feat: add client IP diagnostics and blocking

back/api/clientIp.ts

@@ -0,0 +1,55 @@
+import { NextFunction, Request, Response, Router } from 'express';
+import { celebrate, Joi } from 'celebrate';
+import {
+  diagnoseClientIp,
+  getTrustProxyConfig,
+  updateTrustProxy,
+} from '../shared/trustProxy';
+
+const route = Router();
+
+export default (app: Router) => {
+  app.use('/system/client-ip', route);
+
+  route.get(
+    '/config',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.send({ code: 200, data: await getTrustProxyConfig() });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+
+  route.put(
+    '/config',
+    celebrate({
+      body: Joi.object({
+        trustProxy: Joi.string().max(500).required(),
+      }),
+    }),
+    async (req: Request, res: Response) => {
+      try {
+        const data = await updateTrustProxy(req.body.trustProxy);
+        res.send({ code: 200, data });
+      } catch (error) {
+        res.send({
+          code: 400,
+          message: error instanceof Error ? error.message : '配置更新失败',
+        });
+      }
+    },
+  );
+
+  route.get(
+    '/diagnose',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.send({ code: 200, data: await diagnoseClientIp(req) });
+      } catch (error) {
+        next(error);
+      }
+    },
+  );
+};

back/api/index.ts

@@ -12,6 +12,7 @@ import subscription from './subscription';
 import update from './update';
 import dashboard from './dashboard';
 import health from './health';
+import clientIp from './clientIp';
 
 export default () => {
   const app = Router();
@@ -28,6 +29,7 @@ export default () => {
   update(app);
   dashboard(app);
   health(app);
+  clientIp(app);
 
   return app;
 };

back/api/user.ts

@@ -189,6 +189,59 @@ export default (app: Router) => {
     },
   );
 
+  route.get(
+    '/ip-blacklist',
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.getIpBlacklist();
+        res.send({ code: 200, data });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.put(
+    '/ip-blacklist',
+    celebrate({
+      body: Joi.object({
+        ip: Joi.string()
+          .ip({ version: ['ipv4', 'ipv6'], cidr: 'forbidden' })
+          .required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.blockIp(req.body.ip);
+        res.send({ code: 200, data, message: t('已加入 IP 黑名单') });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
+  route.delete(
+    '/ip-blacklist',
+    celebrate({
+      body: Joi.object({
+        ip: Joi.string()
+          .ip({ version: ['ipv4', 'ipv6'], cidr: 'forbidden' })
+          .required(),
+      }),
+    }),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const userService = Container.get(UserService);
+        const data = await userService.unblockIp(req.body.ip);
+        res.send({ code: 200, data, message: t('已移出 IP 黑名单') });
+      } catch (e) {
+        return next(e);
+      }
+    },
+  );
+
   route.get(
     '/notification',
     async (req: Request, res: Response, next: NextFunction) => {

back/data/system.ts

@@ -78,6 +78,7 @@ export interface AuthInfo {
   twoFactorActivated: boolean;
   twoFactorSecret: string;
   avatar: string;
+  blockedIps?: string[];
 }
 
 export type SystemModelInfo = SystemConfigInfo &

back/loaders/app.ts

@@ -6,6 +6,7 @@ import { Application } from 'express';
 import linkDeps from './deps';
 import initTask from './initTask';
 import initFile from './initFile';
+import { initializeTrustProxy } from '../shared/trustProxy';
 
 export default async ({ app }: { app: Application }) => {
   depInjectorLoader();
@@ -24,5 +25,6 @@ export default async ({ app }: { app: Application }) => {
   Logger.info('[boot] Init task loaded');
 
   expressLoader({ app });
+  await initializeTrustProxy(app);
   Logger.info('[boot] Express loaded');
 };

back/loaders/express.ts

@@ -15,11 +15,25 @@ import path from 'path';
 import { t } from '../shared/i18n';
 import { AppScope } from '../data/open';
 
+function resolveTrustProxy(value = process.env.QL_TRUST_PROXY) {
+  const setting = value?.trim();
+  if (!setting) {
+    return 'loopback';
+  }
+  if (setting === 'true' || setting === 'false') {
+    return setting === 'true';
+  }
+  if (/^\d+$/.test(setting)) {
+    return Number(setting);
+  }
+  return setting;
+}
+
 export default ({ app }: { app: Application }) => {
   // Security: Enable strict routing to prevent case-insensitive path bypass
   app.set('case sensitive routing', true);
   app.set('strict routing', true);
-  app.set('trust proxy', 'loopback');
+  app.set('trust proxy', resolveTrustProxy());
   app.use(cors());
 
   // Security: Path normalization middleware to prevent case variation attacks
@@ -28,11 +42,14 @@ export default ({ app }: { app: Application }) => {
     const normalizedPath = originalPath.toLowerCase();
 
     // Block requests with case variations on protected paths
-    if (originalPath !== normalizedPath &&
-      (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/open/'))) {
+    if (
+      originalPath !== normalizedPath &&
+      (normalizedPath.startsWith('/api/') ||
+        normalizedPath.startsWith('/open/'))
+    ) {
       return res.status(400).json({
         code: 400,
-        message: 'Invalid path format'
+        message: 'Invalid path format',
       });
     }
 
@@ -97,7 +114,10 @@ export default ({ app }: { app: Application }) => {
           return next(err);
         }
 
-        if (!currentToken || currentToken.expiration < Math.round(Date.now() / 1000)) {
+        if (
+          !currentToken ||
+          currentToken.expiration < Math.round(Date.now() / 1000)
+        ) {
           const err = new UnauthorizedError('invalid_token', {
             message: t('Token 已失效'),
           });
@@ -123,9 +143,7 @@ export default ({ app }: { app: Application }) => {
     }
 
     const errorCode = headerToken ? 'invalid_token' : 'credentials_required';
-    const errorMessage = headerToken
-      ? t('Token 已失效')
-      : t('请先登录');
+    const errorMessage = headerToken ? t('Token 已失效') : t('请先登录');
     const err = new UnauthorizedError(errorCode, { message: errorMessage });
     next(err);
   });
@@ -142,8 +160,7 @@ export default ({ app }: { app: Application }) => {
     ) {
       return next();
     }
-    const authInfo =
-      (await shareStore.getAuthInfo()) || ({} as AuthInfo);
+    const authInfo = (await shareStore.getAuthInfo()) || ({} as AuthInfo);
 
     let isInitialized = !isDefaultAuthInfo(authInfo);
 

back/services/user.ts

@@ -20,12 +20,12 @@ import ScheduleService from './schedule';
 import SockService from './sock';
 import dayjs from 'dayjs';
 import IP2Region from 'ip2region';
-import requestIp from 'request-ip';
 import uniq from 'lodash/uniq';
 import pickBy from 'lodash/pickBy';
 import isNil from 'lodash/isNil';
 import { shareStore } from '../shared/store';
 import { t, tf } from '../shared/i18n';
+import { getClientIp, normalizeClientIp } from '../shared/clientIp';
 
 @Service()
 export default class UserService {
@@ -49,6 +49,14 @@ export default class UserService {
     let { username, password } = payloads;
     const content = await this.getAuthInfo();
     const timestamp = Date.now();
+    const ip = getClientIp(req);
+    const query = new IP2Region();
+    const ipAddress = query.search(ip);
+    let address = '';
+    if (ipAddress) {
+      const { country, province, city, isp } = ipAddress;
+      address = uniq([country, province, city, isp]).filter(Boolean).join(' ');
+    }
     let {
       username: cUsername,
       password: cPassword,
@@ -59,7 +67,27 @@ export default class UserService {
       twoFactorActivated,
       tokens = {},
       platform,
+      blockedIps = [],
     } = content;
+
+    if (
+      ip &&
+      blockedIps.some((blockedIp) => normalizeClientIp(blockedIp) === ip)
+    ) {
+      await this.insertDb({
+        type: AuthDataType.loginLog,
+        info: {
+          timestamp,
+          address,
+          ip,
+          platform: req.platform,
+          status: LoginStatus.fail,
+        },
+      });
+      this.getLoginLog();
+      return { code: 403, message: t('该 IP 已被列入黑名单') };
+    }
+
     const retriesTime = Math.pow(3, retries) * 1000;
     if (retries > 2 && timestamp - lastlogon < retriesTime) {
       const waitTime = Math.ceil(
@@ -87,14 +115,6 @@ export default class UserService {
       };
     }
 
-    const ip = requestIp.getClientIp(req) || '';
-    const query = new IP2Region();
-    const ipAddress = query.search(ip);
-    let address = '';
-    if (ipAddress) {
-      const { country, province, city, isp } = ipAddress;
-      address = uniq([country, province, city, isp]).filter(Boolean).join(' ');
-    }
     if (username === cUsername && password === cPassword) {
       const data = createRandomString(50, 100);
       const expiration = twoFactorActivated ? '60d' : '20d';
@@ -264,6 +284,33 @@ export default class UserService {
     return [];
   }
 
+  public async getIpBlacklist(): Promise<string[]> {
+    const authInfo = await this.getAuthInfo();
+    return uniq((authInfo.blockedIps || []).map(normalizeClientIp)).filter(
+      Boolean,
+    );
+  }
+
+  public async blockIp(ip: string): Promise<string[]> {
+    const authInfo = await this.getAuthInfo();
+    const blockedIps = uniq([
+      ...(authInfo.blockedIps || []).map(normalizeClientIp),
+      normalizeClientIp(ip),
+    ]).filter(Boolean);
+    await this.updateAuthInfo(authInfo, { blockedIps });
+    return blockedIps;
+  }
+
+  public async unblockIp(ip: string): Promise<string[]> {
+    const authInfo = await this.getAuthInfo();
+    const normalizedIp = normalizeClientIp(ip);
+    const blockedIps = (authInfo.blockedIps || [])
+      .map(normalizeClientIp)
+      .filter((blockedIp) => blockedIp && blockedIp !== normalizedIp);
+    await this.updateAuthInfo(authInfo, { blockedIps });
+    return blockedIps;
+  }
+
   private async insertDb(payload: SystemInfo): Promise<SystemInfo> {
     const doc = await SystemModel.create({ ...payload }, { returning: true });
     return doc;
@@ -330,7 +377,7 @@ export default class UserService {
     if (isValid) {
       return this.login({ username, password }, req, false);
     } else {
-      const ip = requestIp.getClientIp(req) || '';
+      const ip = getClientIp(req);
       const query = new IP2Region();
       const ipAddress = query.search(ip);
       let address = '';

back/shared/clientIp.ts

@@ -0,0 +1,29 @@
+import { Request } from 'express';
+
+const IPV4_MAPPED_PREFIX = '::ffff:';
+
+export function normalizeClientIp(value?: string): string {
+  let ip = (value || '').trim().toLowerCase();
+  if (!ip) {
+    return '';
+  }
+
+  if (ip.startsWith('[') && ip.endsWith(']')) {
+    ip = ip.slice(1, -1);
+  }
+
+  const zoneIndex = ip.indexOf('%');
+  if (zoneIndex !== -1) {
+    ip = ip.slice(0, zoneIndex);
+  }
+
+  if (ip.startsWith(IPV4_MAPPED_PREFIX)) {
+    return ip.slice(IPV4_MAPPED_PREFIX.length);
+  }
+
+  return ip;
+}
+
+export function getClientIp(req: Request): string {
+  return normalizeClientIp(req.ip || req.socket.remoteAddress);
+}

back/shared/i18n.ts

@@ -98,6 +98,9 @@ const messages: Record<string, Record<string, string>> = {
       'Log name can only contain letters, numbers, underscores, and hyphens',
     '日志名称不能超过100个字符': 'Log name cannot exceed 100 characters',
     '错误的用户名密码，请重试': 'Incorrect username or password, please try again',
+    '该 IP 已被列入黑名单': 'This IP address has been blocked',
+    '已加入 IP 黑名单': 'IP address added to the blacklist',
+    '已移出 IP 黑名单': 'IP address removed from the blacklist',
     '青龙快讯': 'QingLong',
     '登录通知': 'Login Notification',
     '你于': 'You at ',

back/shared/trustProxy.ts

@@ -0,0 +1,142 @@
+import express, { Application, Request } from 'express';
+import { AuthDataType, SystemModel } from '../data/system';
+import { normalizeClientIp } from './clientIp';
+
+const DEFAULT_TRUST_PROXY = 'loopback';
+
+type TrustProxyValue = boolean | number | string;
+
+let activeApp: Application | undefined;
+
+function getEnvironmentSetting(): string {
+  return process.env.QL_TRUST_PROXY?.trim() || '';
+}
+
+function normalizeSetting(value?: string): string {
+  return value?.trim() || DEFAULT_TRUST_PROXY;
+}
+
+export function resolveTrustProxy(value?: string): TrustProxyValue {
+  const setting = normalizeSetting(value);
+  if (setting === 'true' || setting === 'false') {
+    return setting === 'true';
+  }
+  if (/^\d+$/.test(setting)) {
+    return Number(setting);
+  }
+  return setting;
+}
+
+function validateTrustProxy(value: string): string {
+  const setting = normalizeSetting(value);
+  if (setting.length > 500 || /[\r\n]/.test(setting)) {
+    throw new Error('trust proxy 配置格式无效');
+  }
+  if (/^\d+$/.test(setting) && Number(setting) > 20) {
+    throw new Error('代理层数不能超过 20');
+  }
+
+  const probe = express();
+  probe.set('trust proxy', resolveTrustProxy(setting));
+  return setting;
+}
+
+async function getStoredSetting(): Promise<string> {
+  const doc = await SystemModel.findOne({
+    where: { type: AuthDataType.systemConfig },
+  });
+  const info = (doc?.get('info') || {}) as Record<string, unknown>;
+  return typeof info.trustProxy === 'string' ? info.trustProxy : '';
+}
+
+export async function getTrustProxyConfig() {
+  const environmentSetting = getEnvironmentSetting();
+  const storedSetting = await getStoredSetting();
+  const trustProxy = normalizeSetting(environmentSetting || storedSetting);
+
+  return {
+    trustProxy,
+    source: environmentSetting
+      ? 'environment'
+      : storedSetting
+      ? 'system'
+      : 'default',
+    editable: !environmentSetting,
+  };
+}
+
+export async function initializeTrustProxy(app: Application) {
+  activeApp = app;
+  const { trustProxy } = await getTrustProxyConfig();
+  app.set('trust proxy', resolveTrustProxy(trustProxy));
+}
+
+export async function updateTrustProxy(value: string) {
+  if (getEnvironmentSetting()) {
+    throw new Error('环境变量 QL_TRUST_PROXY 已生效，系统设置不可覆盖');
+  }
+
+  const trustProxy = validateTrustProxy(value);
+  const doc = await SystemModel.findOne({
+    where: { type: AuthDataType.systemConfig },
+  });
+  if (!doc) {
+    throw new Error('系统配置不存在');
+  }
+
+  const plain = doc.get({ plain: true });
+  await SystemModel.update(
+    { info: { ...(plain.info || {}), trustProxy } as any },
+    { where: { id: plain.id } },
+  );
+  activeApp?.set('trust proxy', resolveTrustProxy(trustProxy));
+
+  return getTrustProxyConfig();
+}
+
+function parseForwardedFor(value: string | string[] | undefined): string[] {
+  const values = Array.isArray(value) ? value : value ? [value] : [];
+  return values
+    .flatMap((item) => item.split(','))
+    .map((item) => normalizeClientIp(item))
+    .filter(Boolean);
+}
+
+export async function diagnoseClientIp(req: Request) {
+  const remoteAddress = normalizeClientIp(req.socket.remoteAddress);
+  const forwardedFor = parseForwardedFor(req.headers['x-forwarded-for']);
+  const hopsFromApp = [remoteAddress, ...forwardedFor.slice().reverse()].filter(
+    Boolean,
+  );
+  const trust = req.app.get('trust proxy fn') as
+    | ((ip: string, hop: number) => boolean)
+    | undefined;
+
+  let selectedIndex = Math.max(hopsFromApp.length - 1, 0);
+  for (let index = 0; index < hopsFromApp.length - 1; index += 1) {
+    if (!trust?.(hopsFromApp[index], index)) {
+      selectedIndex = index;
+      break;
+    }
+  }
+
+  const hops = hopsFromApp.map((ip, index) => ({
+    ip,
+    hop: index,
+    status:
+      index < selectedIndex
+        ? 'trusted'
+        : index === selectedIndex
+        ? 'client'
+        : 'not_checked',
+  }));
+
+  return {
+    ...(await getTrustProxyConfig()),
+    remoteAddress,
+    forwardedFor,
+    expressIps: req.ips.map(normalizeClientIp),
+    clientIp: normalizeClientIp(req.ip || req.socket.remoteAddress),
+    hops,
+  };
+}