nestjs-ip-filter 0.2.0 → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+## 1.0.0
+
+### Breaking changes
+
+- Rules are IPv4/IPv6 addresses and CIDR ranges instead of regular expressions; an invalid entry throws at startup or from a setter. An IPv4-mapped rule with an IPv6 prefix under 96 is rejected.
+- The client IP is `req.ip`, which follows the app's `trust proxy` setting, instead of forwarded headers read from anyone.
+- The filter mode is explicit: a configured `whitelist` (even `[]`) allows only its matches; without one, everyone not blacklisted is allowed. Configuring neither list (`undefined` or `null`) throws at startup.
+- `IpFilterDenyException` carries only `{ clientIp }`.
+- `IpFilterService.whitelist` / `blacklist` return `string[] | undefined` (a copy, or `undefined` when not configured).
+- Requires NestJS 11 or 12 (now peer dependencies) and Node.js `>=22.12.0`.
+- Removed the unused `IpFilterDenyHandler` interface.
+
+### Fixed
+
+- The guard crashed on GraphQL requests and denied every WebSocket/RPC message; non-HTTP contexts now pass through unfiltered.
+- A rule like `10.0.0.1` also matched `110.0.0.15` (unanchored regex).
+- A forged `X-Forwarded-For` header bypassed the whitelist.
+- With both lists set, the whitelist was ignored.
+- Denied clients received the full whitelist and blacklist in the exception response.
+
+### Added
+
+- `global: false` to apply the guard only where `@UseGuards(IpFilterGuard)` is used (#519).
+- `IpFilterGuard` and `IPFILTER_TOKEN` resolve in every module; register `IpFilter` once in the root module.
+- IPv6 rules.
+- Tests and CI for Node.js 22/24 and NestJS 11/12 (#68).
+
+### Removed
+
+- The `@supercharge/request-ip` dependency; the package has no runtime dependencies.
+- The `example/` project; the README covers its usage.

package/README.md

@@ -1,14 +1,16 @@
 # NestJS IP Filter
 
-Now we can filter the incoming requests by setting the whitelist and the blacklist IP addresses.
+A NestJS guard that allows or denies requests by client IP address, using whitelists and blacklists of IPv4/IPv6 addresses and CIDR ranges.
 
-It will work using the built-in feature in NestJS, **Guard**, so it works like a charm as it should be and as much as it should do.
+It filters HTTP requests. GraphQL, WebSocket and microservice (RPC) contexts are not filtered and pass through.
 
-The Guard recognizes the requester's IP address using [@supercharge/request-ip](https://www.npmjs.com/package/request-ip) package.
+## Requirements
 
-## How to install
+- NestJS 11 or 12
+- Node.js `>=22.12.0`
+- The Express platform (`@nestjs/platform-express`)
 
-Simply, install using NPM by the following command.
+## Install
 
 ```bash
 npm install nestjs-ip-filter
@@ -16,180 +18,152 @@ npm install nestjs-ip-filter
 
 ## Usage
 
-### Use Regex for the IP list
-
-> In Express-based framework, the incoming IP address will have prefix `::ffff:` characters. So if you have put `(^192.168.)` into the whitelist, it won't work because that regex describes it must have number `1` as a first character.
-> So for now, you should put that prefix for your regex string like `(^::ffff:192.168.)`. Will patch the source codes in the near future.
-
-You can use the Regex format string for the IP ranges.
-
-For a simple example, if you want to allow the private network hosts in `192.168.0.1/16`, you can write the Regex string like the below.
-
-```bash
-# 192.168.0.0 ~ 192.168.255.255
-(^192.168.)
-```
-
-Check the other use cases.
-
-```bash
-# 192.168.0.100 ~ 192.168.0.110
-(^192.168.0.1[0-1]0)
-
-# 172.16.16.10, 172.16.17.10, 172.16.18.10
-(^172.16.1[6-8].10)
-
-# 110~119.*
-(^11[0-9].*)
-```
-
-And, writing in this way also works on this package.
-
-But be aware of that you should write the Regex string very carefully to avoid allowing unwanted incoming IP addresses.
-
-### Basic usage for Whitelist
-
-You can initialize the dedicated Guard using non-async or async mode, as the other NestJS packages support.
-
-Use `register` for the static IP address list.
+Import `IpFilter` once, in your root module. The guard then applies to every route, and `IpFilterGuard` and `IPFILTER_TOKEN` are available in every module.
 
 ```typescript
-IpFilter.register({
-  whitelist: [
-    '(^::1)',
-    '(^192.168.)',
-    '127.0.0.1',
+import { Module } from '@nestjs/common';
+import { IpFilter } from 'nestjs-ip-filter';
+
+@Module({
+  imports: [
+    IpFilter.register({
+      whitelist: ['127.0.0.1', '::1', '192.168.0.0/16'],
+    }),
   ],
-}),
+})
+export class AppModule {}
 ```
 
-Or, use `registerAsync` for the provided IP addresses from the other Provider, such as ConfigModule or RepositoryModule for your database.
+Use `registerAsync` to load the lists from another provider, such as a config service or a database.
 
 ```typescript
-// If it would like to get the whitelist IPs from a config file,
-// and if MyConfigModule provides that
-
 IpFilter.registerAsync({
-  imports: [ MyConfigModule ],
-  inject: [ MyConfigService ],
-  useFactory: async (myConfigService: MyConfigService) => ({
-    whitelist: myConfigService.getWhitelist(),
+  imports: [ConfigModule],
+  inject: [ConfigService],
+  useFactory: (config: ConfigService) => ({
+    whitelist: config.get<string[]>('ipFilter.whitelist'),
+    blacklist: config.get<string[]>('ipFilter.blacklist'),
   }),
-}),
+});
 ```
 
-Yeah, you can use your method to provide some async data.
+### Rules
 
-After setting up the `IpFilter` module with the `register*` method, this will accept only the incoming requests for the given whitelist IP addresses.
+Each entry is an IPv4 or IPv6 address, or a CIDR range:
 
-### Blacklist
-
-You can deny the requests that are from the blacklist IPs.
+```typescript
+'10.0.0.1'; // one address
+'10.0.0.0/8'; // 10.0.0.0 – 10.255.255.255
+'2001:db8::/32'; // an IPv6 range
+```
 
-Use `blacklist` option to let the Guard know the list.
+IPv4-mapped IPv6 client addresses (`::ffff:10.1.2.3`) match IPv4 rules, so write IPv4 ranges as IPv4 CIDR.
+A mapped rule with an IPv6 prefix under 96 (`::ffff:192.168.0.0/16`) is rejected: as an IPv6 range it would span all of IPv4.
+An invalid entry throws when the module starts or when a list is set, so a typo never silently matches nothing.
 
-```typescript
-// If it would like to get the whitelist IPs from a config file,
-// and if MyConfigModule provides that
+### How a request is evaluated
 
-IpFilter.registerAsync({
-  imports: [ MyConfigModule ],
-  inject: [ MyConfigService ],
-  useFactory: async (myConfigService: MyConfigService) => ({
-    whitelist: myConfigService.getWhitelist(),
-    blacklist: myConfigService.getBlacklist(),
-  }),
-}),
-```
+1. A client IP in the `blacklist` is denied.
+2. If a `whitelist` is configured, only client IPs in it are allowed. An empty whitelist (`[]`) allows nobody.
+3. If no `whitelist` is configured, every client IP not denied by step 1 is allowed.
 
-Then its NestJS Guard will deny all the IPs which are from the blacklist.
+At least one of `whitelist` and `blacklist` must be configured; otherwise the module throws at startup.
+This way a missing configuration value fails loudly instead of opening or closing everything.
 
-### Use IpFilterDenyException when denying a request
+| `whitelist` | `blacklist` | Allowed |
+| --- | --- | --- |
+| `['10.0.0.0/8']` | not set | `10.0.0.0/8` only |
+| not set | `['10.0.0.5']` | everyone except `10.0.0.5` |
+| `['10.0.0.0/8']` | `['10.0.0.5']` | `10.0.0.0/8` except `10.0.0.5` |
+| `[]` | not set | nobody |
+| not set | `[]` | everyone |
+| not set | not set | throws at startup |
 
-You can handle the denial condition by catching the HTTP exception.
+### Behind a proxy or load balancer
 
-If you want to throw that `IpFilterDenyException` when denial, set the option `useDenyException` to `true`.
+The guard uses `req.ip`, so the client IP follows Express's [`trust proxy`](https://expressjs.com/en/guide/behind-proxies.html) setting.
+Forwarded headers such as `X-Forwarded-For` are used only from proxies you trust; anyone else can forge them.
 
 ```typescript
-// If it would like to get the whitelist IPs from a config file,
-// and if MyConfigModule provides that
+import { NestFactory } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 
-IpFilter.registerAsync({
-  imports: [ MyConfigModule ],
-  inject: [ MyConfigService ],
-  useFactory: async (myConfigService: MyConfigService) => ({
-    whitelist: myConfigService.getWhitelist(),
-    blacklist: myConfigService.getBlacklist(),
-    useDenyException: true,
-  }),
-}),
+const app = await NestFactory.create<NestExpressApplication>(AppModule);
+app.set('trust proxy', 'loopback'); // or the proxy's address/CIDR, or the number of hops
 ```
 
-Then it will throw `IpFilterDenyException` when the request is denied for the given whitelist or the blacklist.
+Without it, every request behind a proxy appears to come from the proxy's address.
 
-So that, you can handle the denied request and can send a custom response on that handler, using NestJS **Exception Filter**.
+### Apply to some routes only
 
-When the Guard throws an exception, it will also carry some informative data like the incoming IP address, current whitelist and blacklist.
+Set `global: false` in the root module and add `IpFilterGuard` where you need it, in any module.
 
-### Inject IpFilterService
-
-If you want, you can inject `IpFilterService` into your code and can see current options you put when you initialize it. And, you can set the whitelist and the blacklist too.
+```typescript
+@Module({
+  imports: [IpFilter.register({ whitelist: ['10.0.0.0/8'], global: false }), AdminModule],
+})
+export class AppModule {}
 
-Inject the service using the `IPFILTER_TOKEN` module.
+@Controller('admin')
+@UseGuards(IpFilterGuard)
+export class AdminController {}
 
-```typescript
-@Injectable()
-export class SomeService {
-  constructor(
-    @inject(IPFILTER_TOKEN)
-    private readonly ipFilterService: IpFilterService
-  ) {}
-  // ...
-}
+@Module({ controllers: [AdminController] })
+export class AdminModule {}
 ```
 
-Then you can edit the whitelist, blacklist IP addresses dynamically.
+### Handle denied requests
+
+By default a denied request gets NestJS's standard `403 Forbidden`.
+With `useDenyException: true` the guard throws `IpFilterDenyException` instead, whose response is `{ clientIp }`, so you can catch it in an exception filter.
 
 ```typescript
-this.ipFilterService.whitelist = [ {NEW_WHITELIST} ];
-this.ipFilterService.blacklist = [ {NEW_BLACKLIST} ];
+@Catch(IpFilterDenyException)
+export class IpFilterDenyExceptionFilter implements ExceptionFilter {
+  catch(exception: IpFilterDenyException, host: ArgumentsHost) {
+    const { clientIp } = exception.getResponse() as { clientIp?: string };
+    host.switchToHttp().getResponse<Response>().status(403).json({ message: 'Forbidden', clientIp });
+  }
+}
 ```
 
-## Example project
+### Change the lists at runtime
 
-This repository contains an example project of this `nestjs-ip-filter` package.
+Inject `IpFilterService` with `IPFILTER_TOKEN`. Setting a list replaces it and applies to the next request; an invalid entry throws and keeps the previous list.
 
-Move to `example` directory and run the following commands.
+```typescript
+@Injectable()
+export class IpRulesService {
+  constructor(@Inject(IPFILTER_TOKEN) private readonly ipFilter: IpFilterService) {}
 
-```bash
-npm ci
-npm start:debug
+  block(address: string) {
+    this.ipFilter.blacklist = [...(this.ipFilter.blacklist ?? []), address];
+  }
+}
 ```
 
-Then, the example project will run in **3001** port.
-
-With the `curl` command, you can do a simple test for the project.
-
-```bash
-curl -X GET -H "Content-Type: application/json" http://localhost:3001/ipfilter
-```
+The getters return a copy of the list, or `undefined` when that list is not configured. Emptying a list keeps the mode: an empty whitelist still allows nobody.
+Setting a whitelist on an app that had none switches it to whitelist mode, so only the whitelisted addresses pass from then on.
 
-It will result like the below, if your localhost IP is accepted for the whitelist.
+## Migrating from 0.x
 
-```bash
-{"whitelist":["(^::1)","(^192.168.)","127.0.0.1"],"blacklist":[]}
-```
+- **Rules are addresses and CIDR ranges, not regular expressions.** Rewrite `'(^192.168.)'` as `'192.168.0.0/16'` and drop the `::ffff:` prefix workaround (write `'192.168.0.0/16'`, not `'::ffff:192.168.0.0/16'`). A regex entry now throws at startup.
+- **The client IP is `req.ip`.** 0.x read `X-Forwarded-For` and similar headers from anyone, which allowed spoofing. Behind a proxy, set [`trust proxy`](#behind-a-proxy-or-load-balancer).
+- **The blacklist no longer overrides the whitelist.** With both lists set, a client must be in the whitelist and not in the blacklist; 0.x let anyone outside the blacklist through.
+- **Configure at least one list** (`null` counts as not configured). 0.x denied everything when both lists were empty. Set `whitelist: []` to keep that behavior, for example when the lists are filled at runtime.
+- **`IpFilterDenyException` carries only `{ clientIp }`.** 0.x also sent both lists to the denied client.
+- **The getters return `string[] | undefined`.**
+- NestJS 11 or 12 and Node.js `>=22.12.0` are required.
 
-If it denies, it will result like the below. Check the `ipFilterData` field.
+## Development
 
 ```bash
-{"statusCode":403,"timestamp":"2022-06-13T09:29:40.452Z","ipFilterData":{"clientIp":"::ffff:127.0.0.1","whitelist":["(^::1)","(^192.168.)"],"blacklist":[]},"path":"/ipfilter"}
+npm ci
+npm run lint
+npm test
+npm run build
 ```
 
-[Our exception filter](example/src/exception/ipfilter-exception-filter.exception.ts) put that additional field on the typical HttpException results.
-
-You can test the projects with your local host IP address, [by editing the whitelist and the blacklist](example/src/ip-repository/ip-repository.service.ts).
-
 ## License
 
-It follows the [MIT license](LICENSE).
+[MIT](LICENSE)

package/dist/index.js

@@ -21,4 +21,3 @@ __exportStar(require("./ipfilter.interface"), exports);
 __exportStar(require("./ipfilter.module"), exports);
 __exportStar(require("./ipfilter.module-definition"), exports);
 __exportStar(require("./ipfilter.service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/ipfilter-deny.exception.js

@@ -8,4 +8,3 @@ class IpFilterDenyException extends common_1.HttpException {
     }
 }
 exports.IpFilterDenyException = IpFilterDenyException;
-//# sourceMappingURL=ipfilter-deny.exception.js.map

package/dist/ipfilter.constants.js

@@ -2,4 +2,3 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IPFILTER_TOKEN = void 0;
 exports.IPFILTER_TOKEN = Symbol('IpFilterToken');
-//# sourceMappingURL=ipfilter.constants.js.map

package/dist/ipfilter.guard.d.ts

@@ -1,8 +1,7 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { Observable } from 'rxjs';
-import { IpFilterService } from './ipfilter.service';
+import type { IpFilterService } from './ipfilter.service';
 export declare class IpFilterGuard implements CanActivate {
     private readonly ipFilterService;
     constructor(ipFilterService: IpFilterService);
-    canActivate(context: ExecutionContext): Promise<boolean> | Observable<boolean> | boolean;
+    canActivate(context: ExecutionContext): boolean;
 }

package/dist/ipfilter.guard.js

@@ -14,44 +14,30 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IpFilterGuard = void 0;
 const common_1 = require("@nestjs/common");
-const requestIp = require("@supercharge/request-ip");
-const ipfilter_service_1 = require("./ipfilter.service");
 const ipfilter_constants_1 = require("./ipfilter.constants");
 const ipfilter_deny_exception_1 = require("./ipfilter-deny.exception");
 let IpFilterGuard = class IpFilterGuard {
+    ipFilterService;
     constructor(ipFilterService) {
         this.ipFilterService = ipFilterService;
     }
     canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        const ipAddress = requestIp.getClientIp(request);
-        const whitelist = this.ipFilterService.whitelist;
-        const blacklist = this.ipFilterService.blacklist;
-        let approved = false;
-        if (whitelist.length > 0) {
-            approved = whitelist.some((item) => {
-                return new RegExp(item).test(ipAddress);
-            });
-        }
-        if (blacklist.length > 0) {
-            approved = !blacklist.some((item) => {
-                return new RegExp(item).test(ipAddress);
-            });
+        if (context.getType() !== 'http') {
+            return true;
         }
+        const ipAddress = context
+            .switchToHttp()
+            .getRequest().ip;
+        const approved = this.ipFilterService.isAllowed(ipAddress);
         if (!approved && this.ipFilterService.useDenyException) {
-            throw new ipfilter_deny_exception_1.IpFilterDenyException({
-                clientIp: ipAddress,
-                whitelist: whitelist,
-                blacklist: blacklist,
-            }, 403);
+            throw new ipfilter_deny_exception_1.IpFilterDenyException({ clientIp: ipAddress }, 403);
         }
         return approved;
     }
 };
-IpFilterGuard = __decorate([
+exports.IpFilterGuard = IpFilterGuard;
+exports.IpFilterGuard = IpFilterGuard = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(ipfilter_constants_1.IPFILTER_TOKEN)),
-    __metadata("design:paramtypes", [ipfilter_service_1.IpFilterService])
+    __metadata("design:paramtypes", [Function])
 ], IpFilterGuard);
-exports.IpFilterGuard = IpFilterGuard;
-//# sourceMappingURL=ipfilter.guard.js.map

package/dist/ipfilter.interface.d.ts

@@ -1,8 +1,5 @@
-export declare type IpFilterModuleOptions = {
+export type IpFilterModuleOptions = {
     whitelist?: string[];
     blacklist?: string[];
     useDenyException?: boolean;
 };
-export interface IpFilterDenyHandler {
-    handle(): boolean;
-}

package/dist/ipfilter.interface.js

@@ -1,3 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=ipfilter.interface.js.map

package/dist/ipfilter.module-definition.d.ts

@@ -1,2 +1,8 @@
 import { IpFilterModuleOptions } from './ipfilter.interface';
-export declare const ConfigurableModuleClass: import("@nestjs/common").ConfigurableModuleCls<IpFilterModuleOptions, "register", "create", {}>, MODULE_OPTIONS_TOKEN: string | symbol;
+export declare const ConfigurableModuleClass: import("@nestjs/common").ConfigurableModuleCls<IpFilterModuleOptions, "register", "create", {
+    global: boolean;
+}>, MODULE_OPTIONS_TOKEN: string | symbol, OPTIONS_TYPE: IpFilterModuleOptions & Partial<{
+    global: boolean;
+}>, ASYNC_OPTIONS_TYPE: import("@nestjs/common").ConfigurableModuleAsyncOptions<IpFilterModuleOptions, "create"> & Partial<{
+    global: boolean;
+}>;

package/dist/ipfilter.module-definition.js

@@ -1,7 +1,19 @@
 "use strict";
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODULE_OPTIONS_TOKEN = exports.ConfigurableModuleClass = void 0;
+exports.ASYNC_OPTIONS_TYPE = exports.OPTIONS_TYPE = exports.MODULE_OPTIONS_TOKEN = exports.ConfigurableModuleClass = void 0;
 const common_1 = require("@nestjs/common");
-_a = new common_1.ConfigurableModuleBuilder().build(), exports.ConfigurableModuleClass = _a.ConfigurableModuleClass, exports.MODULE_OPTIONS_TOKEN = _a.MODULE_OPTIONS_TOKEN;
-//# sourceMappingURL=ipfilter.module-definition.js.map
+const core_1 = require("@nestjs/core");
+const ipfilter_guard_1 = require("./ipfilter.guard");
+_a = new common_1.ConfigurableModuleBuilder()
+    .setExtras({ global: true }, (definition, extras) => ({
+    ...definition,
+    global: true,
+    providers: extras.global !== false
+        ? [
+            ...(definition.providers ?? []),
+            { provide: core_1.APP_GUARD, useClass: ipfilter_guard_1.IpFilterGuard },
+        ]
+        : definition.providers,
+}))
+    .build(), exports.ConfigurableModuleClass = _a.ConfigurableModuleClass, exports.MODULE_OPTIONS_TOKEN = _a.MODULE_OPTIONS_TOKEN, exports.OPTIONS_TYPE = _a.OPTIONS_TYPE, exports.ASYNC_OPTIONS_TYPE = _a.ASYNC_OPTIONS_TYPE;

package/dist/ipfilter.module.js

@@ -8,26 +8,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IpFilter = void 0;
 const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
 const ipfilter_constants_1 = require("./ipfilter.constants");
-const ipfilter_guard_1 = require("./ipfilter.guard");
 const ipfilter_module_definition_1 = require("./ipfilter.module-definition");
 const ipfilter_service_1 = require("./ipfilter.service");
 const ipFilterServiceProvider = {
     provide: ipfilter_constants_1.IPFILTER_TOKEN,
     useClass: ipfilter_service_1.IpFilterService,
 };
-const ipFilterGuardProvider = {
-    provide: core_1.APP_GUARD,
-    useClass: ipfilter_guard_1.IpFilterGuard,
-};
 let IpFilter = class IpFilter extends ipfilter_module_definition_1.ConfigurableModuleClass {
 };
-IpFilter = __decorate([
+exports.IpFilter = IpFilter;
+exports.IpFilter = IpFilter = __decorate([
     (0, common_1.Module)({
-        providers: [ipFilterServiceProvider, ipFilterGuardProvider],
+        providers: [ipFilterServiceProvider],
         exports: [ipFilterServiceProvider],
     })
 ], IpFilter);
-exports.IpFilter = IpFilter;
-//# sourceMappingURL=ipfilter.module.js.map

package/dist/ipfilter.service.d.ts

@@ -2,11 +2,14 @@ import { IpFilterModuleOptions } from './ipfilter.interface';
 export declare class IpFilterService {
     readonly options: IpFilterModuleOptions;
     useDenyException: boolean;
-    private _whitelist;
-    private _blacklist;
+    private _whitelist?;
+    private _blacklist?;
+    private whitelistRules?;
+    private blacklistRules?;
     constructor(options: IpFilterModuleOptions);
-    get whitelist(): string[];
+    get whitelist(): string[] | undefined;
     set whitelist(whitelist: string[]);
-    get blacklist(): string[];
+    get blacklist(): string[] | undefined;
     set blacklist(blacklist: string[]);
+    isAllowed(ip: string | undefined): boolean;
 }

package/dist/ipfilter.service.js

@@ -14,32 +14,80 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IpFilterService = void 0;
 const common_1 = require("@nestjs/common");
+const node_net_1 = require("node:net");
 const ipfilter_module_definition_1 = require("./ipfilter.module-definition");
+const familyOf = (address) => ((0, node_net_1.isIP)(address) === 6 ? 'ipv6' : 'ipv4');
+function toBlockList(rules) {
+    if (!Array.isArray(rules)) {
+        throw new Error(`IP filter rules must be an array, got ${typeof rules}`);
+    }
+    const list = new node_net_1.BlockList();
+    for (const raw of rules) {
+        const [address, prefix, ...rest] = String(raw).trim().split('/');
+        const family = (0, node_net_1.isIP)(address);
+        const maxPrefix = family === 4 ? 32 : 128;
+        if (family === 0 ||
+            rest.length > 0 ||
+            (prefix !== undefined &&
+                (!/^\d+$/.test(prefix) || Number(prefix) > maxPrefix)) ||
+            (/^::ffff:/i.test(address) && prefix !== undefined && Number(prefix) < 96)) {
+            throw new Error(`Invalid IP filter rule: "${raw}"`);
+        }
+        if (prefix === undefined) {
+            list.addAddress(address, familyOf(address));
+        }
+        else {
+            list.addSubnet(address, Number(prefix), familyOf(address));
+        }
+    }
+    return list;
+}
 let IpFilterService = class IpFilterService {
+    options;
+    useDenyException;
+    _whitelist;
+    _blacklist;
+    whitelistRules;
+    blacklistRules;
     constructor(options) {
-        var _a, _b, _c;
         this.options = options;
-        this.useDenyException = (_a = options.useDenyException) !== null && _a !== void 0 ? _a : false;
-        this._whitelist = Object.assign([], (_b = options.whitelist) !== null && _b !== void 0 ? _b : []);
-        this._blacklist = Object.assign([], (_c = options.blacklist) !== null && _c !== void 0 ? _c : []);
+        if (options.whitelist == null && options.blacklist == null) {
+            throw new Error('IpFilter: configure "whitelist", "blacklist" or both');
+        }
+        this.useDenyException = options.useDenyException ?? false;
+        if (options.whitelist != null)
+            this.whitelist = options.whitelist;
+        if (options.blacklist != null)
+            this.blacklist = options.blacklist;
     }
     get whitelist() {
-        return this._whitelist;
+        return this._whitelist && [...this._whitelist];
     }
     set whitelist(whitelist) {
-        this._whitelist = whitelist;
+        this.whitelistRules = toBlockList(whitelist);
+        this._whitelist = [...whitelist];
     }
     get blacklist() {
-        return this._blacklist;
+        return this._blacklist && [...this._blacklist];
     }
     set blacklist(blacklist) {
-        this._blacklist = blacklist;
+        this.blacklistRules = toBlockList(blacklist);
+        this._blacklist = [...blacklist];
+    }
+    isAllowed(ip) {
+        if (!ip || (0, node_net_1.isIP)(ip) === 0) {
+            return false;
+        }
+        const family = familyOf(ip);
+        if (this.blacklistRules?.check(ip, family)) {
+            return false;
+        }
+        return this.whitelistRules?.check(ip, family) ?? true;
     }
 };
-IpFilterService = __decorate([
+exports.IpFilterService = IpFilterService;
+exports.IpFilterService = IpFilterService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(ipfilter_module_definition_1.MODULE_OPTIONS_TOKEN)),
     __metadata("design:paramtypes", [Object])
 ], IpFilterService);
-exports.IpFilterService = IpFilterService;
-//# sourceMappingURL=ipfilter.service.js.map