@lock-dev/geo-block/dist/index.mjs

Geographic blocking module for lock.dev security framework

import {
  MemoryGeoCacheStore,
  RedisGeoCacheStore,
  UpstashGeoCacheStore,
  __esm,
  __export,
  __toCommonJS,
  createCacheStore
} from "./chunk-R24AWRDI.mjs";

// src/providers/ip-api.ts
var ip_api_exports = {};
__export(ip_api_exports, {
  IpApiProvider: () => IpApiProvider
});
var IpApiProvider;
var init_ip_api = __esm({
  "src/providers/ip-api.ts"() {
    "use strict";
    IpApiProvider = class {
      constructor(config) {
        this.apiKey = config.apiKey;
      }
      async init() {
      }
      async lookup(ip) {
        try {
          const url = this.apiKey ? `https://pro.ip-api.com/json/${ip}?key=${this.apiKey}&fields=status,message,countryCode,region,city,lat,lon` : `http://ip-api.com/json/${ip}?fields=status,message,countryCode,region,city,lat,lon`;
          const response = await fetch(url);
          if (!response.ok) {
            throw new Error(`IP-API request failed with status: ${response.status}`);
          }
          const data = await response.json();
          if (data.status === "success") {
            return {
              country: data.countryCode,
              region: data.region,
              city: data.city,
              latitude: data.lat,
              longitude: data.lon
            };
          } else {
            console.warn(`IP-API lookup failed: ${data.message}`);
            return {};
          }
        } catch (error) {
          console.error(`Error looking up IP ${ip} with IP-API:`, error);
          return {};
        }
      }
    };
  }
});

// src/types.ts
var GeoBlockEventType = /* @__PURE__ */ ((GeoBlockEventType2) => {
  GeoBlockEventType2["GEO_BLOCKED"] = "geo_blocked";
  return GeoBlockEventType2;
})(GeoBlockEventType || {});

// src/index.ts
import { createModule } from "@lock-dev/core";

// src/providers/index.ts
import * as fs2 from "fs";

// src/providers/maxmind.ts
import * as maxmind from "maxmind";
import * as fs from "fs";
var MaxMindProvider = class {
  constructor(config) {
    this.initialized = false;
    if (!config.maxmindDbPath) {
      throw new Error("MaxMind database path must be provided");
    }
    this.dbPath = config.maxmindDbPath;
  }
  async init() {
    if (this.initialized) return;
    try {
      if (!fs.existsSync(this.dbPath)) {
        throw new Error(`MaxMind database file not found at: ${this.dbPath}`);
      }
      this.reader = await maxmind.open(this.dbPath);
      this.initialized = true;
    } catch (error) {
      throw new Error(
        `Failed to initialize MaxMind database: ${error instanceof Error ? error.message : String(error)}`
      );
    }
  }
  async lookup(ip) {
    if (!this.initialized) {
      await this.init();
    }
    try {
      const result = this.reader.get(ip);
      if (!result) {
        return {};
      }
      return {
        country: result.country?.iso_code,
        region: result.subdivisions?.[0]?.iso_code,
        city: result.city?.names?.en,
        latitude: result.location?.latitude,
        longitude: result.location?.longitude
      };
    } catch (error) {
      console.error(`Error looking up IP ${ip}:`, error);
      return {};
    }
  }
};

// src/providers/index.ts
init_ip_api();
function createProvider(config) {
  if (config.provider === "maxmind") {
    if (!config.maxmindDbPath || !fs2.existsSync(config.maxmindDbPath)) {
      console.warn(
        `MaxMind database not found at path: ${config.maxmindDbPath || "undefined"}. Falling back to ip-api.com service.`
      );
      return new IpApiProvider(config);
    }
    return new MaxMindProvider(config);
  }
  switch (config.provider) {
    case "ipapi":
      return new IpApiProvider(config);
    case "custom":
      if (!config.customLookup) {
        throw new Error("Custom lookup function must be provided when using custom provider");
      }
      return {
        init: async () => {
        },
        lookup: config.customLookup
      };
    default:
      console.warn(`Unknown provider: ${config.provider}. Falling back to ip-api.com service.`);
      return new IpApiProvider(config);
  }
}

// src/utils/extract-ip.ts
function extractIp(request, ipHeaders = [], useRemoteAddress = true) {
  if (request.headers) {
    for (const header of ipHeaders) {
      const value = request.headers[header.toLowerCase()];
      if (value) {
        const parts = value.split(",");
        return parts[0].trim();
      }
    }
  }
  if (useRemoteAddress) {
    if (request.connection && request.connection.remoteAddress) {
      return request.connection.remoteAddress;
    }
    if (request.socket && request.socket.remoteAddress) {
      return request.socket.remoteAddress;
    }
  }
  return null;
}

// src/index.ts
import { registerModule } from "@lock-dev/core";
var DEFAULT_CONFIG = {
  mode: "blacklist",
  ipHeaders: ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"],
  useRemoteAddress: true,
  blockStatusCode: 403,
  blockMessage: "Access denied based on your location",
  provider: "ipapi",
  storage: "memory",
  cacheTtl: 36e5,
  cacheSize: 1e4,
  failBehavior: "open"
};
var geoCache = null;
var provider = null;
var geoBlock = createModule({
  name: "geo-block",
  defaultConfig: DEFAULT_CONFIG,
  async check(context, config) {
    try {
      if (!geoCache) {
        try {
          geoCache = await createCacheStore(config);
        } catch (cacheError) {
          console.error(`Failed to initialize geo cache: ${cacheError.message}`);
          const { MemoryGeoCacheStore: MemoryGeoCacheStore2 } = await import("./storage-4X2IQ37X.mjs");
          geoCache = new MemoryGeoCacheStore2(config);
          await geoCache.init();
        }
      }
      if (!provider) {
        provider = createProvider(config);
        try {
          await provider.init();
        } catch (initError) {
          console.error(`Failed to initialize geo provider: ${initError.message}`);
          if (config.failBehavior === "closed") {
            return {
              passed: false,
              reason: "geo_blocked" /* GEO_BLOCKED */,
              data: { error: "Geo provider failed to initialize" },
              severity: "medium"
            };
          }
          if (config.provider !== "ipapi") {
            try {
              const IpApiProvider2 = (init_ip_api(), __toCommonJS(ip_api_exports)).IpApiProvider;
              const fallbackProvider = new IpApiProvider2(config);
              await fallbackProvider.init();
              provider = fallbackProvider;
              console.warn("Successfully switched to ip-api fallback provider");
            } catch (fallbackError) {
              console.error(`Fallback provider also failed: ${fallbackError.message}`);
              return { passed: true };
            }
          } else {
            return { passed: true };
          }
        }
      }
      const ip = extractIp(context.request, config.ipHeaders, config.useRemoteAddress);
      if (!ip) {
        console.warn("No IP address could be extracted from the request");
        return { passed: true };
      }
      try {
        let geoInfo = await geoCache.get(ip);
        if (!geoInfo) {
          geoInfo = await provider.lookup(ip);
          if (geoInfo && Object.keys(geoInfo).length > 0) {
            await geoCache.set(ip, geoInfo);
          }
        }
        if (!geoInfo || !geoInfo.country) {
          console.warn(`No country information found for IP: ${ip}`);
          return { passed: true };
        }
        const country = geoInfo.country;
        context.data.set("geo-block:country", country);
        const isBlocked = config.mode === "blacklist" && config.countries.includes(country) || config.mode === "whitelist" && !config.countries.includes(country);
        if (isBlocked) {
          return {
            passed: false,
            reason: "geo_blocked" /* GEO_BLOCKED */,
            data: { ip, country, geoInfo },
            severity: "medium"
          };
        }
        return { passed: true };
      } catch (lookupError) {
        console.error(`Error during geo lookup for IP ${ip}:`, lookupError);
        if (config.failBehavior === "closed") {
          return {
            passed: false,
            reason: "geo_blocked" /* GEO_BLOCKED */,
            data: { error: "Geo lookup failed", ip },
            severity: "medium"
          };
        }
        return { passed: true };
      }
    } catch (error) {
      console.error(`Unexpected error in geo-block module:`, error);
      return {
        passed: config.failBehavior !== "closed",
        reason: config.failBehavior === "closed" ? "geo_blocked" /* GEO_BLOCKED */ : void 0,
        data: config.failBehavior === "closed" ? { error: "Geo-block module failed" } : void 0,
        severity: "medium"
      };
    }
  },
  async handleFailure(context, reason, data) {
    const config = context.data.get("geo-block:config");
    const res = context.response;
    if (res.headersSent || res.writableEnded) {
      return;
    }
    if (typeof res.status === "function") {
      return res.status(config.blockStatusCode ?? 403).json({
        error: config.blockMessage ?? "Access denied based on your location"
      });
    } else if (typeof res.statusCode === "number") {
      res.statusCode = config.blockStatusCode ?? 403;
      res.setHeader("Content-Type", "application/json");
      return res.end(
        JSON.stringify({
          error: config.blockMessage ?? "Access denied based on your location"
        })
      );
    }
  }
});
registerModule("geoBlock", geoBlock);
export {
  GeoBlockEventType,
  MemoryGeoCacheStore,
  RedisGeoCacheStore,
  UpstashGeoCacheStore,
  createCacheStore,
  extractIp,
  geoBlock
};