refactor: move ip validity check to ip middleware and ensure IP is only present when needed.

packages/core/src/db/schemas.ts

@@ -125,7 +125,7 @@ const AddonSchema = z.object({
   resultPassthrough: z.boolean().optional(),
   forceToTop: z.boolean().optional(),
   headers: z.record(z.string().min(1), z.string().min(1)).optional(),
-  ip: z.string().optional(),
+  ip: z.union([z.ipv4(), z.ipv6()]).optional(),
 });
 
 // preset objects are transformed into addons by a preset transformer.

packages/core/src/db/users.ts

@@ -41,6 +41,7 @@ export class UserRepository {
         );
       }
       config.trusted = false;
+      config.ip = undefined;
       try {
         // don't skip errors, but don't decrypt credentials
         // as we need to store the encrypted version
@@ -190,6 +191,7 @@ export class UserRepository {
       decryptedConfig.trusted =
         Env.TRUSTED_UUIDS?.split(',').some((u) => new RegExp(u).test(uuid)) ??
         false;
+      decryptedConfig.ip = undefined;
       logger.info(`Retrieved configuration for user ${uuid}`);
       return applyMigrations(decryptedConfig);
     } catch (error) {
@@ -232,6 +234,7 @@ export class UserRepository {
         config.trusted =
           Env.TRUSTED_UUIDS?.split(',').some((u) => new RegExp(u).test(uuid)) ??
           false;
+        config.ip = undefined;
         let validatedConfig: UserData;
         try {
           validatedConfig = await validateConfig(config, {

packages/server/src/middlewares/ip.ts

@@ -1,8 +1,16 @@
 import { Request, Response, NextFunction } from 'express';
 import { createLogger, Env } from '@aiostreams/core';
+import { isIP } from 'net';
 
 const logger = createLogger('server');
 
+// Helper function to validate if a string is a valid IP address
+function isValidIp(ip: string | undefined): boolean {
+  if (!ip) return false;
+  // isIP returns 4 for IPv4, 6 for IPv6, and 0 for invalid
+  return isIP(ip) !== 0;
+}
+
 const isIpInRange = (ip: string, range: string) => {
   if (range.includes('/')) {
     // CIDR notation
@@ -80,7 +88,7 @@ export const ipMiddleware = (
       req.get('CF-Connecting-IP') ||
       ip
     : ip;
-  req.userIp = isPrivateIp(userIp) ? undefined : userIp;
-  req.requestIp = requestIp;
+  req.userIp = isPrivateIp(userIp) || !isValidIp(userIp) ? undefined : userIp;
+  req.requestIp = isValidIp(requestIp) ? requestIp : undefined;
   next();
 };

packages/server/src/middlewares/userData.ts

@@ -1,5 +1,4 @@
 import { Request, Response, NextFunction } from 'express';
-import { isIP } from 'net';
 import {
   createLogger,
   APIError,
@@ -14,16 +13,8 @@ import {
 const logger = createLogger('server');
 
 // Valid resources that require authentication
-// const VALID_RESOURCES = ['stream', 'configure'];
 const VALID_RESOURCES = [...constants.RESOURCES, 'manifest.json', 'configure'];
 
-// Helper function to validate if a string is a valid IP address
-function isValidIp(ip: string | undefined): boolean {
-  if (!ip) return false;
-  // isIP returns 4 for IPv4, 6 for IPv6, and 0 for invalid
-  return isIP(ip) !== 0;
-}
-
 export const userDataMiddleware = async (
   req: Request,
   res: Response,
@@ -107,8 +98,7 @@ export const userDataMiddleware = async (
 
     userData.encryptedPassword = encryptedPassword;
     userData.uuid = uuid;
-    // Only set IP if it's a valid IP address or undefined
-    userData.ip = isValidIp(req.userIp) ? req.userIp : undefined;
+    userData.ip = req.userIp;
 
     if (resource !== 'configure') {
       try {