feat(api): add IP ban exemptions (#1448)

fluxer_api/src/api/middleware/AbusiveIpAutoBanner.ts

@@ -10,6 +10,7 @@ import {AdminRepository} from '../admin/AdminRepository';
 import {Config} from '../Config';
 import {IP_BAN_REFRESH_CHANNEL} from '../constants/IpBan';
 import {Logger} from '../Logger';
+import {isIpBanExempt} from '../risk/IpBanExemptions';
 import type {HonoEnv} from '../types/HonoEnv';
 import {parseJsonRecord} from '../utils/JsonBoundaryUtils';
 import {ipBanCache} from './IpBanMiddleware';
@@ -118,6 +119,7 @@ function normalizeSignalIp(ip: string | null): AbuseSignalIp | null {
 	const parsed = parseIpAddress(ip);
 	if (!parsed) return null;
 	if (!isPublicIpAddress(parsed.normalized)) return null;
+	if (isIpBanExempt(parsed.normalized)) return null;
 	const banKey = getSameIpDecisionKey(parsed.normalized) ?? parsed.normalized;
 	return {banKey, lookupIp: parsed.normalized};
 }
@@ -324,6 +326,9 @@ async function executeAutoBan(
 	if (!isPublicIpAddress(ctx.lookupIp)) {
 		return;
 	}
+	if (isIpBanExempt(ctx.lookupIp)) {
+		return;
+	}
 	try {
 		await adminRepository.banIpTemp(key, AUTO_BAN_TTL_SECONDS);
 		ipBanCache.banTemp(key, AUTO_BAN_TTL_SECONDS);

fluxer_api/src/api/middleware/IpBanMiddleware.ts

@@ -10,6 +10,7 @@ import type {BannedIpEntry, BannedIpKind} from '../admin/IAdminRepository';
 import {Config} from '../Config';
 import {IP_BAN_REFRESH_CHANNEL} from '../constants/IpBan';
 import {Logger} from '../Logger';
+import {isIpBanExempt} from '../risk/IpBanExemptions';
 import type {HonoEnv} from '../types/HonoEnv';
 import {parseIpBanEntry, tryParseSingleIp} from '../utils/IpRangeUtils';
 
@@ -157,6 +158,7 @@ class IpBanCache {
 	}
 
 	getMatch(ip: string): IpBanMatch | null {
+		if (isIpBanExempt(ip)) return null;
 		const parsed = tryParseSingleIp(ip);
 		if (!parsed) return null;
 		const sameIpDecisionKey = getSameIpDecisionKey(parsed.canonical);
@@ -193,10 +195,12 @@ class IpBanCache {
 	}
 
 	ban(ip: string): void {
+		if (isIpBanExempt(ip)) return;
 		this.addEntry(ip, PERMANENT_BAN_METADATA);
 	}
 
 	banTemp(ip: string, ttlSeconds: number): void {
+		if (isIpBanExempt(ip)) return;
 		const expiresAt = Number.isFinite(ttlSeconds) && ttlSeconds > 0 ? new Date(Date.now() + ttlSeconds * 1000) : null;
 		this.addEntry(ip, {kind: 'temporary_24h', expiresAt});
 	}