feat(staking): add IP whitelist

Author: cprussin

apps/staking/src/config/server.ts

@@ -54,6 +54,7 @@ export const WALLETCONNECT_PROJECT_ID = demandInProduction(
 export const MAINNET_RPC = process.env.MAINNET_RPC;
 export const HERMES_URL = getOr("HERMES_URL", "https://hermes.pyth.network");
 export const BLOCKED_REGIONS = transformOr("BLOCKED_REGIONS", fromCsv, []);
+export const IP_ALLOWLIST = transformOr("IP_ALLOWLIST", fromCsv, []);
 export const GOVERNANCE_ONLY_REGIONS = transformOr(
   "GOVERNANCE_ONLY_REGIONS",
   fromCsv,

apps/staking/src/middleware.ts

@@ -10,6 +10,7 @@ import {
   BLOCKED_REGIONS,
   GOVERNANCE_ONLY_REGIONS,
   PROXYCHECK_API_KEY,
+  IP_ALLOWLIST,
 } from "./config/server";
 
 const GEO_BLOCKED_PATH = `/${GEO_BLOCKED_SEGMENT}`;
@@ -21,22 +22,31 @@ const proxyCheckClient = PROXYCHECK_API_KEY
   : undefined;
 
 export const middleware = async (request: NextRequest) => {
-  if (await isProxyBlocked(request)) {
-    return rewrite(request, VPN_BLOCKED_PATH);
-  } else if (isGovernanceOnlyRegion(request)) {
-    return rewrite(request, GOVERNANCE_ONLY_PATH);
-  } else if (isRegionBlocked(request)) {
-    return rewrite(request, GEO_BLOCKED_PATH);
-  } else if (isBlockedSegment(request)) {
-    return rewrite(request, "/not-found");
+  if (isIpAllowlisted(request)) {
+    return isBlockedSegment(request)
+      ? rewrite(request, "/not-found")
+      : undefined;
   } else {
-    return;
+    if (await isProxyBlocked(request)) {
+      return rewrite(request, VPN_BLOCKED_PATH);
+    } else if (isGovernanceOnlyRegion(request)) {
+      return rewrite(request, GOVERNANCE_ONLY_PATH);
+    } else if (isRegionBlocked(request)) {
+      return rewrite(request, GEO_BLOCKED_PATH);
+    } else if (isBlockedSegment(request)) {
+      return rewrite(request, "/not-found");
+    } else {
+      return;
+    }
   }
 };
 
 const rewrite = (request: NextRequest, path: string) =>
   NextResponse.rewrite(new URL(path, request.url));
 
+const isIpAllowlisted = ({ ip }: NextRequest) =>
+  ip !== undefined && IP_ALLOWLIST.includes(ip);
+
 const isGovernanceOnlyRegion = ({ geo }: NextRequest) =>
   geo?.country !== undefined &&
   GOVERNANCE_ONLY_REGIONS.includes(geo.country.toLowerCase());