feat(api): don't strike users from /geoblock*, raise 403 (backport #3158)

[mergify]

Summary

• Remove state-machine logic from compliance controller that automatically transitioned users through COMPLIANT → FIRST_STRIKE_CLOSE_ONLY → CLOSE_ONLY → BLOCKED based on connection attempts and surveys.
• Replace with fail-fast behavior: any non-whitelisted request from a restricted country returns 403 Forbidden immediately, regardless of existing compliance status or action type.
• Existing compliance statuses in the database are now read-only; the controller no longer mutates them based on geo checks or survey actions.
• Requests from non-restricted countries with no existing status are still marked COMPLIANT; existing non-COMPLIANT statuses are returned as-is.

Details

API behavior changes

• Restricted country requests: All actions (CONNECT, VALID_SURVEY, INVALID_SURVEY) from restricted geolocations now return 403 with error code BlockedCode.GEOBLOCKED and payload INDEXER_GEOBLOCKED_PAYLOAD, before any database lookups or mutations.
• Non-restricted country requests:
  • New addresses → COMPLIANT status created in DB, 200 returned.
  • Existing addresses → current status returned unchanged, 200 returned (including BLOCKED, FIRST_STRIKE, FIRST_STRIKE_CLOSE_ONLY, CLOSE_ONLY).

Risk & Impact

Breaking change: High impact on compliance enforcement.

• Previous behavior: Users from restricted countries with wallets could connect and transition through strike states via surveys; manual human review influenced state transitions.
• New behavior: All restricted-country requests are rejected immediately at the API layer. Survey actions no longer affect compliance state.
• Data consistency: Existing FIRST_STRIKE, FIRST_STRIKE_CLOSE_ONLY, and CLOSE_ONLY records in the database are preserved but no longer updated by this controller.
• Rollout: Requires coordination with compliance policy; any users relying on survey-based remediation will lose access immediately.

Testing

• Comprehensive test coverage added/updated in compliance-v2-controller.test.ts:
  • New tests verify 403 response for all actions (CONNECT, VALID_SURVEY, INVALID_SURVEY) from restricted countries, regardless of pre-existing status (COMPLIANT, FIRST_STRIKE, FIRST_STRIKE_CLOSE_ONLY, CLOSE_ONLY, or none).
  • Tests confirm database is not mutated on geoblocked requests.
  • Parameterized test (it.each) verifies non-restricted requests return existing FIRST_STRIKE/FIRST_STRIKE_CLOSE_ONLY statuses unchanged.
  • Tests confirm BLOCKED status persists for non-restricted requests.
• Removed obsolete tests for state transitions (COMPLIANT → FIRST_STRIKE_CLOSE_ONLY, survey-based transitions).

Reviewer Notes

• Key change: upsertComplianceStatus() is now effectively a no-op for existing addresses; all mutation logic removed.
• Stats emission: compliance_status_changed metrics are no longer emitted for geoblocked requests (verified in tests).
• Manual QA: Verify geoblocking behavior in staging with VPN/geo-spoofing for restricted countries; confirm existing survey flows are disabled.

---

This is an automatic backport of pull request #3158 done by [Mergify](https://mergify.com).

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Dec 17 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}