fix(network-policy): enforce on v1 API path, isTruthy break-glass, mapped-CIDR matching, realtime fail-open+audit consistency, drop dead exports

Author: waleedlatif1

apps/realtime/src/middleware/network-policy.ts

@@ -1,4 +1,5 @@
 import { getIp } from '@better-auth/core/utils/ip'
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { member, organization } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -72,23 +73,45 @@ async function getOrgAllowlist(organizationId: string): Promise<CompiledAllowlis
 
 interface HandshakeLike {
   headers: Record<string, string | string[] | undefined>
-  address: string
+}
+
+/**
+ * Per-member throttle for socket-denial audit events (this is a separate
+ * process from the app, so it keeps its own map) — one event per member per
+ * window is enough to show who is blocked without a reconnect loop flooding
+ * the log.
+ */
+const DENIAL_AUDIT_WINDOW_MS = 5 * 60 * 1000
+const lastDenialAuditAt = new Map<string, number>()
+
+function recordSocketDenial(userId: string, organizationId: string, clientIp: string | null): void {
+  const last = lastDenialAuditAt.get(userId)
+  if (last && Date.now() - last < DENIAL_AUDIT_WINDOW_MS) return
+  lastDenialAuditAt.set(userId, Date.now())
+  recordAudit({
+    workspaceId: null,
+    actorId: userId,
+    action: AuditAction.ORG_IP_ACCESS_DENIED,
+    resourceType: AuditResourceType.ORGANIZATION,
+    resourceId: organizationId,
+    description: clientIp
+      ? `Denied realtime connection from ${clientIp} by the IP allowlist`
+      : 'Denied realtime connection by the IP allowlist (client IP unresolvable)',
+    metadata: { clientIp, surface: 'realtime' },
+  })
 }
 
 /**
  * Socket-handshake counterpart of the app's org IP-allowlist enforcement.
  * Resolves the client IP with Better Auth's trusted-proxy resolver from the
- * handshake headers (falling back to the socket peer address when no
- * forwarding headers are present), then checks the member org's allowlist.
- * Fail-closed like the app side: an active policy with an unresolvable
- * client IP denies the connection.
+ * handshake headers, then checks the member org's allowlist. Shares the
+ * app's posture: fail-closed on an unresolvable client IP (active policy +
+ * no derivable trusted IP → deny), fail-open on an unexpected/DB error.
  *
  * Plan gating is intentionally absent here — `apps/realtime` cannot import
- * billing code, and over-denial is the safe direction for a security
- * control (the app-side check makes the opposite, fail-open call on DB
- * errors because a blip must not lock an org out of the product). A
- * downgraded org's stored-but-enabled policy therefore keeps gating sockets
- * until the org disables it; the app is the sole writer of the settings.
+ * billing code. A downgraded org's stored-but-enabled policy therefore keeps
+ * gating sockets until the org disables it (the app is the sole writer of
+ * the settings), which is the safe direction for a security control.
  */
 export async function isSocketAllowedByNetworkPolicy(
   userId: string,
@@ -109,20 +132,33 @@ export async function isSocketAllowedByNetworkPolicy(
       if (typeof value === 'string') headers.set(key, value)
       else if (Array.isArray(value)) headers.set(key, value.join(', '))
     }
-    const clientIp =
-      getIp(new Request('http://socket.internal/', { headers }), IP_RESOLUTION_OPTIONS) ??
-      (handshake.address || null)
+    // Trust only the trusted-proxy-resolved address — the same resolution the
+    // app uses. No fallback to the raw socket peer: matching the app's
+    // fail-closed-on-unresolvable-IP behavior is more important than salvaging
+    // a direct-connect address the app-side check would never have accepted.
+    const clientIp = getIp(
+      new Request('http://socket.internal/', { headers }),
+      IP_RESOLUTION_OPTIONS
+    )
 
     if (!clientIp) {
       logger.warn('Denying socket: network policy active but client IP unresolvable', {
         userId,
         organizationId,
       })
+      recordSocketDenial(userId, organizationId, null)
+      return false
+    }
+    if (!isAddressAllowed(clientIp, allowlist)) {
+      recordSocketDenial(userId, organizationId, clientIp)
       return false
     }
-    return isAddressAllowed(clientIp, allowlist)
+    return true
   } catch (error) {
-    logger.error('Network policy check failed; denying socket', { userId, error })
-    return false
+    // Fail OPEN on an unexpected/DB error, matching the app-side network-policy
+    // loader — a transient blip must not lock members out of collaboration.
+    // The primary boundary (policy loaded, IP not allowed) stays fail-closed.
+    logger.error('Network policy check failed; allowing socket', { userId, error })
+    return true
   }
 }

apps/sim/app/api/v1/auth.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import type { NextRequest } from 'next/server'
 import { authenticateApiKeyFromHeader, updateApiKeyLastUsed } from '@/lib/api-key/service'
 import { ANONYMOUS_USER_ID } from '@/lib/auth/constants'
+import { enforceOrgNetworkPolicy, getTrustedClientIp } from '@/lib/auth/network-policy'
 import { isAuthDisabled } from '@/lib/core/config/env-flags'
 
 const logger = createLogger('V1Auth')
@@ -43,6 +44,17 @@ export async function authenticateV1Request(request: NextRequest): Promise<AuthR
       }
     }
 
+    // Org IP allowlist applies to API-key auth on the public v1 surface too,
+    // mirroring the legacy hybrid-auth path — otherwise a member under an IP
+    // restriction could bypass it by calling v1 instead.
+    const network = await enforceOrgNetworkPolicy(result.userId, () => getTrustedClientIp(request))
+    if (!network.allowed) {
+      return {
+        authenticated: false,
+        error: network.reason,
+      }
+    }
+
     await updateApiKeyLastUsed(result.keyId!)
 
     return {

apps/sim/lib/auth/network-policy.ts

@@ -14,13 +14,13 @@ import {
 import { eq } from 'drizzle-orm'
 import { getMemberOrganizationId } from '@/lib/auth/security-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
-import { env } from '@/lib/core/config/env'
+import { env, isTruthy } from '@/lib/core/config/env'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 
 const logger = createLogger('NetworkPolicy')
 
 /** How long a compiled org network policy is served from process memory. */
-export const NETWORK_POLICY_CACHE_TTL_MS = 60 * 1000
+const NETWORK_POLICY_CACHE_TTL_MS = 60 * 1000
 
 interface ResolvedNetworkPolicy {
   /** Compiled allowlist, or null when no restriction applies. */
@@ -59,7 +59,7 @@ export function getTrustedClientIp(request: Request): string | null {
  * lock an entire org out of the product; the realtime handshake makes the
  * opposite call because denying one socket is cheap.
  */
-export async function getNetworkPolicy(
+async function getNetworkPolicy(
   organizationId: string | null | undefined
 ): Promise<ResolvedNetworkPolicy> {
   if (!organizationId) return NO_POLICY
@@ -119,11 +119,24 @@ const DENIED: NetworkPolicyDecision = {
  * enough for a security team to see who is being blocked and from where.
  */
 const DENIAL_AUDIT_WINDOW_MS = 5 * 60 * 1000
+const DENIAL_AUDIT_MAX_TRACKED = 10_000
 const lastDenialAuditAt = new Map<string, number>()
 
+/** Test-only: clears the denial-audit throttle so suites don't cross-pollute. */
+export function __resetDenialAuditThrottle(): void {
+  lastDenialAuditAt.clear()
+}
+
 function recordDenialAudit(userId: string, organizationId: string, clientIp: string | null): void {
   const last = lastDenialAuditAt.get(userId)
   if (last && Date.now() - last < DENIAL_AUDIT_WINDOW_MS) return
+  // Bound the throttle map: on overflow, drop the oldest-inserted key (Map
+  // preserves insertion order). Denied users are all authenticated, so this
+  // is a slow ceiling, not an attacker-inflatable one.
+  if (lastDenialAuditAt.size >= DENIAL_AUDIT_MAX_TRACKED) {
+    const oldest = lastDenialAuditAt.keys().next().value
+    if (oldest !== undefined) lastDenialAuditAt.delete(oldest)
+  }
   lastDenialAuditAt.set(userId, Date.now())
   recordAudit({
     workspaceId: null,
@@ -153,7 +166,7 @@ export async function enforceOrgNetworkPolicy(
   userId: string | null | undefined,
   resolveClientIp: () => string | null | undefined
 ): Promise<NetworkPolicyDecision> {
-  if (env.DISABLE_ORG_IP_ALLOWLIST) return ALLOWED
+  if (isTruthy(env.DISABLE_ORG_IP_ALLOWLIST)) return ALLOWED
 
   const organizationId = await getMemberOrganizationId(userId)
   if (!organizationId) return ALLOWED

packages/platform-authz/src/network.test.ts

@@ -15,6 +15,7 @@ describe('isValidCidrEntry', () => {
     ' 10.0.0.0/24 ',
     '10.0.0.0/16 # Frankfurt VPN',
     '203.0.113.7 #office',
+    '::ffff:10.0.0.0/120',
   ])('accepts %s', (entry) => {
     expect(isValidCidrEntry(entry)).toBe(true)
   })
@@ -34,6 +35,7 @@ describe('isValidCidrEntry', () => {
     'fe80::%eth0',
     '# label only',
     'banana # labelled garbage',
+    '::ffff:10.0.0.0/24',
   ])('rejects %s', (entry) => {
     expect(isValidCidrEntry(entry)).toBe(false)
   })
@@ -81,6 +83,15 @@ describe('isAddressAllowed', () => {
     expect(isAddressAllowed('203.0.113.7', compiled)).toBe(false)
   })
 
+  it('matches an IPv4-mapped-IPv6 CIDR entry against demoted mapped clients', () => {
+    const mapped = compileAllowlist(['::ffff:10.0.0.0/120'])
+    expect(mapped.v4).toHaveLength(1)
+    expect(mapped.v6).toHaveLength(0)
+    expect(isAddressAllowed('::ffff:10.0.0.5', mapped)).toBe(true)
+    expect(isAddressAllowed('10.0.0.5', mapped)).toBe(true)
+    expect(isAddressAllowed('::ffff:10.0.1.5', mapped)).toBe(false)
+  })
+
   it('labels never affect matching', () => {
     const labelled = compileAllowlist(['10.0.0.0/16 # Frankfurt VPN'])
     expect(isAddressAllowed('10.0.5.5', labelled)).toBe(true)

packages/platform-authz/src/network.ts

@@ -90,6 +90,22 @@ function parseCidr(entry: string): ParsedCidr | null {
   const [host, prefixPart, ...rest] = stripEntryLabel(entry).split('/')
   if (rest.length > 0) return null
 
+  // An IPv4-mapped IPv6 host (`::ffff:a.b.c.d`) is canonicalized to IPv4 so it
+  // lands in the same family bucket as the client addresses isAddressAllowed
+  // demotes — otherwise a mapped-form entry compiles into the v6 list and a
+  // mapped client, demoted to v4, would never match it. A prefix on the
+  // mapped form addresses the full 128-bit space, so its meaningful range is
+  // the low 32 bits (>= /96); demote it by 96.
+  const mappedV4 = host.match(/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i)
+  if (mappedV4) {
+    const v4Mapped = parseIpv4(mappedV4[1])
+    if (v4Mapped === null) return null
+    if (prefixPart === undefined) return { kind: 'v4', value: v4Mapped, prefix: 32 }
+    const mappedPrefix = Number(prefixPart)
+    if (!Number.isInteger(mappedPrefix) || mappedPrefix < 96 || mappedPrefix > 128) return null
+    return { kind: 'v4', value: v4Mapped, prefix: mappedPrefix - 96 }
+  }
+
   const v4 = parseIpv4(host)
   if (v4 !== null) {
     const prefix = prefixPart === undefined ? 32 : Number(prefixPart)