All files / src/app/api/admin/security/blocked-ips route.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
export const dynamic = "force-dynamic";

/**
 * Blocked IPs API Route
 *
 * Manages blocked IP addresses for the admin dashboard.
 * GET - Get list of blocked IPs
 * POST - Block a new IP
 * DELETE - Unblock an IP
 */

import { NextRequest, NextResponse } from "next/server";
import {
  withAdmin,
  withErrorHandling,
  successResponse,
  errorResponse,
  ApiSuccessResponse,
  ApiErrorResponse,
} from "@/lib/api";
import { blockIp, unblockIp, getBlockedIps } from "@/lib/security/security-logger";
import { z } from "zod";

interface BlockedIpsResponse {
  blockedIps: Array<{
    id: string;
    ipAddress: string;
    reason: string;
    expiresAt: Date;
    createdAt: Date;
  }>;
}

const blockIpSchema = z.object({
  ipAddress: z
    .string()
    .min(1)
    .max(45)
    .regex(/^[\d.:a-fA-F]+$/, "Invalid IP address format"),
  reason: z.string().min(1).max(500),
  durationHours: z.number().min(1).max(8760).default(24), // Max 1 year
});

const unblockIpSchema = z.object({
  ipAddress: z.string().min(1).max(45),
});

/**
 * GET /api/admin/security/blocked-ips
 * Get list of blocked IPs
 */
async function handleGet(): Promise<
  NextResponse<ApiSuccessResponse<BlockedIpsResponse> | ApiErrorResponse>
> {
  const blockedIps = await getBlockedIps();

  return successResponse({
    blockedIps,
  });
}

/**
 * POST /api/admin/security/blocked-ips
 * Block a new IP address
 */
async function handlePost(
  request: NextRequest
): Promise<NextResponse<ApiSuccessResponse<{ success: boolean }> | ApiErrorResponse>> {
  const body = await request.json();
  const validation = blockIpSchema.safeParse(body);

  if (!validation.success) {
    return errorResponse("VALIDATION_ERROR", validation.error.issues[0].message, { status: 400 });
  }

  const { ipAddress, reason, durationHours } = validation.data;
  const durationMs = durationHours * 60 * 60 * 1000;

  await blockIp(ipAddress, reason, durationMs);

  return successResponse({ success: true });
}

/**
 * DELETE /api/admin/security/blocked-ips
 * Unblock an IP address
 */
async function handleDelete(
  request: NextRequest
): Promise<NextResponse<ApiSuccessResponse<{ success: boolean }> | ApiErrorResponse>> {
  const body = await request.json();
  const validation = unblockIpSchema.safeParse(body);

  if (!validation.success) {
    return errorResponse("VALIDATION_ERROR", validation.error.issues[0].message, { status: 400 });
  }

  const { ipAddress } = validation.data;
  await unblockIp(ipAddress);

  return successResponse({ success: true });
}

export const GET = withErrorHandling(withAdmin(handleGet));
export const POST = withErrorHandling(withAdmin(handlePost));
export const DELETE = withErrorHandling(withAdmin(handleDelete));