Function socketIpAccessControl

js/ip_access_control.js:90–107

* Creates a Socket.IO `allowRequest` handler that enforces the same IP whitelist as the HTTP middleware. * This closes the gap where Socket.IO handshakes bypassed the Express-only `ipAccessControl` middleware. * @param {string[]} whitelist - Array of allowed IP addresses or CIDR ranges * @returns

(whitelist)

 * @returns {(req: object, callback: (err: string | null, success: boolean) => void) => void} Socket.IO allowRequest handler
 */
function socketIpAccessControl (whitelist) {
	// Empty whitelist means allow all
	if (!Array.isArray(whitelist) || whitelist.length === 0) {
		return function (req, callback) {
			callback(null, true); // allow the connection
		};
	}

	return function (req, callback) {
		const clientIp = resolveClientIp(req);
		if (isAllowed(clientIp, whitelist)) {
			callback(null, true); // allow the connection
		} else {
			Log.warn(`IP ${clientIp} is not allowed to connect to the mirror socket`);
			callback("This device is not allowed to access your mirror.", false);
		}
	};
}

module.exports = { ipAccessControl, socketIpAccessControl };