[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","4e736cb42e83c17c10d9f33412034a74b06f3941","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_172":173,"_174":-5},"handle","ianmenethil","name","ZenServer","path","src/services/ipSecurityService.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":73,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","619e7f00-58a9-11f0-a700-f69ea79377d9","createdAt",["D",1751614495896],"deletedAt","legacyEnvVars","privacy","unlisted","description","imageUrl","5856754a-b1b9-4358-87d1-77f1d9f79e45","pinnedFileId","9f5c41ce-58a9-11f0-947f-f69ea79377d9","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","7559f40a-a274-4a9b-8f8b-7486509c3949","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycXU1U2ZIVEk3NnhGTXRySE0wbWdYQncxSnYifQ","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",883,"619ecc08-58a9-11f0-a700-f69ea79377d9","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":160,"_161":116,"_104":162,"_138":32,"_163":164,"_165":166,"_167":20,"_168":-5,"_98":169},"828fdfd4-5f4c-11f0-bebf-0224a6c84d84","ipSecurityService.ts","fileId","828fe07e-5f4c-11f0-bebf-0224a6c84d84","parentId","9ec2a1a4-58a9-11f0-9d42-f69ea79377d9","branchId","branchVersion",638,"latest",["D",1752344266105],"fileType","script","content","/**\r\n * IP Security Service\r\n *\r\n * Industry-standard in-memory IP security checking with periodic refresh from blob storage.\r\n * Provides fast O(1) lookups for IP checks that happen on every request.\r\n *\r\n * Features:\r\n * - In-memory Set lookups for maximum performance\r\n * - Periodic refresh from blob storage\r\n * - Support for individual IPs and CIDR ranges\r\n * - Geographic blocking\r\n * - Automatic blocked IPs from security events\r\n * - Configurable refresh intervals\r\n */\r\n\r\nimport { createBlobService, BlobService } from \"./blobService.ts\";\r\nimport {\r\n getClientIP,\r\n performIPSecurityCheck,\r\n isIPInCIDR,\r\n isValidIP,\r\n} from \"../utils/ipUtils.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n/**\r\n * IP Security Check Result\r\n */\r\nexport interface IPSecurityResult {\r\n allowed: boolean;\r\n reason?: string;\r\n source?:\r\n | \"whitelist\"\r\n | \"blacklist\"\r\n | \"blocked\"\r\n | \"geo_blocked\"\r\n | \"security_policy\";\r\n metadata?: {\r\n ip: string;\r\n checkDuration: number;\r\n lastRefresh: Date;\r\n };\r\n}\r\n\r\n/**\r\n * IP List Configuration\r\n */\r\ninterface IPListConfig {\r\n individual: string[];\r\n cidr: string[];\r\n lastUpdated: string;\r\n source: string;\r\n}\r\n\r\n/**\r\n * Geographic blocking configuration\r\n */\r\ninterface GeoBlockConfig {\r\n blockedCountries: string[];\r\n allowedCountries: string[];\r\n lastUpdated: string;\r\n}\r\n\r\n/**\r\n * Security policy configuration\r\n */\r\ninterface SecurityPolicyConfig {\r\n allowPrivate: boolean;\r\n allowLoopback: boolean;\r\n defaultAction: \"allow\" | \"deny\";\r\n lastUpdated: string;\r\n}\r\n\r\n/**\r\n * In-Memory IP Security Service\r\n */\r\nexport class IPSecurityService {\r\n private readonly blobService: BlobService;\r\n\r\n // In-memory sets for fast lookups\r\n private whitelistedIPs = new Set();\r\n private whitelistedCIDRs: string[] = [];\r\n private blacklistedIPs = new Set();\r\n private blacklistedCIDRs: string[] = [];\r\n private blockedIPs = new Set();\r\n private blockedCIDRs: string[] = [];\r\n private blockedGeos = new Set();\r\n private allowedGeos = new Set();\r\n\r\n // Configuration\r\n private securityPolicy: SecurityPolicyConfig = {\r\n allowPrivate: environment.ALLOW_PRIVATE_IPS ?? true,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS ?? true,\r\n defaultAction: \"allow\",\r\n lastUpdated: new Date().toISOString(),\r\n };\r\n\r\n // Refresh control\r\n private lastRefresh = 0;\r\n private refreshInterval: number;\r\n private isRefreshing = false;\r\n private refreshPromise: Promise | null = null;\r\n\r\n constructor(refreshIntervalMinutes: number = 5) {\r\n this.blobService = createBlobService(\"security\");\r\n this.refreshInterval = refreshIntervalMinutes * 60 * 1000; // Convert to milliseconds\r\n\r\n // Initial load\r\n this.refreshFromBlob().catch((error) => {\r\n logger.error(\"Failed initial IP security refresh\", {\r\n error: error.message,\r\n });\r\n });\r\n }\r\n\r\n /**\r\n * Main IP security check method - optimized for high frequency calls\r\n */\r\n async checkIP(ip: string, request?: Request): Promise {\r\n const startTime = performance.now();\r\n\r\n // Ensure we have recent data\r\n await this.refreshIfNeeded();\r\n\r\n // Fast validation\r\n if (!isValidIP(ip)) {\r\n return {\r\n allowed: false,\r\n reason: \"Invalid IP address format\",\r\n source: \"security_policy\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 1. Check whitelist first (highest priority)\r\n if (this.isIPInWhitelist(ip)) {\r\n return {\r\n allowed: true,\r\n reason: \"IP is whitelisted\",\r\n source: \"whitelist\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 2. Check blacklist (manual blocks)\r\n if (this.isIPInBlacklist(ip)) {\r\n return {\r\n allowed: false,\r\n reason: \"IP is manually blacklisted\",\r\n source: \"blacklist\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 3. Check automatic blocks (from security events)\r\n if (this.isIPInBlockedList(ip)) {\r\n return {\r\n allowed: false,\r\n reason: \"IP is automatically blocked due to security events\",\r\n source: \"blocked\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 4. Check geographic restrictions (if geolocation data available)\r\n const geoResult = await this.checkGeographicRestrictions(ip, request);\r\n if (!geoResult.allowed) {\r\n return {\r\n ...geoResult,\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 5. Apply security policy (private IPs, loopback, etc.)\r\n const policyResult = performIPSecurityCheck(ip, {\r\n allowPrivate: this.securityPolicy.allowPrivate,\r\n allowLoopback: this.securityPolicy.allowLoopback,\r\n });\r\n\r\n if (!policyResult.allowed) {\r\n return {\r\n allowed: false,\r\n reason: policyResult.reason,\r\n source: \"security_policy\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n // 6. Default action\r\n const allowed = this.securityPolicy.defaultAction === \"allow\";\r\n return {\r\n allowed,\r\n reason: allowed ? \"Passed all security checks\" : \"Default deny policy\",\r\n source: \"security_policy\",\r\n metadata: {\r\n ip,\r\n checkDuration: performance.now() - startTime,\r\n lastRefresh: new Date(this.lastRefresh),\r\n },\r\n };\r\n }\r\n\r\n /**\r\n * Check if IP is in whitelist (individual IPs or CIDR ranges)\r\n */\r\n private isIPInWhitelist(ip: string): boolean {\r\n // Check individual IPs\r\n if (this.whitelistedIPs.has(ip)) {\r\n return true;\r\n }\r\n\r\n // Check CIDR ranges\r\n return this.whitelistedCIDRs.some((cidr) => isIPInCIDR(ip, cidr));\r\n }\r\n\r\n /**\r\n * Check if IP is in blacklist (individual IPs or CIDR ranges)\r\n */\r\n private isIPInBlacklist(ip: string): boolean {\r\n // Check individual IPs\r\n if (this.blacklistedIPs.has(ip)) {\r\n return true;\r\n }\r\n\r\n // Check CIDR ranges\r\n return this.blacklistedCIDRs.some((cidr) => isIPInCIDR(ip, cidr));\r\n }\r\n\r\n /**\r\n * Check if IP is in automatically blocked list\r\n */\r\n private isIPInBlockedList(ip: string): boolean {\r\n // Check individual IPs\r\n if (this.blockedIPs.has(ip)) {\r\n return true;\r\n }\r\n\r\n // Check CIDR ranges\r\n return this.blockedCIDRs.some((cidr) => isIPInCIDR(ip, cidr));\r\n }\r\n\r\n /**\r\n * Check geographic restrictions\r\n */\r\n private async checkGeographicRestrictions(\r\n ip: string,\r\n request?: Request\r\n ): Promise {\r\n // For now, we don't have geolocation implemented\r\n // In production, you would integrate with a geolocation service\r\n // or use Cloudflare's geo headers if available\r\n\r\n if (request) {\r\n const countryCode = request.headers.get(\"cf-ipcountry\");\r\n if (countryCode) {\r\n // Check if country is blocked\r\n if (this.blockedGeos.has(countryCode.toUpperCase())) {\r\n return {\r\n allowed: false,\r\n reason: `Access denied for country: ${countryCode}`,\r\n source: \"geo_blocked\",\r\n };\r\n }\r\n\r\n // Check if only specific countries are allowed\r\n if (\r\n this.allowedGeos.size > 0 &&\r\n !this.allowedGeos.has(countryCode.toUpperCase())\r\n ) {\r\n return {\r\n allowed: false,\r\n reason: `Country ${countryCode} not in allowed list`,\r\n source: \"geo_blocked\",\r\n };\r\n }\r\n }\r\n }\r\n\r\n return { allowed: true };\r\n }\r\n\r\n /**\r\n * Refresh IP lists if needed (non-blocking)\r\n */\r\n private async refreshIfNeeded(): Promise {\r\n const now = Date.now();\r\n\r\n // Check if refresh is needed\r\n if (now - this.lastRefresh < this.refreshInterval) {\r\n return;\r\n }\r\n\r\n // If already refreshing, wait for it to complete\r\n if (this.isRefreshing && this.refreshPromise) {\r\n return this.refreshPromise;\r\n }\r\n\r\n // Start refresh\r\n this.refreshPromise = this.refreshFromBlob();\r\n return this.refreshPromise;\r\n }\r\n\r\n /**\r\n * Load IP lists from blob storage\r\n */\r\n private async refreshFromBlob(): Promise {\r\n if (this.isRefreshing) {\r\n return;\r\n }\r\n\r\n this.isRefreshing = true;\r\n const startTime = performance.now();\r\n\r\n try {\r\n // Load all configurations in parallel\r\n const [whitelist, blacklist, blocked, geoConfig, policyConfig] =\r\n await Promise.all([\r\n this.loadIPList(\"whitelist\"),\r\n this.loadIPList(\"blacklist\"),\r\n this.loadIPList(\"blocked\"),\r\n this.loadGeoConfig(),\r\n this.loadSecurityPolicy(),\r\n ]);\r\n\r\n // Update in-memory sets\r\n this.updateIPSet(whitelist, \"whitelist\");\r\n this.updateIPSet(blacklist, \"blacklist\");\r\n this.updateIPSet(blocked, \"blocked\");\r\n this.updateGeoSets(geoConfig);\r\n this.updateSecurityPolicy(policyConfig);\r\n\r\n this.lastRefresh = Date.now();\r\n const duration = performance.now() - startTime;\r\n\r\n logger.info(\"IP security lists refreshed\", {\r\n whitelistedCount:\r\n this.whitelistedIPs.size + this.whitelistedCIDRs.length,\r\n blacklistedCount:\r\n this.blacklistedIPs.size + this.blacklistedCIDRs.length,\r\n blockedCount: this.blockedIPs.size + this.blockedCIDRs.length,\r\n blockedGeos: this.blockedGeos.size,\r\n allowedGeos: this.allowedGeos.size,\r\n duration: `${duration.toFixed(2)}ms`,\r\n });\r\n } catch (error) {\r\n const duration = performance.now() - startTime;\r\n logger.error(\"Failed to refresh IP security lists\", {\r\n error: error instanceof Error ? error.message : String(error),\r\n duration: `${duration.toFixed(2)}ms`,\r\n });\r\n } finally {\r\n this.isRefreshing = false;\r\n this.refreshPromise = null;\r\n }\r\n }\r\n\r\n /**\r\n * Load IP list configuration from blob\r\n */\r\n private async loadIPList(\r\n listType: \"whitelist\" | \"blacklist\" | \"blocked\"\r\n ): Promise {\r\n const result = await this.blobService.getJSON(\r\n `ip-${listType}`\r\n );\r\n return result.success ? result.data || null : null;\r\n }\r\n\r\n /**\r\n * Load geographic configuration from blob\r\n */\r\n private async loadGeoConfig(): Promise {\r\n const result = await this.blobService.getJSON(\"geo-config\");\r\n return result.success ? result.data || null : null;\r\n }\r\n\r\n /**\r\n * Load security policy from blob\r\n */\r\n private async loadSecurityPolicy(): Promise {\r\n const result = await this.blobService.getJSON(\r\n \"security-policy\"\r\n );\r\n return result.success ? result.data || null : null;\r\n }\r\n\r\n /**\r\n * Update in-memory IP sets\r\n */\r\n private updateIPSet(\r\n config: IPListConfig | null,\r\n type: \"whitelist\" | \"blacklist\" | \"blocked\"\r\n ): void {\r\n if (!config) {\r\n return;\r\n }\r\n\r\n let ipSet: Set;\r\n let cidrArray: string[];\r\n\r\n switch (type) {\r\n case \"whitelist\":\r\n ipSet = this.whitelistedIPs;\r\n cidrArray = this.whitelistedCIDRs;\r\n break;\r\n case \"blacklist\":\r\n ipSet = this.blacklistedIPs;\r\n cidrArray = this.blacklistedCIDRs;\r\n break;\r\n case \"blocked\":\r\n ipSet = this.blockedIPs;\r\n cidrArray = this.blockedCIDRs;\r\n break;\r\n }\r\n\r\n // Clear existing data\r\n ipSet.clear();\r\n cidrArray.length = 0;\r\n\r\n // Add individual IPs\r\n config.individual.forEach((ip) => {\r\n if (isValidIP(ip)) {\r\n ipSet.add(ip);\r\n }\r\n });\r\n\r\n // Add CIDR ranges\r\n config.cidr.forEach((cidr) => {\r\n if (cidr.includes(\"/\")) {\r\n cidrArray.push(cidr);\r\n }\r\n });\r\n }\r\n\r\n /**\r\n * Update geographic restrictions\r\n */\r\n private updateGeoSets(config: GeoBlockConfig | null): void {\r\n if (!config) {\r\n return;\r\n }\r\n\r\n this.blockedGeos.clear();\r\n this.allowedGeos.clear();\r\n\r\n config.blockedCountries.forEach((country) => {\r\n this.blockedGeos.add(country.toUpperCase());\r\n });\r\n\r\n config.allowedCountries.forEach((country) => {\r\n this.allowedGeos.add(country.toUpperCase());\r\n });\r\n }\r\n\r\n /**\r\n * Update security policy\r\n */\r\n private updateSecurityPolicy(config: SecurityPolicyConfig | null): void {\r\n if (config) {\r\n this.securityPolicy = { ...config };\r\n }\r\n }\r\n\r\n /**\r\n * Manually add IP to blocked list (for security events)\r\n */\r\n async addToBlockedList(\r\n ip: string,\r\n reason: string = \"Security event\"\r\n ): Promise {\r\n if (!isValidIP(ip)) {\r\n throw new Error(\"Invalid IP address\");\r\n }\r\n\r\n // Add to in-memory set immediately\r\n this.blockedIPs.add(ip);\r\n\r\n // Update blob storage\r\n const config = (await this.loadIPList(\"blocked\")) || {\r\n individual: [],\r\n cidr: [],\r\n lastUpdated: new Date().toISOString(),\r\n source: \"security\",\r\n };\r\n\r\n if (!config.individual.includes(ip)) {\r\n config.individual.push(ip);\r\n config.lastUpdated = new Date().toISOString();\r\n\r\n await this.blobService.setJSON(\"ip-blocked\", config);\r\n\r\n logger.info(\"IP added to blocked list\", { ip, reason });\r\n }\r\n }\r\n\r\n /**\r\n * Remove IP from blocked list\r\n */\r\n async removeFromBlockedList(ip: string): Promise {\r\n // Remove from in-memory set\r\n this.blockedIPs.delete(ip);\r\n\r\n // Update blob storage\r\n const config = await this.loadIPList(\"blocked\");\r\n if (config) {\r\n config.individual = config.individual.filter(\r\n (blockedIP) => blockedIP !== ip\r\n );\r\n config.lastUpdated = new Date().toISOString();\r\n\r\n await this.blobService.setJSON(\"ip-blocked\", config);\r\n\r\n logger.info(\"IP removed from blocked list\", { ip });\r\n }\r\n }\r\n\r\n /**\r\n * Get current security statistics\r\n */\r\n getSecurityStats(): {\r\n whitelisted: { ips: number; cidrs: number };\r\n blacklisted: { ips: number; cidrs: number };\r\n blocked: { ips: number; cidrs: number };\r\n geoBlocks: { blockedCountries: number; allowedCountries: number };\r\n lastRefresh: Date;\r\n refreshInterval: number;\r\n } {\r\n return {\r\n whitelisted: {\r\n ips: this.whitelistedIPs.size,\r\n cidrs: this.whitelistedCIDRs.length,\r\n },\r\n blacklisted: {\r\n ips: this.blacklistedIPs.size,\r\n cidrs: this.blacklistedCIDRs.length,\r\n },\r\n blocked: {\r\n ips: this.blockedIPs.size,\r\n cidrs: this.blockedCIDRs.length,\r\n },\r\n geoBlocks: {\r\n blockedCountries: this.blockedGeos.size,\r\n allowedCountries: this.allowedGeos.size,\r\n },\r\n lastRefresh: new Date(this.lastRefresh),\r\n refreshInterval: this.refreshInterval,\r\n };\r\n }\r\n\r\n /**\r\n * Force refresh of IP lists\r\n */\r\n async forceRefresh(): Promise {\r\n this.lastRefresh = 0; // Force refresh\r\n await this.refreshFromBlob();\r\n }\r\n}\r\n\r\n/**\r\n * Singleton instance for application use\r\n */\r\nexport const ipSecurityService = new IPSecurityService(5);\r\n\r\n/**\r\n * Convenience function for request IP checking\r\n */\r\nexport async function checkRequestIP(\r\n request: Request\r\n): Promise {\r\n const ip = getClientIP(request);\r\n return ipSecurityService.checkIP(ip, request);\r\n}\r\n\r\nexport default IPSecurityService;\r\n","deleted","label",[170,171,153],"src","services","permalink","https://www.val.town/x/ianmenethil/ZenServer/code/src/services/ipSecurityService.ts","extension","actionData","errors"]