    expect(await isMatch({ addr: '::1', type: 'IPv6' }, '0.0.0.0/24')).toBeFalsy()
+    expect(await isMatch({ addr: '::abcd:1', type: 'IPv6' }, '127.0.0.0/8')).toBeFalsy()
+    expect(await isMatch({ addr: '::1', type: 'IPv6' }, '::ffff:1.0.0.0/96')).toBeFalsy()
+
+    expect(
+      await isMatch({ addr: '::ffff:192.168.1.1', type: 'IPv6' }, '::ffff:192.168.1.0/120')
+    ).toBeTruthy()
+    expect(
+      await isMatch({ addr: '192.168.1.1', type: 'IPv4' }, '::ffff:192.168.1.0/120')
+    ).toBeTruthy()
+    expect(
+      await isMatch({ addr: '::ffff:192.168.1.1', type: 'IPv6' }, '192.168.1.0/24')
+    ).toBeTruthy()
+    expect(await isMatch({ addr: '::ffff:10.0.0.1', type: 'IPv6' }, '192.168.1.0/24')).toBeFalsy()
+    expect(await isMatch({ addr: '::ffff:192.168.1.1', type: 'IPv6' }, '::/0')).toBeTruthy()
+    expect(
+      await isMatch({ addr: '::ffff:192.168.1.1', type: 'IPv6' }, '::ffff:0:0/95')
+    ).toBeTruthy()
+  })
+  it('Static Rules', async () => {
+    expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '192.168.2.1')).toBeTruthy()
+    expect(await isMatch({ addr: '1234::5678', type: 'IPv6' }, '1234::5678')).toBeTruthy()
+    expect(
+      await isMatch({ addr: '::ffff:127.0.0.1', type: 'IPv6' }, '::ffff:127.0.0.1')
+    ).toBeTruthy()
+    expect(await isMatch({ addr: '::ffff:127.0.0.1', type: 'IPv6' }, '::ffff:7f00:1')).toBeTruthy()
+    expect(await isMatch({ addr: '127.0.0.1', type: 'IPv4' }, '::ffff:127.0.0.1')).toBeTruthy()
+    // IPv4-mapped IPv6 addresses are canonicalized to IPv4
+    expect(await isMatch({ addr: '::ffff:127.0.0.1', type: 'IPv6' }, '127.0.0.1')).toBeTruthy()
+    expect(await isMatch({ addr: '::ffff:127.0.0.1', type: 'IPv6' }, '127.0.0.2')).toBeFalsy()
+    expect(await isMatch({ addr: '::ffff:7f00:1', type: 'IPv6' }, '127.0.0.1')).toBeTruthy()
+    expect(await isMatch({ addr: '0:0:0:0:0:ffff:7f00:1', type: 'IPv6' }, '127.0.0.1')).toBeTruthy()
+    // regular IPv6 is matched numerically without being treated as IPv4
+    expect(await isMatch({ addr: '::1', type: 'IPv6' }, '::1')).toBeTruthy()
+    expect(
+      await isMatch({ addr: '2001:db8:0:0:0:0:0:1', type: 'IPv6' }, '2001:db8::1')
+    ).toBeTruthy()
+    expect(
+      await isMatch({ addr: '2001:db8::1', type: 'IPv6' }, '2001:db8:0:0:0:0:0:1')
+    ).toBeTruthy()
+    expect(await isMatch({ addr: '::ffff:127.0.0.2', type: 'IPv6' }, '127.0.0.1')).toBeFalsy()
+    expect(await isMatch({ addr: '::7f00:1', type: 'IPv6' }, '127.0.0.1')).toBeFalsy()
+  })
+  it('Function Rules', async () => {
+    expect(await isMatch({ addr: '0.0.0.0', type: 'IPv4' }, () => true)).toBeTruthy()
+    expect(await isMatch({ addr: '0.0.0.0', type: 'IPv4' }, () => false)).toBeFalsy()
+
+    const ipaddr = '93.184.216.34'
+    await isMatch({ addr: ipaddr, type: 'IPv4' }, (ip) => {
+      expect(ipaddr).toBe(ip.addr)
+      return false
+    })
+  })
+})

package/plugins/acryl-router/src/core/middleware/ip-restriction/index.ts

@@ -0,0 +1,278 @@
+/**
+ * IP Restriction Middleware for App
+ * @module
+ */
+
+import type { Context, MiddlewareHandler } from '../../index.ts'
+import type { AddressType, GetConnInfo } from '../../helper/conninfo/index.ts'
+import { HTTPException } from '../../http-exception.ts'
+import type { InvalidIPAddressError } from '../../utils/ipaddr.ts'
+import {
+  convertIPv4MappedIPv6ToIPv4,
+  convertIPv4ToBinary,
+  convertIPv6BinaryToString,
+  convertIPv6ToBinary,
+  distinctRemoteAddr,
+  isIPv4MappedIPv6,
+  INVALID_IP_ADDRESS_ERROR_CODE,
+} from '../../utils/ipaddr.ts'
+
+/**
+ * Function to get IP Address
+ */
+type GetIPAddr = GetConnInfo | ((c: Context) => string)
+
+/**
+ * ### IPv4 and IPv6
+ * - `*` match all
+ *
+ * ### IPv4
+ * - `192.168.2.0` static
+ * - `192.168.2.0/24` CIDR Notation
+ *
+ * ### IPv6
+ * - `::1` static
+ * - `::1/10` CIDR Notation
+ */
+type IPRestrictionRuleFunction = (addr: { addr: string; type: AddressType }) => boolean
+export type IPRestrictionRule = string | ((addr: { addr: string; type: AddressType }) => boolean)
+
+const IS_CIDR_NOTATION_REGEX = /\/[^/]*$/
+const parseCidrPrefix = (rule: string, prefix: string, max: number): number => {
+  if (!/^[0-9]{1,3}$/.test(prefix)) {
+    throw new TypeError(`Invalid rule: ${rule}`)
+  }
+  const parsedPrefix = parseInt(prefix)
+  if (parsedPrefix > max) {
+    throw new TypeError(`Invalid rule: ${rule}`)
+  }
+  return parsedPrefix
+}
+const buildMatcher = (
+  rules: IPRestrictionRule[]
+): ((addr: { addr: string; type: AddressType; isIPv4: boolean }) => boolean) => {
+  const functionRules: IPRestrictionRuleFunction[] = []
+  const staticRules: Set<string> = new Set()
+  const staticIPv4Rules: Set<bigint> = new Set()
+  const staticIPv6Rules: Set<bigint> = new Set()
+  const cidrRules: [boolean, bigint, bigint][] = []
+  const registerStaticRule = (rule: string): void => {
+    const type = distinctRemoteAddr(rule)
+    if (type === undefined) {
+      throw new TypeError(`Invalid rule: ${rule}`)
+    }
+    if (type === 'IPv4') {
+      const ipv4binary = convertIPv4ToBinary(rule)
+      staticRules.add(rule)
+      staticRules.add(`::ffff:${rule}`)
+      staticIPv4Rules.add(ipv4binary)
+      staticIPv6Rules.add((0xffffn << 32n) | ipv4binary)
+    } else {
+      const ipv6binary = convertIPv6ToBinary(rule)
+      const ipv6Addr = convertIPv6BinaryToString(ipv6binary)
+      staticRules.add(ipv6Addr)
+      staticIPv6Rules.add(ipv6binary)
+      if (isIPv4MappedIPv6(ipv6binary)) {
+        staticRules.add(ipv6Addr.substring(7)) // remove ::ffff: prefix
+        staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary))
+      }
+    }
+  }
+
+  for (let rule of rules) {
+    if (rule === '*') {
+      return () => true
+    } else if (typeof rule === 'function') {
+      functionRules.push(rule)
+    } else {
+      if (IS_CIDR_NOTATION_REGEX.test(rule)) {
+        const separatedRule = rule.split('/')
+
+        const addrStr = separatedRule[0]
+        const type = distinctRemoteAddr(addrStr)
+        if (type === undefined) {
+          throw new TypeError(`Invalid rule: ${rule}`)
+        }
+
+        let isIPv4 = type === 'IPv4'
+        let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128)
+
+        if (isIPv4 ? prefix === 32 : prefix === 128) {
+          // this rule is a static rule
+          rule = addrStr
+        } else {
+          let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr)
+          if (type === 'IPv6' && isIPv4MappedIPv6(addr) && prefix >= 96) {
+            isIPv4 = true
+            addr = convertIPv4MappedIPv6ToIPv4(addr)
+            prefix -= 96
+          }
+
+          const mask = ((1n << BigInt(prefix)) - 1n) << BigInt((isIPv4 ? 32 : 128) - prefix)
+
+          cidrRules.push([isIPv4, addr & mask, mask] as [boolean, bigint, bigint])
+          continue
+        }
+      }
+
+      registerStaticRule(rule)
+    }
+  }
+
+  return (remote: {
+    addr: string
+    type: AddressType
+    isIPv4: boolean
+    binaryAddr?: bigint
+  }): boolean => {
+    if (staticRules.has(remote.addr)) {
+      return true
+    }
+    const remoteAddr = (remote.binaryAddr ||= (
+      remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary
+    )(remote.addr))
+    const remoteIPv4Addr =
+      remote.isIPv4 || isIPv4MappedIPv6(remoteAddr)
+        ? remote.isIPv4
+          ? remoteAddr
+          : convertIPv4MappedIPv6ToIPv4(remoteAddr)
+        : undefined
+    if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) {
+      return true
+    }
+    for (const [isIPv4, addr, mask] of cidrRules) {
+      if (isIPv4) {
+        if (remoteIPv4Addr === undefined) {
+          continue
+        }
+        if ((remoteIPv4Addr & mask) === addr) {
+          return true
+        }
+        continue
+      }
+      if (remote.isIPv4) {
+        continue
+      }
+      if ((remoteAddr & mask) === addr) {
+        return true
+      }
+    }
+    for (const rule of functionRules) {
+      if (rule({ addr: remote.addr, type: remote.type })) {
+        return true
+      }
+    }
+    return false
+  }
+}
+
+/**
+ * Rules for IP Restriction Middleware
+ */
+export interface IPRestrictionRules {
+  denyList?: IPRestrictionRule[]
+  allowList?: IPRestrictionRule[]
+}
+
+/**
+ * IP Restriction Middleware for App.
+ *
+ *
+ * @param {GetConnInfo | ((c: Context) => string)} getIP - A function to retrieve the client IP address. Use `getConnInfo` from the appropriate runtime adapter.
+ * @param {IPRestrictionRules} rules - An object with optional `denyList` and `allowList` arrays of IP rules. Each rule can be a static IP, a CIDR range, or a custom function.
+ * @param {(remote: { addr: string; type: AddressType }, c: Context) => Response | Promise<Response>} [onError] - Optional custom handler invoked when a request is blocked. Defaults to returning a 403 Forbidden response.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * import { App } from 'acryl-router'
+ * import { ipRestriction } from 'acryl-router/middleware'
+ * import { getConnInfo } from 'acryl-router/helpers'
+ *
+ * const app = new App()
+ *
+ * app.use(
+ *   '*',
+ *   ipRestriction(getConnInfo, {
+ *     // Block a specific IP and an entire subnet
+ *     denyList: ['192.168.0.5', '10.0.0.0/8'],
+ *     // Only allow requests from localhost and a private range
+ *     allowList: ['127.0.0.1', '::1', '192.168.1.0/24'],
+ *   })
+ * )
+ *
+ * // With a custom error handler
+ * app.use(
+ *   '/admin/*',
+ *   ipRestriction(
+ *     getConnInfo,
+ *     { allowList: ['203.0.113.0/24'] },
+ *     (remote, c) => c.text(`Access denied for ${remote.addr}`, 403)
+ *   )
+ * )
+ *
+ * app.get('/', (c) => c.text('Hello!'))
+ * ```
+ */
+export const ipRestriction = (
+  getIP: GetIPAddr,
+  { denyList = [], allowList = [] }: IPRestrictionRules,
+  onError?: (
+    remote: { addr: string; type: AddressType },
+    c: Context
+  ) => Response | Promise<Response>
+): MiddlewareHandler => {
+  const allowLength = allowList.length
+
+  const denyMatcher = buildMatcher(denyList)
+  const allowMatcher = buildMatcher(allowList)
+
+  const blockError = (c: Context): HTTPException =>
+    new HTTPException(403, {
+      res: c.text('Forbidden', {
+        status: 403,
+      }),
+    })
+
+  return async function ipRestriction(c, next) {
+    const connInfo = getIP(c)
+    const addr = typeof connInfo === 'string' ? connInfo : connInfo.remote.address
+    if (!addr) {
+      throw blockError(c)
+    }
+    const type =
+      (typeof connInfo !== 'string' && connInfo.remote.addressType) || distinctRemoteAddr(addr)
+
+    const remoteData = { addr, type, isIPv4: type === 'IPv4' }
+
+    try {
+      if (denyMatcher(remoteData)) {
+        if (onError) {
+          return onError({ addr, type }, c)
+        }
+        throw blockError(c)
+      }
+      if (allowMatcher(remoteData)) {
+        return await next()
+      }
+    } catch (e) {
+      if (
+        e instanceof TypeError &&
+        (e as InvalidIPAddressError).code === INVALID_IP_ADDRESS_ERROR_CODE
+      ) {
+        // If an invalid IP address is specified, treat it as if no IP address was specified
+        throw blockError(c)
+      }
+      throw e
+    }
+
+    if (allowLength === 0) {
+      return await next()
+    } else {
+      if (onError) {
+        return await onError({ addr, type }, c)
+      }
+      throw blockError(c)
+    }
+  }
+}