From d480067c9c66f0bd1afc68b8f974358ed39a2a49 Mon Sep 17 00:00:00 2001
From: Viren070 <viren070@protonmail.com>
Date: Mon, 27 Oct 2025 14:46:15 +0000
Subject: [PATCH] refactor: move ip validity check to ip middleware and ensure
 IP is only present when needed.

---
 packages/core/src/db/schemas.ts             |  2 +-
 packages/core/src/db/users.ts               |  3 +++
 packages/server/src/middlewares/ip.ts       | 12 ++++++++++--
 packages/server/src/middlewares/userData.ts | 12 +-----------
 4 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/packages/core/src/db/schemas.ts b/packages/core/src/db/schemas.ts
index a6a070b6..3ee6e140 100644
--- a/packages/core/src/db/schemas.ts
+++ b/packages/core/src/db/schemas.ts
@@ -125,7 +125,7 @@ const AddonSchema = z.object({
   resultPassthrough: z.boolean().optional(),
   forceToTop: z.boolean().optional(),
   headers: z.record(z.string().min(1), z.string().min(1)).optional(),
-  ip: z.string().optional(),
+  ip: z.union([z.ipv4(), z.ipv6()]).optional(),
 });
 
 // preset objects are transformed into addons by a preset transformer.
diff --git a/packages/core/src/db/users.ts b/packages/core/src/db/users.ts
index 3a756f5f..2e3024c3 100644
--- a/packages/core/src/db/users.ts
+++ b/packages/core/src/db/users.ts
@@ -41,6 +41,7 @@ export class UserRepository {
         );
       }
       config.trusted = false;
+      config.ip = undefined;
       try {
         // don't skip errors, but don't decrypt credentials
         // as we need to store the encrypted version
@@ -190,6 +191,7 @@ export class UserRepository {
       decryptedConfig.trusted =
         Env.TRUSTED_UUIDS?.split(',').some((u) => new RegExp(u).test(uuid)) ??
         false;
+      decryptedConfig.ip = undefined;
       logger.info(`Retrieved configuration for user ${uuid}`);
       return applyMigrations(decryptedConfig);
     } catch (error) {
@@ -232,6 +234,7 @@ export class UserRepository {
         config.trusted =
           Env.TRUSTED_UUIDS?.split(',').some((u) => new RegExp(u).test(uuid)) ??
           false;
+        config.ip = undefined;
         let validatedConfig: UserData;
         try {
           validatedConfig = await validateConfig(config, {
diff --git a/packages/server/src/middlewares/ip.ts b/packages/server/src/middlewares/ip.ts
index ffff7c30..306eb1e1 100644
--- a/packages/server/src/middlewares/ip.ts
+++ b/packages/server/src/middlewares/ip.ts
@@ -1,8 +1,16 @@
 import { Request, Response, NextFunction } from 'express';
 import { createLogger, Env } from '@aiostreams/core';
+import { isIP } from 'net';
 
 const logger = createLogger('server');
 
+// Helper function to validate if a string is a valid IP address
+function isValidIp(ip: string | undefined): boolean {
+  if (!ip) return false;
+  // isIP returns 4 for IPv4, 6 for IPv6, and 0 for invalid
+  return isIP(ip) !== 0;
+}
+
 const isIpInRange = (ip: string, range: string) => {
   if (range.includes('/')) {
     // CIDR notation
@@ -80,7 +88,7 @@ export const ipMiddleware = (
       req.get('CF-Connecting-IP') ||
       ip
     : ip;
-  req.userIp = isPrivateIp(userIp) ? undefined : userIp;
-  req.requestIp = requestIp;
+  req.userIp = isPrivateIp(userIp) || !isValidIp(userIp) ? undefined : userIp;
+  req.requestIp = isValidIp(requestIp) ? requestIp : undefined;
   next();
 };
diff --git a/packages/server/src/middlewares/userData.ts b/packages/server/src/middlewares/userData.ts
index e34555a4..a75b3643 100644
--- a/packages/server/src/middlewares/userData.ts
+++ b/packages/server/src/middlewares/userData.ts
@@ -1,5 +1,4 @@
 import { Request, Response, NextFunction } from 'express';
-import { isIP } from 'net';
 import {
   createLogger,
   APIError,
@@ -14,16 +13,8 @@ import {
 const logger = createLogger('server');
 
 // Valid resources that require authentication
-// const VALID_RESOURCES = ['stream', 'configure'];
 const VALID_RESOURCES = [...constants.RESOURCES, 'manifest.json', 'configure'];
 
-// Helper function to validate if a string is a valid IP address
-function isValidIp(ip: string | undefined): boolean {
-  if (!ip) return false;
-  // isIP returns 4 for IPv4, 6 for IPv6, and 0 for invalid
-  return isIP(ip) !== 0;
-}
-
 export const userDataMiddleware = async (
   req: Request,
   res: Response,
@@ -107,8 +98,7 @@ export const userDataMiddleware = async (
 
     userData.encryptedPassword = encryptedPassword;
     userData.uuid = uuid;
-    // Only set IP if it's a valid IP address or undefined
-    userData.ip = isValidIp(req.userIp) ? req.userIp : undefined;
+    userData.ip = req.userIp;
 
     if (resource !== 'configure') {
       try {