Feat/ip allowlist guard#1072
Open
greatKhalifa-code wants to merge 2 commits into
Open
Conversation
Wraps all IPaymentProvider HTTP calls with an opossum CircuitBreaker to prevent a slow/unavailable gateway from exhausting the connection pool. - Add PaymentProviderCircuitBreakerService (timeout 10s, 50% error threshold, 30s half-open probe interval, volumeThreshold 5) - Proxy all IPaymentProvider methods through the breaker; throw 503 ServiceUnavailableException when the circuit is OPEN - Register service in PaymentsModule (providers + exports) - Extend HealthIndicatorsService with checkPaymentProvider() and include paymentProvider in the readiness() map - Add PaymentProviderHealthController exposing GET /health/payment-provider (503/207/200 by circuit state) and GET /health/payment-provider/status - Update HealthModule to register new controller and providers - Add 21 unit tests covering CLOSED, OPEN, and HALF_OPEN states Closes #payment-circuit-breaker
Adds IpAllowlistGuard as a defense-in-depth layer preventing abuse
of admin endpoints from unknown networks, even with a valid stolen JWT.
- Create IpAllowlistGuard reading ADMIN_IP_ALLOWLIST from ConfigService
- Supports comma-separated IPv4 addresses and CIDR notation (e.g. 10.0.0.0/8)
- Resolves client IP from X-Forwarded-For first hop, falls back to
request.ip / socket.remoteAddress
- Strips ::ffff: IPv6-mapped IPv4 prefix automatically
- When ADMIN_IP_ALLOWLIST is unset, guard is disabled with a startup WARNING
- Unlisted IPs receive HTTP 403 Forbidden
- Apply guard to TenancyController, RolesController, ShardingController
- Guard runs before JwtAuthGuard and RolesGuard (fail-fast on IP)
- All endpoints on the three controllers now require ADMIN role + allowlisted IP
- Update TenancyModule, RbacModule, ShardingModule to provide ConfigModule
and IpAllowlistGuard
- Add 34 unit tests covering: exact IP allow/deny, CIDR /8 /12 /24 /32,
mixed lists, X-Forwarded-For parsing, IPv6-mapped stripping, fallback
IP resolution, disabled guard, malformed entry handling
Closes #ip-allowlist-guard
|
@greatKhalifa-code Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Contributor
|
Well done on the job done so far! |
Author
|
Okay I will
Is there a chance I could get more issuesnto solve?
…On Sat, 25 Jul 2026, 12:58 pm Rukayat Zakariyau, ***@***.***> wrote:
*RUKAYAT-CODER* left a comment (rinafcode/teachLink_backend#1072)
<#1072 (comment)>
Well done on the job done so far!
Kindly resolve conflict and fix workflow.
—
Reply to this email directly, view it on GitHub
<#1072?email_source=notifications&email_token=CCBH3XU7XRWKESRYOTDR3KT5GSOHDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBXHAZTSOBUGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5078398442>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/CCBH3XTDDGQH3KFLNMJ3K2L5GSOHDAVCNFSNUABFKJSXA33TNF2G64TZHM4TKOJXG4ZTCMBSHNEXG43VMU5TIOJXGQ4DCNZYHE32C5QC>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/CCBH3XRCK6MDAWXTYGLNFRL5GSOHDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBXHAZTSOBUGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y>
and Android
<https://github.com/notifications/mobile/android/CCBH3XSSIPPWSDXQLTNZRKD5GSOHDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBXHAZTSOBUGQZKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>.
Download it today!
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(security): IP allowlist guard for admin endpoints
Problem
Admin endpoints (/tenants, /roles, /sharding) are protected only by RBAC role checks. A stolen admin JWT from any IP is sufficient for full administrative access — there is no
network-level defense.
Solution
Adds IpAllowlistGuard as a defense-in-depth layer. Even with a valid admin JWT, requests originating from an IP not in the configured allowlist are rejected before reaching business
logic.
Changes
New
allowlist on every request
Modified
Configuration
Comma-separated IPv4 addresses and/or CIDR blocks
ADMIN_IP_ALLOWLIST=10.0.0.0/8,192.168.1.0/24,203.0.113.42
┌──────────────────────────┬─────────────────────────────────────┐
│ Scenario │ Behaviour │
├──────────────────────────┼─────────────────────────────────────┤
│ IP in allowlist │ Request proceeds normally │
├──────────────────────────┼─────────────────────────────────────┤
│ IP not in allowlist │ 403 Forbidden │
├──────────────────────────┼─────────────────────────────────────┤
│ ADMIN_IP_ALLOWLIST unset │ Guard disabled, startup WARN logged │
└──────────────────────────┴─────────────────────────────────────┘
How IP is resolved
Tests
34 passing — exact IP allow/deny, CIDR /8 /12 /24 /32, mixed lists,
X-Forwarded-For parsing, ::ffff: stripping, fallback IP resolution,
disabled guard, malformed entry handling
Acceptance criteria
closes #834