Add IP Whitelisting Support

[izadoesdev]

Overview

Add IP whitelisting to restrict API key usage to specific IP addresses or CIDR ranges.

Motivation

IP whitelisting adds an additional security layer by restricting where keys can be used from.

Proposed API

await keys.create({
  ownerId: 'user_123',
  allowedIPs: ['192.168.1.1', '10.0.0.0/24'],
})

await keys.verify(key, { ipAddress: req.ip })

Implementation Details

Storage Requirements

• Add allowedIPs array to key metadata
• Support both single IPs and CIDR ranges
• Store in key metadata

Verification Logic

// Check IP whitelist during verification
const result = await manager.verify(key, {
  ipAddress: req.ip,
  checkIPWhitelist: true
})

if (!result.ipAllowed) {
  throw new Error('IP address not whitelisted')
}

Acceptance Criteria

• Implement IP matching logic
• Support CIDR notation
• Support multiple IPs per key
• Add IP check to verification flow
• Add tests for IP matching
• Document IP whitelisting
• Log IP violations

Priority

Medium - Additional security layer