Repository navigation
feat(auth): IP allow-list — network gating on auth routes (ADR-0069 D5, P2) - #2401
Merged
Merged
Conversation
…5, P2) - service-settings: new `allowed_ip_ranges` setting (Network group; CIDR/IP list). - plugin-auth: a Hono middleware registered ahead of the better-auth handler rejects auth requests from a client IP outside the ranges with 403 IP_NOT_ALLOWED. Client IP read trust-proxy-aware (x-forwarded-for first hop / cf-connecting-ip / x-real-ip). /config + /bootstrap-status exempt so a blocked client still gets a clean login + error. Fails OPEN when the IP can't be determined (missing proxy header = no-op, not a lockout). IPv4 CIDR + exact match (ipMatchesRange + isClientIpAllowed). Default-off / additive; ADR-0049. Verified live (dogfood, allowed=203.0.113.0/24): sign-in with XFF 8.8.8.8 -> 403 IP_NOT_ALLOWED; XFF 203.0.113.50 -> 200 + token; /config from a disallowed IP -> 200 (login renders); no XFF -> 200 (fail-open, admin not locked out). Unit: plugin-auth 208 + service-settings 129 green; full build incl. strict DTS green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 14 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-0069 P2 / D5 — IP allow-list (network gating).
What
New
allowed_ip_rangesauth setting (CIDR ranges or exact IPs, one per line / comma-separated; empty = no restriction). A Hono middleware registered ahead of the better-auth handler in the auth-route registration rejects auth requests from a client IP outside the ranges with403 IP_NOT_ALLOWED— the exact seam ADR-0069 D5 names.x-forwarded-for(first hop) →cf-connecting-ip→x-real-ip./config+/bootstrap-statusare exempt so a blocked client still gets a clean login page + a clear error (rather than a broken page).a.b.c.d/n) + exact IPv4/IPv6 matching (ipMatchesRange/isClientIpAllowed, unit-tested).ADR-0049
Default-off / additive (no upgrade behavior change); the setting ships with its enforcement.
Verification
allowed_ip_ranges=203.0.113.0/24):X-Forwarded-For: 8.8.8.8→403 IP_NOT_ALLOWEDX-Forwarded-For: 203.0.113.50→200+ token/configfrom a disallowed IP →200(login still renders)200(fail-open; admin not locked out)Scope / follow-ups (#2375)
This gates the auth routes (sign-in / session), per the ADR's D5 seam. Gating all data requests by IP, per-org
sys_organization.allowed_ip_ranges, and therequire_ip_matchsession-pinning toggle are follow-ups. Remaining ADR-0069 work: P3 SAML (needs a@better-auth/ssovs custom plugin decision). (OIDC trust-list UI / D6 verified already shipped via the SSO-provider surface.)🤖 Generated with Claude Code