ldrouter 1.6.0 → 1.6.2

package/dist/server/util/cidr.js

@@ -0,0 +1,91 @@
+// CIDR matching for IPv4 + IPv6.
+import ipaddr from 'ipaddr.js';
+export function parseCidr(input) {
+    const cidr = input.trim();
+    if (!cidr)
+        throw new Error('empty cidr');
+    let base;
+    let prefix;
+    if (cidr.includes('/')) {
+        const parts = cidr.split('/');
+        base = parts[0];
+        prefix = Number(parts[1]);
+    }
+    else {
+        base = cidr;
+        prefix = -1; // -1 = single host, normalized
+    }
+    const parsed = ipaddr.parse(base);
+    const family = parsed.kind() === 'ipv4' ? 'ipv4' : 'ipv6';
+    if (prefix === -1) {
+        prefix = family === 'ipv4' ? 32 : 128;
+    }
+    if (family === 'ipv4' && (prefix < 0 || prefix > 32))
+        throw new Error('invalid ipv4 prefix');
+    if (family === 'ipv6' && (prefix < 0 || prefix > 128))
+        throw new Error('invalid ipv6 prefix');
+    const normalized = `${parsed.toString()}/${prefix}`;
+    return {
+        cidr: normalized,
+        family,
+        prefix,
+        matches(ip) {
+            try {
+                const addr = ipaddr.parse(ip);
+                const addrKind = addr.kind();
+                if (addrKind === family) {
+                    return samePrefix(parsed, addr, prefix);
+                }
+                // IPv4-mapped IPv6 (::ffff:a.b.c.d) satisfies IPv4 CIDR rules.
+                if (family === 'ipv4' && addrKind === 'ipv6') {
+                    const v4 = addr.toIPv4Address();
+                    if (!v4)
+                        return false;
+                    return samePrefix(parsed, v4, prefix);
+                }
+                return false;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+function samePrefix(a, b, prefix) {
+    const aBytes = octets(a);
+    const bBytes = octets(b);
+    const full = aBytes.length * 8;
+    if (prefix === 0)
+        return true;
+    if (prefix >= full)
+        return a.toString() === b.toString();
+    const fullBytes = Math.floor(prefix / 8);
+    const remBits = prefix % 8;
+    for (let i = 0; i < fullBytes; i++) {
+        if (aBytes[i] !== bBytes[i])
+            return false;
+    }
+    if (remBits === 0)
+        return true;
+    const mask = (0xff << (8 - remBits)) & 0xff;
+    return (aBytes[fullBytes] & mask) === (bBytes[fullBytes] & mask);
+}
+function octets(a) {
+    if (a.kind() === 'ipv4') {
+        return a.toByteArray();
+    }
+    return a.toByteArray();
+}
+export function ipMatchesAny(ip, cidrs) {
+    for (const c of cidrs) {
+        try {
+            const parsed = parseCidr(c);
+            if (parsed.matches(ip))
+                return true;
+        }
+        catch {
+            // ignore invalid cidr
+        }
+    }
+    return false;
+}

package/dist/server/util/client-ip.js

@@ -0,0 +1,15 @@
+// Client-IP resolution: trust X-Forwarded-For only when trustProxyHops > 0.
+import { loadConfig } from '../config/index.js';
+export function resolveClientIp(req) {
+    const cfg = loadConfig();
+    if (cfg.trustProxyHops > 0) {
+        const xff = req.headers['x-forwarded-for'];
+        if (typeof xff === 'string') {
+            const chain = xff.split(',').map((s) => s.trim()).filter(Boolean);
+            const idx = Math.max(0, chain.length - cfg.trustProxyHops);
+            if (chain[idx])
+                return chain[idx];
+        }
+    }
+    return req.ip || (req.socket?.remoteAddress ?? '0.0.0.0');
+}

package/dist/server/util/stable-json.js

@@ -0,0 +1,19 @@
+// Stable deterministic JSON serialization for cache key derivation.
+export function stableStringify(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (typeof value === 'object') {
+        const obj = value;
+        const sorted = {};
+        for (const k of Object.keys(obj).sort()) {
+            sorted[k] = sortKeys(obj[k]);
+        }
+        return sorted;
+    }
+    return value;
+}

package/dist/server/version.js

@@ -0,0 +1,35 @@
+// Single source of truth for the running app version.
+//
+// Precedence:
+// 1. LATEDEV_APP_VERSION env (set explicitly, or baked into Docker images via
+//    `ENV LATEDEV_APP_VERSION=${APP_VERSION}`).
+// 2. The package.json found by walking up from this module — works from
+//    dist/server (npm install + Docker) AND the source tree (dev/test), where
+//    npm_package_version is unset.
+// 3. npm_package_version (npm-run scripts).
+// 4. '0.0.0'.
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export function getAppVersion() {
+    // '0.0.0' is the Dockerfile ARG default (local builds pass no arg) — treat
+    // it as unset so the package.json walk yields the real version.
+    if (process.env.LATEDEV_APP_VERSION && process.env.LATEDEV_APP_VERSION !== '0.0.0')
+        return process.env.LATEDEV_APP_VERSION;
+    let dir = __dirname;
+    for (let i = 0; i < 6; i++) {
+        try {
+            const v = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+            if (v)
+                return v;
+        }
+        catch { /* keep climbing */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return process.env.npm_package_version ?? '0.0.0';
+}

package/dist/shared/types.js

@@ -0,0 +1,2 @@
+// Shared public types between server and web admin UI.
+export {};