Add ip allow list check

api/src/app.ts

@@ -38,6 +38,7 @@ import graphqlRouter from './controllers/graphql';
 
 import notFoundHandler from './controllers/not-found';
 import sanitizeQuery from './middleware/sanitize-query';
+import { checkIP } from './middleware/check-ip';
 import { WebhooksService } from './services/webhooks';
 import { InvalidPayloadException } from './exceptions';
 
@@ -98,6 +99,9 @@ app.use(sanitizeQuery);
 app.use('/auth', authRouter);
 
 app.use(authenticate);
+
+app.use(checkIP);
+
 app.use(cache);
 
 app.use('/graphql', graphqlRouter);

api/src/middleware/check-ip.ts

@@ -0,0 +1,17 @@
+import { RequestHandler } from 'express';
+import asyncHandler from 'express-async-handler';
+import database from '../database';
+import { InvalidIPException } from '../exceptions';
+
+export const checkIP: RequestHandler = asyncHandler(async (req, res, next) => {
+	const role = await database
+		.select('ip_access')
+		.from('directus_roles')
+		.where({ id: req.accountability!.role })
+		.first();
+	const ipAllowlist = (role.ip_access || '').split(',').filter((ip: string) => ip);
+
+	if (ipAllowlist.length > 0 && ipAllowlist.includes(req.accountability!.ip) === false)
+		throw new InvalidIPException();
+	return next();
+});