From 221a43e8a403eec5f663baa5338a09d2d89eeefe Mon Sep 17 00:00:00 2001
From: Tuan Dang <tony@infisical.com>
Date: Thu, 27 Jul 2023 11:18:36 +0700
Subject: [PATCH 1/2] Update IP allowlist implementation

---
 backend/src/utils/setup/backfillData.ts | 50 ++++++++++++++++++++++---
 backend/src/validation/workspace.ts     |  4 +-
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/backend/src/utils/setup/backfillData.ts b/backend/src/utils/setup/backfillData.ts
index 56ee59a8a..cc3399d29 100644
--- a/backend/src/utils/setup/backfillData.ts
+++ b/backend/src/utils/setup/backfillData.ts
@@ -567,10 +567,29 @@ export const backfillTrustedIps = async () => {
       $nin: workspaceIdsWithTrustedIps
     }
   });
-
+  
   if (workspaceIdsToAddTrustedIp.length > 0) {
-    const operations = workspaceIdsToAddTrustedIp.map((workspaceId) => {
-      return {
+    const operations: {
+      updateOne: {
+        filter: {
+          workspace: Types.ObjectId;
+          ipAddress: string;
+        },
+        update: {
+          workspace: Types.ObjectId;
+          ipAddress: string;
+          type: string;
+          prefix: number;
+          isActive: boolean;
+          comment: string;
+        },
+        upsert: boolean;
+      }
+    }[] = [];
+    
+    workspaceIdsToAddTrustedIp.forEach((workspaceId) => {
+      // default IPv4 trusted CIDR
+      operations.push({
         updateOne: {
           filter: {
             workspace: workspaceId,
@@ -584,9 +603,28 @@ export const backfillTrustedIps = async () => {
             isActive: true,
             comment: ""
           },
-          upsert: true,
-        },
-      };
+          upsert: true
+        }
+      });
+      
+      // default IPv6 trusted CIDR
+      operations.push({
+        updateOne: {
+          filter: {
+            workspace: workspaceId,
+            ipAddress: "::"
+          },
+          update: {
+            workspace: workspaceId,
+            ipAddress: "::",
+            type: IPType.IPV6.toString(),
+            prefix: 0,
+            isActive: true,
+            comment: ""
+          },
+          upsert: true
+        }
+      });
     });
 
     await TrustedIP.bulkWrite(operations);
diff --git a/backend/src/validation/workspace.ts b/backend/src/validation/workspace.ts
index 505b6a425..618ccb02f 100644
--- a/backend/src/validation/workspace.ts
+++ b/backend/src/validation/workspace.ts
@@ -26,6 +26,7 @@ import {
 } from "../variables";
 import { BotService } from "../services";
 import { AuthData } from "../interfaces/middleware";
+import { extractIPDetails } from "../utils/ip";
 
 /**
  * Validate authenticated clients for workspace with id [workspaceId] based
@@ -135,7 +136,8 @@ export const validateClientForWorkspace = async ({
 					}
 				}
 				
-				const check = blockList.check(authData.authIP);
+				const { type } = extractIPDetails(authData.authIP);
+				const check = blockList.check(authData.authIP, type);
 				
 				if (!check) throw UnauthorizedRequestError({
 					message: "Failed workspace authorization"

From 8ed5dbb26a5c1df434fcd79de8a8d2f4e45b7d3a Mon Sep 17 00:00:00 2001
From: Tuan Dang <tony@infisical.com>
Date: Thu, 27 Jul 2023 11:23:57 +0700
Subject: [PATCH 2/2] Add default IPV6 CIDR for creating workspace

---
 backend/src/helpers/workspace.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/backend/src/helpers/workspace.ts b/backend/src/helpers/workspace.ts
index 0f4e5dc6b..ef38e4fc1 100644
--- a/backend/src/helpers/workspace.ts
+++ b/backend/src/helpers/workspace.ts
@@ -45,7 +45,7 @@ export const createWorkspace = async ({
 		workspaceId: workspace._id,
 	});
 	
-	// initialize default trusted ip of 0.0.0.0/0
+	// initialize default trusted IPv4 CIDR - 0.0.0.0/0
 	await new TrustedIP({
 		workspace: workspace._id,
 		ipAddress: "0.0.0.0",
@@ -54,6 +54,16 @@ export const createWorkspace = async ({
 		isActive: true,
 		comment: ""
 	}).save()
+	
+	// initialize default trusted IPv6 CIDR - ::/0
+	await new TrustedIP({
+		workspace: workspace._id,
+		ipAddress: "::",
+		type: IPType.IPV6,
+		prefix: 0,
+		isActive: true,
+		comment: ""
+	});
 
 	await EELicenseService.refreshPlan(organizationId);