proteum 2.2.2 → 2.2.6

package/server/services/router/request/index.ts

@@ -17,6 +17,7 @@ import type { HttpMethod, HttpHeaders } from '..';
 import ApiClient from './api';
 import ServerResponse from '../response';
 import type { TAnyRouter } from '..';
+import { resolveRequestIp } from './ip';
 
 /*----------------------------------
 - TYPES
@@ -108,7 +109,7 @@ export default class ServerRequest<TRouter extends TAnyRouter = TAnyRouter> exte
         this.domain = res.req.hostname;
         this.cookies = res.req.cookies;
 
-        this.ip = res.req.ip;
+        this.ip = resolveRequestIp(res.req);
 
         this.data = data || {};
     }

package/server/services/router/request/ip.test.cjs

@@ -0,0 +1,60 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const { resolveRequestIp } = require('./ip.ts');
+
+const request = (headers, ip = '192.0.2.10') => ({
+    headers,
+    ip,
+});
+
+test('Cloudflare client IP wins over Express fallback IP', () => {
+    assert.equal(
+        resolveRequestIp(request({ 'cf-connecting-ip': '203.0.113.10' }, '192.0.2.10')),
+        '203.0.113.10',
+    );
+});
+
+test('True-Client-IP wins when Cloudflare IP is absent', () => {
+    assert.equal(
+        resolveRequestIp(request({ 'true-client-ip': '198.51.100.24' }, '192.0.2.10')),
+        '198.51.100.24',
+    );
+});
+
+test('Fastly-Client-IP wins when Cloudflare and True-Client-IP are absent', () => {
+    assert.equal(
+        resolveRequestIp(request({ 'fastly-client-ip': '51.182.144.154' }, '192.0.2.10')),
+        '51.182.144.154',
+    );
+});
+
+test('invalid and spoof-looking values are ignored before falling back to Express IP', () => {
+    assert.equal(
+        resolveRequestIp(
+            request(
+                {
+                    'cf-connecting-ip': 'not-an-ip',
+                    'true-client-ip': '203.0.113.10, 198.51.100.24',
+                    'fastly-client-ip': 'unknown',
+                    'x-forwarded-for': '203.0.113.200',
+                    forwarded: 'for=203.0.113.201',
+                },
+                '192.0.2.10',
+            ),
+        ),
+        '192.0.2.10',
+    );
+});
+
+test('IPv4-mapped IPv6 and bracketed IPv6 candidates normalize correctly', () => {
+    assert.equal(
+        resolveRequestIp(request({ 'fastly-client-ip': ' ::ffff:51.182.144.154 ' }, '192.0.2.10')),
+        '51.182.144.154',
+    );
+    assert.equal(resolveRequestIp(request({ 'true-client-ip': '[2001:db8::12]' }, '192.0.2.10')), '2001:db8::12');
+});
+
+test('IPv4 port suffix candidates normalize correctly', () => {
+    assert.equal(resolveRequestIp(request({ 'fastly-client-ip': '51.182.144.154:443' }, '192.0.2.10')), '51.182.144.154');
+});

package/server/services/router/request/ip.ts

@@ -0,0 +1,71 @@
+/*----------------------------------
+- DEPENDANCES
+----------------------------------*/
+
+// Npm
+import type express from 'express';
+import { isIP } from 'net';
+
+/*----------------------------------
+- TYPES
+----------------------------------*/
+
+type THeaderValue = string | string[] | undefined;
+
+/*----------------------------------
+- CONSTANTS
+----------------------------------*/
+
+const trustedClientIpHeaders = ['cf-connecting-ip', 'true-client-ip', 'fastly-client-ip'] as const;
+const bracketedIpPattern = /^\[([^\]]+)\](?::\d+)?$/;
+const ipv4WithPortPattern = /^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/;
+const ipv4MappedIpv6Pattern = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i;
+
+/*----------------------------------
+- HELPERS
+----------------------------------*/
+
+const readHeader = (headers: Record<string, THeaderValue>, name: string): string | null => {
+    const normalizedName = name.toLowerCase();
+    const directValue = headers[name] ?? headers[normalizedName] ?? headers[name.toUpperCase()];
+    const value =
+        directValue !== undefined
+            ? directValue
+            : Object.entries(headers).find(([key]) => key.toLowerCase() === normalizedName)?.[1];
+
+    if (Array.isArray(value)) {
+        const firstValue = value.find((entry) => typeof entry === 'string' && entry.trim());
+        return typeof firstValue === 'string' ? firstValue.trim() : null;
+    }
+
+    return typeof value === 'string' && value.trim() ? value.trim() : null;
+};
+
+export const normalizeRequestIpCandidate = (value: string | null | undefined): string | null => {
+    let candidate = typeof value === 'string' ? value.trim() : '';
+    if (!candidate) return null;
+
+    const bracketedIp = bracketedIpPattern.exec(candidate);
+    if (bracketedIp) candidate = bracketedIp[1].trim();
+
+    const ipv4MappedIpv6 = ipv4MappedIpv6Pattern.exec(candidate);
+    if (ipv4MappedIpv6 && isIP(ipv4MappedIpv6[1]) === 4) {
+        candidate = ipv4MappedIpv6[1];
+    } else {
+        const ipv4WithPort = ipv4WithPortPattern.exec(candidate);
+        if (ipv4WithPort && isIP(ipv4WithPort[1]) === 4) candidate = ipv4WithPort[1];
+    }
+
+    return isIP(candidate) ? candidate : null;
+};
+
+export const resolveRequestIp = (req: Pick<express.Request, 'headers' | 'ip'>): string | undefined => {
+    const headers = req.headers as Record<string, THeaderValue>;
+
+    for (const headerName of trustedClientIpHeaders) {
+        const ip = normalizeRequestIpCandidate(readHeader(headers, headerName));
+        if (ip) return ip;
+    }
+
+    return normalizeRequestIpCandidate(req.ip) || undefined;
+};