Skip to content

Add the Private Endpoint Validation Logic Meet the Tenant Metadata #25460

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tianzhu007 merged 22 commits into from
Sep 16, 2025
Merged

Add the Private Endpoint Validation Logic Meet the Tenant Metadata #25460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
b557c94
Add change for client ip
tianzhu007 Sep 12, 2025
2c0e5a1
Add the change for testing pl
tianzhu007 Sep 12, 2025
53dadad
data plane validation
tianzhu007 Sep 12, 2025
f178af7
Add the change for boolean
tianzhu007 Sep 13, 2025
b590f0e
print the custom data
tianzhu007 Sep 13, 2025
429cf51
Print req
tianzhu007 Sep 13, 2025
73e87c8
made the fix for format
tianzhu007 Sep 13, 2025
eac78ba
Add enablePrivateLinkNetworkCheck
tianzhu007 Sep 13, 2025
d08be16
fix the undefined for string
tianzhu007 Sep 14, 2025
ee83810
Remove secret leak line
tianzhu007 Sep 15, 2025
3a3b414
Remove extra logs
tianzhu007 Sep 15, 2025
9c4ed14
Change the error message
tianzhu007 Sep 16, 2025
664172e
Remove custom data
tianzhu007 Sep 16, 2025
d8cd396
remove client ip
tianzhu007 Sep 16, 2025
fbe8f6d
Add as sendStatus
tianzhu007 Sep 16, 2025
8dc8fd8
Remove account id
tianzhu007 Sep 16, 2025
b41b38e
format the codebase
tianzhu007 Sep 16, 2025
2ab4891
Remove link id
tianzhu007 Sep 16, 2025
3a3a83b
Merge branch 'main' into test/tianzhu/add-ip-address-client-2
tianzhu007 Sep 16, 2025
27bf821
Merge branch 'main' into test/tianzhu/add-ip-address-client-2
tianzhu007 Sep 16, 2025
bb95850
Merge branch 'main' into test/tianzhu/add-ip-address-client-2
tianzhu007 Sep 16, 2025
399fc24
Merge branch 'main' into test/tianzhu/add-ip-address-client-2
tianzhu007 Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions server/routerlicious/packages/lambdas/src/nexus/networkHelper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,23 +19,37 @@ export async function checkNetworkInformation(
): Promise<{ message: string; shouldConnect: boolean }> {
const tenantId = socket?.handshake?.query?.tenantId as string | undefined;
const tenantInfo = await tenantManager.getTenantfromRiddler(tenantId);
const privateLinkEnable = tenantInfo?.customData?.privateEndpoints?.accountLinkId
? true
: false;
const privateLinkEnable =
tenantInfo?.customData?.privateEndpoints &&
Array.isArray(tenantInfo.customData.privateEndpoints) &&
tenantInfo.customData.privateEndpoints?.length > 0 &&
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy?.properties
?.remotePrivateEndpoint?.connectionDetails &&
Array.isArray(
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy?.properties
?.remotePrivateEndpoint?.connectionDetails,
) &&
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy?.properties
?.remotePrivateEndpoint?.connectionDetails[0]
? true
: false;
const xForwardedFor: string | undefined = socket.handshake.headers["x-forwarded-for"] as
| string
| undefined;
const clientIPAddress = xForwardedFor?.split(",")[0];
if (privateLinkEnable && !clientIPAddress) {
return {
message: "Client IP address is required for private link in x-forwarded-for",
message: "Client ip address is required for private link in x-forwarded-for",
shouldConnect: false,
};
}
const networkInfo = getNetworkInformationFromIP(clientIPAddress);
if (networkInfo.isPrivateLink) {
if (privateLinkEnable) {
const accountLinkId = tenantInfo?.customData?.privateEndpoints?.accountLinkId;
const connectionDetail =
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy
?.properties?.remotePrivateEndpoint?.connectionDetails[0];
const accountLinkId = connectionDetail?.linkIdentifier;
return networkInfo.privateLinkId === accountLinkId
? { message: "This is a private link socket connection", shouldConnect: true }
: {
Expand Down
2 changes: 1 addition & 1 deletion server/routerlicious/packages/routerlicious-base/src/alfred/routes/api/restHelper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@ export function getDocumentUrlsfromNetworkInfo(
externalHistorianUrl: string,
externalDeltaStreamUrl: string,
enablePrivateLinkNetworkCheck: boolean = false,
isPrivateLink?: boolean | false,
isPrivateLink: boolean = false,
privateServiceHost?: string | undefined,
): {
documentOrdererUrl: string;
Expand Down
29 changes: 21 additions & 8 deletions server/routerlicious/packages/services-shared/src/http.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,16 +56,27 @@ export function validatePrivateLink(
next();
}
const tenantInfo: ITenantConfig = await tenantManager.getTenantfromRiddler(tenantId);
const privateLinkEnable = tenantInfo?.customData?.privateEndpoints?.accountLinkId
? true
: false;
const privateLinkEnable =
tenantInfo?.customData?.privateEndpoints &&
Array.isArray(tenantInfo.customData.privateEndpoints) &&
tenantInfo.customData.privateEndpoints?.length > 0 &&
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy
?.properties?.remotePrivateEndpoint?.connectionDetails &&
Array.isArray(
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy
?.properties?.remotePrivateEndpoint?.connectionDetails,
) &&
tenantInfo.customData.privateEndpoints[0]?.privateEndpointConnectionProxy
?.properties?.remotePrivateEndpoint?.connectionDetails[0]
? true
: false;
const clientIPAddress = req.ip ?? "";
if (privateLinkEnable && (!clientIPAddress || clientIPAddress.trim() === "")) {
return handleResponse(
Promise.reject(
new NetworkError(
400,
`Client IP address is required for private link in req.ip`,
`Client ip address is required for private link in req.ip`,
),
),
res,
Expand All @@ -74,18 +85,20 @@ export function validatePrivateLink(
const networkInfo = getNetworkInformationFromIP(clientIPAddress);
if (networkInfo.isPrivateLink) {
if (privateLinkEnable) {
const accountLinkId = tenantInfo?.customData?.privateEndpoints?.accountLinkId;
const connectionDetail =
tenantInfo?.customData?.privateEndpoints[0]?.privateEndpointConnectionProxy
?.properties?.remotePrivateEndpoint?.connectionDetails[0];
const accountLinkId = connectionDetail?.linkIdentifier;
if (networkInfo.privateLinkId === accountLinkId) {
Lumberjack.info("This is a private link request", {
Lumberjack.info(`This is a private link request with matching link id.`, {
tenantId,
privateLinkId: networkInfo.privateLinkId,
});
} else {
return handleResponse(
Promise.reject(
new NetworkError(
400,
`This private link should not be connected since the link id ${networkInfo.privateLinkId} does not match ${accountLinkId}`,
`This private link should not be connected since the link id mismatch`,
),
),
res,
Expand Down