SnapOtter db6f7bf38a feat(enterprise): add IP allowlisting with CIDR matching and Redis cache ...

Enterprise-gated onRequest hook that restricts API access to
configured CIDR ranges using Node 22's native BlockList.

- Plugin (ip-allowlist.ts): builds a BlockList from the ipAllowlist
  setting, caches in-process, syncs across instances via Redis pub/sub.
  Exempt paths for health probes, SCIM, SAML/OIDC callbacks.
  Handles IPv4-mapped IPv6 (::ffff:x.x.x.x) transparently.
- Admin API (enterprise/ip-allowlist.ts): GET/PUT endpoints gated by
  security:manage permission and ip_allowlist feature flag.  Validates
  CIDRs, prevents self-lockout, emits IP_ALLOWLIST_UPDATED audit event.
- 32 unit tests covering CIDR matching, validation, exempt paths, IPv6,
  and edge cases (/0, /32, mapped addresses).

2026-06-13 22:54:06 +08:00

..

drizzle

feat(db): add identity columns (lastActivity, toolPermissions, TOTP)

2026-06-13 22:04:14 +08:00

drizzle-sqlite-legacy

feat(tools): 2.0 phase 5 wave 5b - ai pool: ocr-pdf, transcription, background composites (5 tools) (#226)

2026-06-13 10:19:47 +08:00

scripts

feat(beautify): add device frame assets and PNG frame compositing

2026-05-08 16:12:46 +08:00

src

feat(enterprise): add IP allowlisting with CIDR matching and Redis cache

2026-06-13 22:54:06 +08:00

static

fix: resolve 7 bugs from QA sweep (#208)

2026-06-07 18:27:09 +08:00

drizzle.config.ts

feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack (#216)

2026-06-13 10:15:23 +08:00

package.json

chore: install @node-saml/node-saml and otpauth for Phase 3 identity

2026-06-13 22:04:03 +08:00

tsconfig.json

feat: add Fastify API server with health check and env config

2026-03-22 02:46:34 +08:00