 SnapOtter
|
db6f7bf38a
|
feat(enterprise): add IP allowlisting with CIDR matching and Redis cache
Enterprise-gated onRequest hook that restricts API access to
configured CIDR ranges using Node 22's native BlockList.
- Plugin (ip-allowlist.ts): builds a BlockList from the ipAllowlist
setting, caches in-process, syncs across instances via Redis pub/sub.
Exempt paths for health probes, SCIM, SAML/OIDC callbacks.
Handles IPv4-mapped IPv6 (::ffff:x.x.x.x) transparently.
- Admin API (enterprise/ip-allowlist.ts): GET/PUT endpoints gated by
security:manage permission and ip_allowlist feature flag. Validates
CIDRs, prevents self-lockout, emits IP_ALLOWLIST_UPDATED audit event.
- 32 unit tests covering CIDR matching, validation, exempt paths, IPv6,
and edge cases (/0, /32, mapped addresses).
|
2026-06-13 22:54:06 +08:00 |
|