admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
40 lines
1.7 KiB
TypeScript
40 lines
1.7 KiB
TypeScript
/**
|
|
* Truncate a client IP to a privacy-preserving prefix for rate limiting and
|
|
* forensic logging: IPv4 to its /24, IPv6 to its /48. Enough for abuse
|
|
* correlation, not enough to identify a point of presence.
|
|
*
|
|
* Honors `x-forwarded-for` when set (Vercel / proxies); behind Vercel the
|
|
* leftmost value is rewritten by the edge so we accept it as authoritative.
|
|
*
|
|
* Lives in its own module (no route or init imports) so both the v1 REST
|
|
* wrapper and the MCP server can use it without an import cycle.
|
|
*/
|
|
export function truncateIp(ip: string | undefined): string | undefined {
|
|
if (!ip) return undefined
|
|
// IPv4: validate octets are 0-255, then drop last octet → "203.0.113.0/24".
|
|
// Out-of-range octets indicate a spoofed or malformed header; refuse to
|
|
// log a pseudo-IP that would pollute abuse-pattern analysis.
|
|
const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip)
|
|
if (v4) {
|
|
const octets = [v4[1], v4[2], v4[3], v4[4]].map((s) => Number.parseInt(s, 10))
|
|
if (octets.every((o) => o >= 0 && o <= 255)) {
|
|
return `${octets[0]}.${octets[1]}.${octets[2]}.0/24`
|
|
}
|
|
return undefined
|
|
}
|
|
// IPv6: keep first 3 hextets → "2001:db8:abc::/48"
|
|
const v6 = /^([0-9a-f]{1,4}:[0-9a-f]{1,4}:[0-9a-f]{1,4}):/i.exec(ip)
|
|
if (v6) return `${v6[1]}::/48`
|
|
return undefined
|
|
}
|
|
|
|
/**
|
|
* The client IP as the request presents it: leftmost `x-forwarded-for`
|
|
* entry, else `x-real-ip`, else undefined.
|
|
*/
|
|
export function requestClientIp(request: Request): string | undefined {
|
|
const forwarded = request.headers.get('x-forwarded-for')
|
|
if (forwarded) return forwarded.split(',')[0]?.trim() || undefined
|
|
return request.headers.get('x-real-ip') ?? undefined
|
|
}
|