ysk-server-core 1.0.0

package/dist/hosting/defense/geoip/downloader.js

@@ -0,0 +1,179 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Download GeoIP MMDB files into dataDir/geoip with fail-soft (keep old on error).
+ * Supports gzip (.mmdb.gz) for DB-IP City Lite.
+ */
+import { createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { createGunzip } from 'node:zlib';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import { resolveGeoipSources } from './providers.js';
+export function geoipDir(dataDir) {
+    return join(dataDir, 'geoip');
+}
+export function metaPath(dataDir) {
+    return join(geoipDir(dataDir), 'meta.json');
+}
+export function loadGeoipMeta(dataDir) {
+    try {
+        const p = metaPath(dataDir);
+        if (!existsSync(p))
+            return null;
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveGeoipMeta(dataDir, meta) {
+    mkdirSync(geoipDir(dataDir), { recursive: true });
+    writeFileSync(metaPath(dataDir), JSON.stringify(meta, null, 2), 'utf8');
+}
+async function downloadOne(src, dir) {
+    const dest = join(dir, src.filename);
+    const tmp = `${dest}.tmp`;
+    const started = new Date().toISOString();
+    try {
+        const res = await fetch(src.url, {
+            headers: { 'User-Agent': 'ysk-server-geoip/1.0' },
+            redirect: 'follow',
+        });
+        if (!res.ok || !res.body) {
+            throw new Error(`HTTP ${res.status} for ${src.filename}`);
+        }
+        const etag = res.headers.get('etag') ?? undefined;
+        const nodeStream = Readable.fromWeb(res.body);
+        const useGzip = src.gzip ||
+            /\.gz(\?|$)/i.test(src.url) ||
+            (res.headers.get('content-encoding') || '').includes('gzip') ||
+            (res.headers.get('content-type') || '').includes('gzip');
+        if (useGzip) {
+            await pipeline(nodeStream, createGunzip(), createWriteStream(tmp));
+        }
+        else {
+            await pipeline(nodeStream, createWriteStream(tmp));
+        }
+        const st = statSync(tmp);
+        if (st.size < 1024) {
+            throw new Error(tl('notes.auto.t0775', { v0: (st.size) }));
+        }
+        renameSync(tmp, dest);
+        return {
+            filename: src.filename,
+            url: src.url.replace(/token=[^&]+/i, 'token=***'),
+            downloadedAt: started,
+            bytes: st.size,
+            etag,
+            ok: true,
+        };
+    }
+    catch (e) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch {
+            /* ignore */
+        }
+        return {
+            filename: src.filename,
+            url: src.url.replace(/token=[^&]+/i, 'token=***'),
+            downloadedAt: started,
+            bytes: existsSync(dest) ? statSync(dest).size : 0,
+            ok: false,
+            error: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+export async function updateGeoipDatabases(dataDir, env = process.env) {
+    const dir = geoipDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    const { provider, sources } = resolveGeoipSources(env);
+    const prev = loadGeoipMeta(dataDir);
+    const files = [];
+    const notes = [];
+    const okFiles = new Set();
+    for (const src of sources) {
+        // City lite has primary + fallback same filename — skip if already ok
+        if (okFiles.has(src.filename)) {
+            notes.push(tl('notes.auto.t0776', { v0: (src.filename) }));
+            continue;
+        }
+        const r = await downloadOne(src, dir);
+        if (r.ok) {
+            okFiles.add(src.filename);
+            files.push(r);
+            notes.push(tl('notes.auto.t0777', { v0: (r.filename), v1: (r.bytes) }));
+        }
+        else {
+            // Only record last failure for this filename if never succeeded this run
+            const prevFail = files.find((f) => f.filename === src.filename && !f.ok);
+            if (prevFail) {
+                prevFail.error = r.error;
+                prevFail.url = r.url;
+            }
+            else {
+                files.push(r);
+            }
+            notes.push(tl('notes.auto.t0778', { v0: (r.filename), v1: (r.error), v2: (existsSync(join(dir, src.filename)) ? tl('notes.tpl.keepOldDb') : '') }));
+        }
+    }
+    const anyOk = files.some((f) => f.ok) || sources.some((s) => existsSync(join(dir, s.filename)));
+    const attrs = [
+        ...new Set(sources.map((s) => s.attribution).filter(Boolean)),
+    ];
+    const meta = {
+        provider,
+        files,
+        lastAttemptAt: new Date().toISOString(),
+        lastSuccessAt: files.some((f) => f.ok)
+            ? new Date().toISOString()
+            : prev?.lastSuccessAt,
+        lastError: files
+            .filter((f) => !f.ok)
+            .map((f) => f.error)
+            .filter(Boolean)
+            .join('; ') || undefined,
+        attribution: attrs.join(' · ') || undefined,
+    };
+    saveGeoipMeta(dataDir, meta);
+    return { ok: anyOk, meta, notes };
+}
+export function listGeoipSourceStatus(dataDir, env = process.env) {
+    const { provider, sources } = resolveGeoipSources(env);
+    const dir = geoipDir(dataDir);
+    // Dedupe by filename for status display
+    const seen = new Set();
+    const unique = sources.filter((s) => {
+        if (seen.has(s.filename))
+            return false;
+        seen.add(s.filename);
+        return true;
+    });
+    return {
+        provider,
+        sources: unique.map((s) => {
+            const p = join(dir, s.filename);
+            const present = existsSync(p);
+            let mtime;
+            let bytes;
+            if (present) {
+                const st = statSync(p);
+                mtime = st.mtime.toISOString();
+                bytes = st.size;
+            }
+            return {
+                filename: s.filename,
+                url: s.url.replace(/token=[^&]+/i, 'token=***'),
+                license: s.license,
+                updateHint: s.updateHint,
+                present,
+                mtime,
+                bytes,
+                attribution: s.attribution,
+            };
+        }),
+    };
+}
+//# sourceMappingURL=downloader.js.map

package/dist/hosting/defense/geoip/downloader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloader.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/downloader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,gBAAgB,CAAC;AAGvE,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAmB;IAChE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAC/B,OAAO,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE;YACjD,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CACjC,GAAG,CAAC,IAA2C,CAChD,CAAC;QACF,MAAM,OAAO,GACX,GAAG,CAAC,IAAI;YACR,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC3B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5D,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;YACjD,YAAY,EAAE,OAAO;YACrB,KAAK,EAAE,EAAE,CAAC,IAAI;YACd,IAAI;YACJ,EAAE,EAAE,IAAI;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;YACjD,YAAY,EAAE,OAAO;YACrB,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjD,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAMpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,sEAAsE;QACtE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACzB,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CACxI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAC9D,CAAC;IACF,MAAM,IAAI,GAAkB;QAC1B,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,IAAI,EAAE,aAAa;QACvB,SAAS,EACP,KAAK;aACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aACnB,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS;KAC5C,CAAC;IACF,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAE7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,wCAAwC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAyB,CAAC;YAC9B,IAAI,KAAyB,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACvB,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC/B,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;gBAC/C,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,OAAO;gBACP,KAAK;gBACL,KAAK;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/hosting/defense/geoip/index.d.ts

@@ -0,0 +1,32 @@
+export * from './types.js';
+export * from './providers.js';
+export * from './downloader.js';
+export * from './lookup.js';
+export * from './policy.js';
+export * from './nginx-geo.js';
+import type { JsonStore } from '../../../db/store.js';
+import { lookupIp } from './lookup.js';
+import { evaluateIpAccess } from './policy.js';
+import type { GeoipStatus, IpAccessPolicy } from './types.js';
+export declare function getGeoipStatus(dataDir: string, db: JsonStore): Promise<GeoipStatus>;
+export declare function refreshGeoip(dataDir: string): Promise<{
+    ok: boolean;
+    notes: string[];
+    status: GeoipStatus;
+}>;
+export declare function lookupIpWithPolicy(dataDir: string, db: JsonStore, ip: string, whitelist?: string[]): Promise<{
+    lookup: Awaited<ReturnType<typeof lookupIp>>;
+    access: ReturnType<typeof evaluateIpAccess>;
+}>;
+export declare function updateIpAccessPolicy(db: JsonStore, dataDir: string, patch: Partial<IpAccessPolicy>): IpAccessPolicy;
+export declare function applyIpAccessNginx(dataDir: string, db: JsonStore): {
+    ok: boolean;
+    path: string;
+    notes: string[];
+};
+export declare function geoDbFileStats(dataDir: string): Array<{
+    name: string;
+    bytes: number;
+    mtime: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/defense/geoip/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAI/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAOtD,OAAO,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAA0C,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGvF,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAK9D,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,WAAW,CAAC,CAwDtB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3D,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,CA4BD;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,SAAS,EACb,EAAE,EAAE,MAAM,EACV,SAAS,GAAE,MAAM,EAAO,GACvB,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;CAC7C,CAAC,CAMD;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAC7B,cAAc,CAEhB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,SAAS,GACZ;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAUhD;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GACd,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvD"}

package/dist/hosting/defense/geoip/index.js

@@ -0,0 +1,140 @@
+import { tl } from 'ysk-server-shared';
+export * from './types.js';
+export * from './providers.js';
+export * from './downloader.js';
+export * from './lookup.js';
+export * from './policy.js';
+export * from './nginx-geo.js';
+import { join } from 'node:path';
+import { existsSync, statSync } from 'node:fs';
+import { geoipDir, listGeoipSourceStatus, loadGeoipMeta, updateGeoipDatabases, } from './downloader.js';
+import { lookupIp, resetGeoipReaders } from './lookup.js';
+import { loadIpAccessPolicy, saveIpAccessPolicy, evaluateIpAccess } from './policy.js';
+import { writeNginxGeoConf } from './nginx-geo.js';
+import { ipMatchesWhitelist } from '../auto-ban.js';
+import { DEFAULT_IP_ACCESS_POLICY } from './types.js';
+const STALE_MS = 7 * 24 * 60 * 60 * 1000;
+export async function getGeoipStatus(dataDir, db) {
+    const meta = loadGeoipMeta(dataDir);
+    const listed = listGeoipSourceStatus(dataDir);
+    const policy = loadIpAccessPolicy(db, dataDir);
+    const ready = listed.sources.some((s) => s.present);
+    const cityReady = existsSync(join(geoipDir(dataDir), 'dbip-city-lite.mmdb'));
+    let stale = false;
+    if (meta?.lastSuccessAt) {
+        stale = Date.now() - new Date(meta.lastSuccessAt).getTime() > STALE_MS;
+    }
+    else if (ready) {
+        const mt = listed.sources.find((s) => s.mtime)?.mtime;
+        if (mt)
+            stale = Date.now() - new Date(mt).getTime() > STALE_MS;
+        else
+            stale = true;
+    }
+    const notes = [];
+    if (!ready)
+        notes.push(tl('notes.auto.n0709'));
+    if (stale)
+        notes.push(tl('notes.auto.n1448'));
+    if (cityReady) {
+        notes.push(tl('notes.auto.n0581'));
+    }
+    else {
+        notes.push(tl('notes.auto.n0976'));
+    }
+    if (policy.enabled) {
+        notes.push(tl('notes.auto.t0774', { v0: (policy.mode), v1: (policy.countries.length), v2: (policy.regions.length), v3: (policy.cities.length), v4: (policy.cityPolicyEnabled ? '' : tl('notes.tpl.cityPolicyOff')), v5: (policy.asns.length) }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0118'));
+    }
+    notes.push(tl('notes.auto.n0554'));
+    const attribution = [
+        ...new Set([
+            ...listed.sources.map((s) => s.attribution).filter(Boolean),
+            meta?.attribution,
+        ].filter(Boolean)),
+    ];
+    return {
+        provider: listed.provider,
+        dir: geoipDir(dataDir),
+        ready,
+        stale,
+        cityReady,
+        maxGranularity: cityReady ? 'city' : 'country',
+        meta,
+        sources: listed.sources.map(({ attribution: _a, ...s }) => s),
+        attribution,
+        policy,
+        notes,
+    };
+}
+export async function refreshGeoip(dataDir) {
+    const r = await updateGeoipDatabases(dataDir);
+    resetGeoipReaders();
+    const cityReady = existsSync(join(geoipDir(dataDir), 'dbip-city-lite.mmdb'));
+    return {
+        ok: r.ok,
+        notes: r.notes,
+        status: {
+            provider: r.meta.provider,
+            dir: geoipDir(dataDir),
+            ready: r.meta.files.some((f) => f.ok) || r.ok,
+            stale: false,
+            cityReady,
+            maxGranularity: cityReady ? 'city' : 'country',
+            meta: r.meta,
+            sources: [],
+            attribution: r.meta.attribution ? [r.meta.attribution] : [],
+            policy: {
+                ...DEFAULT_IP_ACCESS_POLICY,
+                countries: [],
+                continents: [],
+                regions: [],
+                cities: [],
+                asns: [],
+            },
+            notes: r.notes,
+        },
+    };
+}
+export async function lookupIpWithPolicy(dataDir, db, ip, whitelist = []) {
+    const policy = loadIpAccessPolicy(db, dataDir);
+    const lookup = await lookupIp(dataDir, ip);
+    const whitelisted = ipMatchesWhitelist(ip, whitelist);
+    const access = evaluateIpAccess(lookup, policy, { whitelisted });
+    return { lookup, access };
+}
+export function updateIpAccessPolicy(db, dataDir, patch) {
+    return saveIpAccessPolicy(db, dataDir, patch);
+}
+export function applyIpAccessNginx(dataDir, db) {
+    const policy = loadIpAccessPolicy(db, dataDir);
+    if (!policy.enforce.nginx) {
+        return {
+            ok: true,
+            path: '',
+            notes: [tl('notes.auto.n0343')],
+        };
+    }
+    return writeNginxGeoConf(dataDir, policy);
+}
+export function geoDbFileStats(dataDir) {
+    const dir = geoipDir(dataDir);
+    const names = [
+        'ipinfo_lite.mmdb',
+        'user-country.mmdb',
+        'origin-asn.mmdb',
+        'dbip-city-lite.mmdb',
+    ];
+    const out = [];
+    for (const name of names) {
+        const p = `${dir}/${name}`;
+        if (!existsSync(p))
+            continue;
+        const st = statSync(p);
+        out.push({ name, bytes: st.size, mtime: st.mtime.toISOString() });
+    }
+    return out;
+}
+//# sourceMappingURL=index.js.map

package/dist/hosting/defense/geoip/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,EAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;QACxB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC;IACzE,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QACtD,IAAI,EAAE;YAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC;;YAC1D,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC/C,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACrO,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAG;QAClB,GAAG,IAAI,GAAG,CACR;YACE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3D,IAAI,EAAE,WAAW;SAClB,CAAC,MAAM,CAAC,OAAO,CAAa,CAC9B;KACF,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QACtB,KAAK;QACL,KAAK;QACL,SAAS;QACT,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC9C,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,WAAW;QACX,MAAM;QACN,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAKhD,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,iBAAiB,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;YACzB,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE;YAC7C,KAAK,EAAE,KAAK;YACZ,SAAS;YACT,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC9C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3D,MAAM,EAAE;gBACN,GAAG,wBAAwB;gBAC3B,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,EAAE;aACT;YACD,KAAK,EAAE,CAAC,CAAC,KAAK;SACf;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,EAAa,EACb,EAAU,EACV,YAAsB,EAAE;IAKxB,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAa,EACb,OAAe,EACf,KAA8B;IAE9B,OAAO,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,EAAa;IAEb,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAe;IAEf,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG;QACZ,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,qBAAqB;KACtB,CAAC;IACF,MAAM,GAAG,GAA0D,EAAE,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hosting/defense/geoip/lookup.d.ts

@@ -0,0 +1,4 @@
+import type { GeoLookupResult } from './types.js';
+export declare function resetGeoipReaders(): void;
+export declare function lookupIp(dataDir: string, ip: string): Promise<GeoLookupResult>;
+//# sourceMappingURL=lookup.d.ts.map

package/dist/hosting/defense/geoip/lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/lookup.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmJlD,wBAAgB,iBAAiB,IAAI,IAAI,CAMxC;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAqKpF"}