Bump ip-address from 10.2.0 to 10.4.0

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

package-lock.json

@@ -13111,9 +13111,9 @@
             }
         },
         "node_modules/ip-address": {
-            "version": "10.2.0",
+            "version": "10.4.0",
-            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-            "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+            "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
             "license": "MIT",
             "engines": {
                 "node": ">= 12"

server/lib/readConfigFile.ts

@@ -266,13 +266,13 @@ export const configSchema = z
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(30),
+                            .default(10),
                         burst: z
                             .number()
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(50)
+                            .default(16)
                     })
                     .optional()
                     .prefault({})

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
+import { certificates, db, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,28 +63,14 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .leftJoin(
+        .innerJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .leftJoin(
+        .where(and(inArray(certificates.domain, domainList)));
-            domainNamespaces,
-            eq(domains.domainId, domainNamespaces.domainId)
-        )
-        .where(
-            and(
-                inArray(certificates.domain, domainList),
-                // Namespace domains are shared across all orgs, so they skip
-                // the org-ownership check (mirrors verifyCertificateAccess).
-                or(
-                    isNotNull(orgDomains.orgId),
-                    isNotNull(domainNamespaces.domainNamespaceId)
-                )
-            )
-        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -124,27 +110,19 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .leftJoin(
+            .innerJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
-            .leftJoin(
-                domainNamespaces,
-                eq(domains.domainId, domainNamespaces.domainId)
-            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
-                    ),
-                    or(
-                        isNotNull(orgDomains.orgId),
-                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

server/routers/badger/verifySession.ts

@@ -127,9 +127,6 @@ export async function verifyResourceSession(
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
-        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
-        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
-
         const clientIp = requestIp
             ? stripPortFromHost(requestIp, badgerVersion)
             : undefined;
@@ -316,14 +313,9 @@ export async function verifyResourceSession(
             return allowed(res, undefined, dontStripSession);
         }
 
-        // Only offer a browser redirect to clients that can actually follow one and log in
+        const redirectPath = `/auth/resource/${encodeURIComponent(
-        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
+            resource.resourceGuid
-        // an unauthorized response from Badger instead of a login redirect URL.
+        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
-        const redirectPath = clientIsBrowser
-            ? `/auth/resource/${encodeURIComponent(
-                  resource.resourceGuid
-              )}?redirect=${encodeURIComponent(originalRequestURL)}`
-            : undefined;
 
         // check for access token in headers
         if (
@@ -1484,46 +1476,6 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
     return cachedCountryCode;
 }
 
-// Permissive by default: only reject known non-browser clients or a missing
-// User-Agent (real browsers always send one). This avoids blocking real
-// browsers whose UA string doesn't match a hardcoded allow-list.
-const NON_BROWSER_USER_AGENT_PATTERNS = [
-    /curl/,
-    /wget/,
-    /python-requests/,
-    /python-urllib/,
-    /go-http-client/,
-    /okhttp/,
-    /axios/,
-    /node-fetch/,
-    /postmanruntime/,
-    /insomnia/,
-    /libwww-perl/,
-    /java\//,
-    /ruby/,
-    /php/,
-    /bot/,
-    /spider/,
-    /crawler/,
-    /headlesschrome/,
-    /phantomjs/,
-    /httpclient/,
-    /prometheus/,
-    /go-resty/,
-    /apache-httpclient/,
-    /scrapy/
-];
-
-function isBrowserUserAgent(userAgent: string | undefined): boolean {
-    if (!userAgent) {
-        return false;
-    }
-
-    const ua = userAgent.toLowerCase();
-
-    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
-}
-
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || (!isLoading && data === null)) {
+    } else if (isError || initialCertValue === null) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }