Bump ip-address from 10.2.0 to 10.4.0

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

package-lock.json

@@ -13111,9 +13111,9 @@
             }
         },
         "node_modules/ip-address": {
-            "version": "10.2.0",
-            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-            "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+            "version": "10.4.0",
+            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+            "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
             "license": "MIT",
             "engines": {
                 "node": ">= 12"

server/lib/readConfigFile.ts

@@ -266,13 +266,13 @@ export const configSchema = z
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(30),
+                            .default(10),
                         burst: z
                             .number()
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(50)
+                            .default(16)
                     })
                     .optional()
                     .prefault({})

server/private/lib/logAccessAudit.ts

@@ -28,7 +28,7 @@ async function getAccessDays(orgId: string): Promise<number> {
 
     const [org] = await db
         .select({
-            settingsLogRetentionDaysAccess: orgs.settingsLogRetentionDaysAccess
+            settingsLogRetentionDaysAction: orgs.settingsLogRetentionDaysAction
         })
         .from(orgs)
         .where(eq(orgs.orgId, orgId))
@@ -41,11 +41,11 @@ async function getAccessDays(orgId: string): Promise<number> {
     // store the result in cache
     await cache.set(
         `org_${orgId}_accessDays`,
-        org.settingsLogRetentionDaysAccess,
+        org.settingsLogRetentionDaysAction,
         300
     );
 
-    return org.settingsLogRetentionDaysAccess;
+    return org.settingsLogRetentionDaysAction;
 }
 
 export async function cleanUpOldLogs(orgId: string, retentionDays: number) {

server/routers/badger/verifySession.ts

@@ -127,9 +127,6 @@ export async function verifyResourceSession(
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
-        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
-        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
-
         const clientIp = requestIp
             ? stripPortFromHost(requestIp, badgerVersion)
             : undefined;
@@ -316,14 +313,9 @@ export async function verifyResourceSession(
             return allowed(res, undefined, dontStripSession);
         }
 
-        // Only offer a browser redirect to clients that can actually follow one and log in
-        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
-        // an unauthorized response from Badger instead of a login redirect URL.
-        const redirectPath = clientIsBrowser
-            ? `/auth/resource/${encodeURIComponent(
-                  resource.resourceGuid
-              )}?redirect=${encodeURIComponent(originalRequestURL)}`
-            : undefined;
+        const redirectPath = `/auth/resource/${encodeURIComponent(
+            resource.resourceGuid
+        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
 
         // check for access token in headers
         if (
@@ -1484,46 +1476,6 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
     return cachedCountryCode;
 }
 
-// Permissive by default: only reject known non-browser clients or a missing
-// User-Agent (real browsers always send one). This avoids blocking real
-// browsers whose UA string doesn't match a hardcoded allow-list.
-const NON_BROWSER_USER_AGENT_PATTERNS = [
-    /curl/,
-    /wget/,
-    /python-requests/,
-    /python-urllib/,
-    /go-http-client/,
-    /okhttp/,
-    /axios/,
-    /node-fetch/,
-    /postmanruntime/,
-    /insomnia/,
-    /libwww-perl/,
-    /java\//,
-    /ruby/,
-    /php/,
-    /bot/,
-    /spider/,
-    /crawler/,
-    /headlesschrome/,
-    /phantomjs/,
-    /httpclient/,
-    /prometheus/,
-    /go-resty/,
-    /apache-httpclient/,
-    /scrapy/
-];
-
-function isBrowserUserAgent(userAgent: string | undefined): boolean {
-    if (!userAgent) {
-        return false;
-    }
-
-    const ua = userAgent.toLowerCase();
-
-    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
-}
-
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {