Nick SzaunigandClaude Opus 5.5
f1dc0de3e2
A key can be limited to IP addresses or CIDR networks (e.g. the Wabenhain server); a stolen key is useless from anywhere else. Requests from other addresses get 403 "not allowed for this IP" and a log line. The admin UI asks for the addresses when creating a key, warns when a key works from anywhere, shows the last source address and can take it over into the allowlist - changing the list needs no new key (PATCH /api-keys/:id). Also: a key can only carry scopes its creator holds. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
18 lines
557 B
TypeScript
18 lines
557 B
TypeScript
import { ApiProperty } from '@nestjs/swagger';
|
|
import { ArrayMaxSize, IsArray, IsString, Validate } from 'class-validator';
|
|
import { MAX_ALLOWED_IPS } from '../ip-allowlist';
|
|
import { AllowedIpConstraint } from './allowed-ips.validator';
|
|
|
|
export class UpdateApiKeyDto {
|
|
@ApiProperty({
|
|
description:
|
|
'Erlaubte Absender (IP oder CIDR); leere Liste = von überall nutzbar',
|
|
type: [String],
|
|
})
|
|
@IsArray()
|
|
@ArrayMaxSize(MAX_ALLOWED_IPS)
|
|
@IsString({ each: true })
|
|
@Validate(AllowedIpConstraint, { each: true })
|
|
allowedIps!: string[];
|
|
}
|