Merge pull request #17 from techsavvyash/feat/geoip

feat: add geoip based request blocking

package.json

@@ -31,6 +31,7 @@
     "@fastify/helmet": "8.0.0",
     "@fastify/multipart": "6.0.0",
     "@fastify/static": "5.0.0",
+    "@nestjs/axios": "^3.0.1",
     "@nestjs/cache-manager": "^2.1.0",
     "@nestjs/common": "8.0.0",
     "@nestjs/config": "1.1.6",

src/interceptors/geoip.interceptor.spec.ts

@@ -0,0 +1,66 @@
+import { GeoIPInterceptor } from './geoip.interceptor';
+import { ExecutionContext, HttpException } from '@nestjs/common';
+import { Observable, of } from 'rxjs';
+
+describe('GeoIpInterceptor', () => {
+  let interceptor: GeoIPInterceptor;
+
+  beforeEach(() => {
+    interceptor = new GeoIPInterceptor();
+  });
+
+  it('should allow a request from India', async () => {
+    const executionContext = createMockExecutionContext('115.240.90.163'); // Mock IP from India
+    const callHandler = {
+      handle: jest.fn().mockReturnValue(of({})),
+    };
+
+    await expect(interceptor.intercept(executionContext, callHandler)).resolves.toBeInstanceOf(Observable);
+  });
+
+  it('should allow a request from India with IPv6', async () => {
+    const executionContext = createMockExecutionContext('2401:4900:1c70:140b:fd0c:65a1:64e2:81bb'); // Mock IP from India
+    const callHandler = {
+      handle: jest.fn().mockReturnValue(of({})),
+    };
+
+    await expect(interceptor.intercept(executionContext, callHandler)).resolves.toBeInstanceOf(Observable);
+  });
+
+  it('should block a request from outside India', async () => {
+    const executionContext = createMockExecutionContext('128.101.101.101'); // Mock IP from outside India
+    const callHandler = {
+      handle: jest.fn().mockReturnValue(of({})),
+    };
+
+    await expect(interceptor.intercept(executionContext, callHandler)).rejects.toThrow(HttpException);
+  });
+
+  it('should block a request from machine local IP', async () => {
+    const executionContext = createMockExecutionContext('127.0.0.1'); // Mock IP from outside India
+    const callHandler = {
+      handle: jest.fn().mockReturnValue(of({})),
+    };
+
+    await expect(interceptor.intercept(executionContext, callHandler)).rejects.toThrow(HttpException);
+  });
+
+  it('should block a request from a fake spoofed IP', async () => {
+    const executionContext = createMockExecutionContext('1607:e054:4d04:8f9c:6efa:761f:b964:57b6'); // Mock IP from outside India
+    const callHandler = {
+      handle: jest.fn().mockReturnValue(of({})),
+    };
+
+    await expect(interceptor.intercept(executionContext, callHandler)).rejects.toThrow(HttpException);
+  });
+  // Helper function to create a mock ExecutionContext
+  function createMockExecutionContext(ip: string): ExecutionContext {
+    return {
+      switchToHttp: () => ({
+        getRequest: () => ({
+          headers: { 'x-forwarded-for': ip },
+        }),
+      }),
+    } as ExecutionContext;
+  }
+});

src/interceptors/geoip.interceptor.ts

@@ -0,0 +1,41 @@
+import { Injectable, NestInterceptor, ExecutionContext, CallHandler, Logger, HttpStatus, InternalServerErrorException, HttpException } from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { HttpService } from '@nestjs/axios';
+import { CustomLogger } from "../common/logger";
+
+@Injectable()
+export class GeoIPInterceptor implements NestInterceptor {
+  private logger: CustomLogger;
+  private readonly httpService: HttpService;
+
+  constructor() {
+    this.logger = new CustomLogger('GeoIPInterceptor');
+    this.httpService = new HttpService();
+  }
+
+  async intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>> {
+    const request = context.switchToHttp().getRequest();
+    const clientIp = request.headers['x-forwarded-for'] || request.ip; // Get client IP address
+
+    // Call the geolocation service to get the country from the IP
+    const { country, regionName } = await this.getLocation(clientIp);
+
+    if (country !== 'India') {
+      this.logger.verbose('Denying request from ip: ' + clientIp + ' country: ' + country)
+      throw new HttpException('Access Denied', HttpStatus.FORBIDDEN);
+    }
+
+    this.logger.verbose('Allowed request from ip: ' + clientIp + ' region: ' + regionName)
+    return next.handle();
+  }
+
+  private async getLocation(ip: any): Promise<any> {
+    try {
+      const resp = await this.httpService.axiosRef.get(`https://geoip.samagra.io/city/${ip}`)
+      return { country: resp.data.country, regionName: resp.data.regionName };
+    } catch (err) {
+      this.logger.error('Error occured while reading the geoip database', err);
+      throw new InternalServerErrorException('Error occured while reading the geoip database');
+    }
+  }
+}

src/main.ts

@@ -12,6 +12,7 @@ import compression from "@fastify/compress";
 import { join } from "path";
 import { CustomLogger } from "./common/logger";
 import { MonitoringService } from "./modules/monitoring/monitoring.service";
+import { GeoIPInterceptor } from "./interceptors/geoip.interceptor";
 
 async function bootstrap() {
   const logger = new CustomLogger("Main");
@@ -21,7 +22,7 @@ async function bootstrap() {
     AppModule,
     new FastifyAdapter({ bodyLimit: 10048576 })
   );
-  
+
   /** Register Prismaservice LifeCycle hooks */
   const prismaService: PrismaService = app.get(PrismaService);
   prismaService.enableShutdownHooks(app);
@@ -39,7 +40,9 @@ async function bootstrap() {
     },
   });
 
-  process.on('exit', (code)=>{
+  app.useGlobalInterceptors(new GeoIPInterceptor())
+
+  process.on('exit', (code) => {
     console.log(`Process is exiting with code: ${code}`);
   })
 
@@ -55,7 +58,7 @@ async function bootstrap() {
     await monitoringService.onExit();
     process.exit(0);
   });
-  
+
   process.on('SIGTERM', async () => {
     console.log('Received SIGTERM signal. Gracefully shutting down...');
     const monitoringService = app.get<MonitoringService>(MonitoringService);