improvement(network-policy): getSession chokepoint enforcement, per-entry labels, denial audit events, shared proxy helpers, lazy IP resolution

Author: waleedlatif1

apps/docs/content/docs/en/platform/enterprise/ip-access.mdx

@@ -13,7 +13,7 @@ IP Access lets organization owners and admins on Enterprise plans restrict where
 
 Go to **Settings → Security → IP access** in your organization settings.
 
-Add one entry per line — individual IPv4/IPv6 addresses or CIDR ranges (for example `203.0.113.7`, `10.0.0.0/16`, `2001:db8::/48`), up to 200 entries — then turn on **Restrict access by IP** and save.
+Add one entry per line — individual IPv4/IPv6 addresses or CIDR ranges, each with an optional label after a `#` (for example `203.0.113.7 # Office`, `10.0.0.0/16 # Frankfurt VPN`), up to 200 entries — then turn on **Restrict access by IP** and save.
 
 The settings page shows your current IP. Saving a list that would exclude your own address is rejected, so you cannot lock yourself (and your organization) out in one step.
 
@@ -26,7 +26,9 @@ The settings page shows your current IP. Saving a list that would exclude your o
 - **API keys** — personal and workspace API keys belonging to organization members are only accepted from allowed addresses.
 - **Live collaboration** — realtime canvas connections are checked at connect time.
 
-Deployed chats, public form shares, webhooks, and scheduled executions are **not** restricted — they are your organization's outward-facing product surfaces and server-side automations, not member access.
+Deployed chats, public form shares, webhooks, and scheduled executions are **not** restricted — they are your organization's outward-facing product surfaces and server-side automations, not member access. This scoping is intentional: those surfaces authenticate by their own means (share tokens, webhook signatures), and gating them on caller IP would break the product for its external audience.
+
+Policy changes and denied access attempts are recorded in the [audit log](/platform/enterprise/audit-logs) — denials include the member and the blocked address, throttled per member so a polling client cannot flood the log.
 
 ---
 

apps/realtime/src/middleware/network-policy.ts

@@ -3,9 +3,11 @@ import { db } from '@sim/db'
 import { member, organization } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import {
+  buildIpResolutionOptions,
   type CompiledAllowlist,
   compileAllowlist,
   isAddressAllowed,
+  parseTrustedProxies,
 } from '@sim/platform-authz/network'
 import { eq } from 'drizzle-orm'
 
@@ -22,23 +24,22 @@ interface CacheEntry {
 const policyCache = new Map<string, CacheEntry>()
 const membershipCache = new Map<string, { organizationId: string | null; fetchedAt: number }>()
 
-const trustedProxies = (process.env.AUTH_TRUSTED_PROXIES ?? '')
-  .split(',')
-  .map((entry) => entry.trim())
-  .filter(Boolean)
+const IP_RESOLUTION_OPTIONS = buildIpResolutionOptions(
+  parseTrustedProxies(process.env.AUTH_TRUSTED_PROXIES)
+)
 
-const IP_RESOLUTION_OPTIONS = {
-  advanced: {
-    ipAddress: trustedProxies.length > 0 ? { trustedProxies } : {},
-  },
-}
-
-const enforcementDisabled = process.env.DISABLE_ORG_IP_ALLOWLIST === 'true'
+/**
+ * Non-member results converge fast (matching the app-side membership cache)
+ * so a user who just joined an org through any path cannot dodge the policy
+ * for the full positive TTL.
+ */
+const NEGATIVE_MEMBERSHIP_CACHE_TTL_MS = 15 * 1000
 
 async function getMemberOrganizationId(userId: string): Promise<string | null> {
   const cached = membershipCache.get(userId)
-  if (cached && Date.now() - cached.fetchedAt < POLICY_CACHE_TTL_MS) {
-    return cached.organizationId
+  if (cached) {
+    const ttl = cached.organizationId ? POLICY_CACHE_TTL_MS : NEGATIVE_MEMBERSHIP_CACHE_TTL_MS
+    if (Date.now() - cached.fetchedAt < ttl) return cached.organizationId
   }
   const [row] = await db
     .select({ organizationId: member.organizationId })
@@ -83,15 +84,18 @@ interface HandshakeLike {
  * client IP denies the connection.
  *
  * Plan gating is intentionally absent here — `apps/realtime` cannot import
- * billing code. A downgraded org's stale policy denies sockets for at most
- * the policy-cache TTL beyond the app-side gate, and the app is the sole
- * writer of the settings.
+ * billing code, and over-denial is the safe direction for a security
+ * control (the app-side check makes the opposite, fail-open call on DB
+ * errors because a blip must not lock an org out of the product). A
+ * downgraded org's stored-but-enabled policy therefore keeps gating sockets
+ * until the org disables it; the app is the sole writer of the settings.
  */
 export async function isSocketAllowedByNetworkPolicy(
   userId: string,
   handshake: HandshakeLike
 ): Promise<boolean> {
-  if (enforcementDisabled) return true
+  // Read at call time so the break-glass works without a realtime restart.
+  if (process.env.DISABLE_ORG_IP_ALLOWLIST === 'true') return true
 
   try {
     const organizationId = await getMemberOrganizationId(userId)

apps/sim/app/api/organizations/[id]/network-policy/route.ts

@@ -208,7 +208,7 @@ export const PUT = withRouteHandler(
       success: true,
       data: {
         isEnterprise: true,
-        configured: normalizeConfigured(merged),
+        configured: { enabled: ipAllowlist.enabled, cidrs: ipAllowlist.cidrs },
         callerIp,
       },
     })

apps/sim/ee/network-policy/components/network-policy-settings.tsx

@@ -133,12 +133,12 @@ export function NetworkPolicySettings({ organizationId }: NetworkPolicySettingsP
             id='ip-allowlist-cidrs'
             value={cidrsText}
             onChange={(event) => setCidrsText(event.target.value)}
-            placeholder={'203.0.113.7\n10.0.0.0/16\n2001:db8::/48'}
+            placeholder={'203.0.113.7 # Office\n10.0.0.0/16 # Frankfurt VPN\n2001:db8::/48'}
             rows={8}
           />
           <p className='text-[var(--text-muted)] text-caption'>
-            One entry per line — IPv4/IPv6 addresses or CIDR ranges, up to{' '}
-            {MAX_IP_ALLOWLIST_ENTRIES} entries.
+            One entry per line — IPv4/IPv6 addresses or CIDR ranges with an optional {'# label'}, up
+            to {MAX_IP_ALLOWLIST_ENTRIES} entries.
             {data?.callerIp
               ? ` Your current IP is ${data.callerIp}; saving a list that excludes it is rejected.`
               : ''}

apps/sim/lib/api/contracts/organization.ts

@@ -205,22 +205,32 @@ export const revokeOrganizationSessionsResponseSchema = z.object({
 export const MAX_IP_ALLOWLIST_ENTRIES = 200
 
 export const updateOrganizationNetworkPolicyBodySchema = z.object({
-  ipAllowlist: z.object({
-    enabled: z.boolean(),
-    cidrs: z
-      .array(
-        z
-          .string()
-          .trim()
-          .min(1, 'Allowlist entries cannot be empty')
-          .max(64, 'Allowlist entries cannot exceed 64 characters')
-          .refine(isValidCidrEntry, {
-            message:
-              'Each entry must be a valid IPv4/IPv6 address or CIDR range (e.g. 10.0.0.0/16)',
-          })
-      )
-      .max(MAX_IP_ALLOWLIST_ENTRIES, `At most ${MAX_IP_ALLOWLIST_ENTRIES} allowlist entries`),
-  }),
+  ipAllowlist: z
+    .object({
+      enabled: z.boolean(),
+      cidrs: z
+        .array(
+          z
+            .string()
+            .trim()
+            .min(1, 'Allowlist entries cannot be empty')
+            .max(128, 'Allowlist entries cannot exceed 128 characters')
+            .refine(isValidCidrEntry, {
+              message:
+                'Each entry must be a valid IPv4/IPv6 address or CIDR range, optionally labelled (e.g. 10.0.0.0/16 # Frankfurt VPN)',
+            })
+        )
+        .max(MAX_IP_ALLOWLIST_ENTRIES, `At most ${MAX_IP_ALLOWLIST_ENTRIES} allowlist entries`),
+    })
+    .superRefine((value, ctx) => {
+      if (value.enabled && value.cidrs.length === 0) {
+        ctx.addIssue({
+          code: 'custom',
+          path: ['cidrs'],
+          message: 'Add at least one IP or CIDR range before enabling the allowlist',
+        })
+      }
+    }),
 })
 
 export type UpdateOrganizationNetworkPolicyBody = z.input<

apps/sim/lib/auth/auth.ts

@@ -6,6 +6,7 @@ import { stripe } from '@better-auth/stripe'
 import { db } from '@sim/db'
 import * as schema from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { parseTrustedProxies } from '@sim/platform-authz/network'
 import { toError } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { type BetterAuthOptions, betterAuth, type User } from 'better-auth'
@@ -34,7 +35,7 @@ import {
 import { getAccessControlConfig, isEmailBlockedByAccessControl } from '@/lib/auth/access-control'
 import { createAnonymousSession, ensureAnonymousUserExists } from '@/lib/auth/anonymous'
 import { getRequestedSignInProviderId, isSignInProviderAllowed } from '@/lib/auth/constants'
-import { enforceOrgNetworkPolicy } from '@/lib/auth/network-policy'
+import { enforceOrgNetworkPolicy, getTrustedClientIp } from '@/lib/auth/network-policy'
 import { getSessionCookieCacheVersion } from '@/lib/auth/security-policy'
 import { clampExpiryForSession } from '@/lib/auth/session-policy'
 import { guardSubscriptionPlanWrites } from '@/lib/auth/stripe-adapter-guard'
@@ -202,10 +203,7 @@ if (validStripeKey) {
  * hops, and records the first untrusted address as the session client IP —
  * preventing header spoofing behind multi-hop proxies.
  */
-const trustedProxies = (env.AUTH_TRUSTED_PROXIES ?? '')
-  .split(',')
-  .map((entry) => entry.trim())
-  .filter(Boolean)
+const trustedProxies = parseTrustedProxies(env.AUTH_TRUSTED_PROXIES)
 
 export const auth = betterAuth({
   baseURL: getBaseUrl(),
@@ -667,7 +665,7 @@ export const auth = betterAuth({
           // trusted-proxy-resolved client address. Thrown APIErrors must
           // propagate — deliberately outside the try below.
           if (!session.impersonatedBy) {
-            const network = await enforceOrgNetworkPolicy(session.userId, session.ipAddress)
+            const network = await enforceOrgNetworkPolicy(session.userId, () => session.ipAddress)
             if (!network.allowed) {
               logger.warn('Blocking session creation by org network policy', {
                 userId: session.userId,
@@ -3645,9 +3643,29 @@ async function getSessionImpl() {
   }
 
   const hdrs = await headers()
-  return await auth.api.getSession({
+  const session = await auth.api.getSession({
     headers: hdrs,
   })
+
+  // Org IP allowlists are enforced at this chokepoint so EVERY
+  // session-authenticated request — the 180+ routes and layouts that call
+  // getSession directly, not just hybrid-auth routes — re-checks the policy.
+  // A denied member is treated as signed out. Impersonation sessions are
+  // platform tooling and exempt.
+  const impersonatedBy = session
+    ? (session.session as { impersonatedBy?: string | null }).impersonatedBy
+    : null
+  if (session?.user?.id && !impersonatedBy) {
+    const network = await enforceOrgNetworkPolicy(session.user.id, () =>
+      getTrustedClientIp(new Request('http://localhost/', { headers: hdrs }))
+    )
+    if (!network.allowed) {
+      logger.warn('Session denied by org network policy', { userId: session.user.id })
+      return null
+    }
+  }
+
+  return session
 }
 
 export const getSession = cache(getSessionImpl)

apps/sim/lib/auth/hybrid.ts

@@ -193,7 +193,9 @@ export async function checkHybridAuth(
       const apiKeyHeader = request.headers.get(API_KEY_HEADER) ?? ''
       const result = await authenticateApiKeyFromHeader(apiKeyHeader)
       if (result.success) {
-        const network = await enforceOrgNetworkPolicy(result.userId, getTrustedClientIp(request))
+        const network = await enforceOrgNetworkPolicy(result.userId, () =>
+          getTrustedClientIp(request)
+        )
         if (!network.allowed) {
           return { success: false, error: network.reason }
         }
@@ -213,12 +215,10 @@ export async function checkHybridAuth(
       }
     }
 
+    // Org network policy for sessions is enforced inside getSession itself
+    // (a denied member resolves as signed out), so no re-check here.
     const session = await getSession()
     if (session?.user?.id) {
-      const network = await enforceOrgNetworkPolicy(session.user.id, getTrustedClientIp(request))
-      if (!network.allowed) {
-        return { success: false, error: network.reason }
-      }
       return {
         success: true,
         userId: session.user.id,

apps/sim/lib/auth/network-policy.ts

@@ -1,12 +1,15 @@
 import { getIp } from '@better-auth/core/utils/ip'
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import type { NetworkPolicySettings } from '@sim/db/schema'
 import { organization } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import {
+  buildIpResolutionOptions,
   type CompiledAllowlist,
   compileAllowlist,
   isAddressAllowed,
+  parseTrustedProxies,
 } from '@sim/platform-authz/network'
 import { eq } from 'drizzle-orm'
 import { getMemberOrganizationId } from '@/lib/auth/security-policy'
@@ -33,16 +36,9 @@ const policyCache = new Map<string, PolicyCacheEntry>()
 
 const NO_POLICY: ResolvedNetworkPolicy = { allowlist: null }
 
-const trustedProxies = (env.AUTH_TRUSTED_PROXIES ?? '')
-  .split(',')
-  .map((entry) => entry.trim())
-  .filter(Boolean)
-
-const IP_RESOLUTION_OPTIONS = {
-  advanced: {
-    ipAddress: trustedProxies.length > 0 ? { trustedProxies } : {},
-  },
-}
+const IP_RESOLUTION_OPTIONS = buildIpResolutionOptions(
+  parseTrustedProxies(env.AUTH_TRUSTED_PROXIES)
+)
 
 /**
  * Resolves the trusted client IP for a request using Better Auth's hardened
@@ -58,7 +54,10 @@ export function getTrustedClientIp(request: Request): string | null {
 /**
  * Resolves the EFFECTIVE network policy for an organization, served from a
  * short TTL cache. Mirrors the session policy's plan gating: hosted orgs no
- * longer on Enterprise stop enforcing automatically.
+ * longer on Enterprise stop enforcing automatically. A resolution failure
+ * deliberately fails OPEN here (no policy) — a transient DB blip must not
+ * lock an entire org out of the product; the realtime handshake makes the
+ * opposite call because denying one socket is cheap.
  */
 export async function getNetworkPolicy(
   organizationId: string | null | undefined
@@ -110,45 +109,75 @@ export interface NetworkPolicyDecision {
 }
 
 /**
- * Enforces the member org's IP allowlist for a user. `clientIp` is the
- * trusted-proxy-resolved address ({@link getTrustedClientIp} for requests,
- * Better Auth's `session.ipAddress` at session creation).
+ * Enforces the member org's IP allowlist for a user. `resolveClientIp`
+ * returns the trusted-proxy-resolved address ({@link getTrustedClientIp}
+ * for requests, Better Auth's `session.ipAddress` at session creation).
  *
  * Fail-closed by design: when a policy is active and no trustworthy client
  * IP can be derived, access is denied — a spoofable or absent address must
  * not bypass a network restriction. `DISABLE_ORG_IP_ALLOWLIST` is the
  * break-glass for misconfigured proxy topologies. Non-members and orgs
  * without an active policy are always allowed.
  */
+const ALLOWED: NetworkPolicyDecision = { allowed: true }
+const DENIED: NetworkPolicyDecision = {
+  allowed: false,
+  reason: 'Access restricted by your organization network policy. Contact your administrator.',
+}
+
+/**
+ * Denial audit events are throttled per user so a polling client outside the
+ * allowlist cannot flood the audit log — one event per user per window is
+ * enough for a security team to see who is being blocked and from where.
+ */
+const DENIAL_AUDIT_WINDOW_MS = 5 * 60 * 1000
+const lastDenialAuditAt = new Map<string, number>()
+
+function recordDenialAudit(userId: string, organizationId: string, clientIp: string | null): void {
+  const last = lastDenialAuditAt.get(userId)
+  if (last && Date.now() - last < DENIAL_AUDIT_WINDOW_MS) return
+  lastDenialAuditAt.set(userId, Date.now())
+  recordAudit({
+    workspaceId: null,
+    actorId: userId,
+    action: AuditAction.ORG_IP_ACCESS_DENIED,
+    resourceType: AuditResourceType.ORGANIZATION,
+    resourceId: organizationId,
+    description: clientIp
+      ? `Denied access from ${clientIp} by the IP allowlist`
+      : 'Denied access by the IP allowlist (client IP unresolvable)',
+    metadata: { clientIp },
+  })
+}
+
 export async function enforceOrgNetworkPolicy(
   userId: string | null | undefined,
-  clientIp: string | null | undefined
+  resolveClientIp: () => string | null | undefined
 ): Promise<NetworkPolicyDecision> {
-  if (env.DISABLE_ORG_IP_ALLOWLIST) return { allowed: true }
+  if (env.DISABLE_ORG_IP_ALLOWLIST) return ALLOWED
 
   const organizationId = await getMemberOrganizationId(userId)
-  if (!organizationId) return { allowed: true }
+  if (!organizationId) return ALLOWED
 
   const policy = await getNetworkPolicy(organizationId)
-  if (!policy.allowlist) return { allowed: true }
+  if (!policy.allowlist) return ALLOWED
 
+  // Resolved lazily: the common case (non-member or no active policy) never
+  // pays for forwarded-header parsing.
+  const clientIp = resolveClientIp()
   if (!clientIp) {
     logger.warn('Denying request: network policy active but client IP unresolvable', {
       userId,
       organizationId,
     })
-    return {
-      allowed: false,
-      reason: 'Access restricted by your organization network policy. Contact your administrator.',
-    }
+    if (userId) recordDenialAudit(userId, organizationId, null)
+    return DENIED
   }
 
   if (!isAddressAllowed(clientIp, policy.allowlist)) {
-    return {
-      allowed: false,
-      reason: 'Access restricted by your organization network policy. Contact your administrator.',
-    }
+    if (userId) recordDenialAudit(userId, organizationId, clientIp)
+    return DENIED
   }
 
-  return { allowed: true }
+  return ALLOWED
 }