perf(common): GeolocationMiddleware runs geoip lookup on every route including health checks

[phertyameen]

Summary

app.module.ts applies geolocation enrichment globally:

consumer.apply(GeolocationMiddleware).forRoutes('*');

This means every request pays a geoip-lite lookup, including:

• /health (hit continuously by load balancers and referenced by the graceful-shutdown probe in main.ts),
• /api Swagger document routes,
• all pre-auth auth/* traffic.

Infrastructure probes get geolocation side effects for IPs that will never be users, and the lookup cost lands on the hottest paths.

Proposal

1. Exclude infrastructure paths:

   consumer.apply(GeolocationMiddleware)
     .exclude('health', 'api/(.*)')
     .forRoutes('*');

2. Audit what consumes the enriched fields downstream (the analytics module recently gained PII hashing in event metadata - confirm country/city granularity is intentional there).
3. Add unit tests mirroring the style used for CorrelationIdMiddleware, including exclusion cases.

Acceptance criteria

• Health/Swagger paths bypass geolocation enrichment.
• Business routes still receive enrichment data.
• Middleware covered by unit tests including exclusion cases.

[guptakumarranjeet150]

Hi maintainers,

I would love to take this on. My planned approach:

• Structure backend handlers for perf(common): GeolocationMiddleware runs geoip lookup on every route including health checks with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

Looking forward to contributing—please feel free to assign!

[shobhamerabacha-star]

Hey team,

I would love to take this on. My planned approach:

• Structure backend handlers for perf(common): GeolocationMiddleware runs geoip lookup on every route including health checks with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

Happy to pick this up today—please assign to me!

[ranjeet150]

Hello @maintainers,

I would love to take this on. My planned approach:

• Structure backend handlers for perf(common): GeolocationMiddleware runs geoip lookup on every route including health checks with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

Happy to pick this up today—please assign to me!