fix(ip): combine route country verdict and unknown identity like the reference

packages/core/src/core/checks/helpers.ts

@@ -60,17 +60,20 @@ export async function checkRouteIpAccess(
 ): Promise<boolean | null> {
   try {
     /* Reference check_route_ip_access: a configured route whitelist alone
-       decides; the route blacklist is consulted only when it is absent. */
+       decides among the IP lists (the route blacklist is consulted only when
+       it is absent), then the route country verdict is combined: a blocked
+       verdict from either denies, an allowed verdict from either allows. */
+    let ipResult: boolean | null = null;
     if (routeConfig.ipWhitelist && routeConfig.ipWhitelist.length > 0) {
-      const whitelistResult = isIpInWhitelist(clientIp, routeConfig.ipWhitelist);
-      if (whitelistResult !== null) return whitelistResult;
+      ipResult = isIpInWhitelist(clientIp, routeConfig.ipWhitelist);
     } else if (routeConfig.ipBlacklist && routeConfig.ipBlacklist.length > 0) {
-      if (isIpInBlacklist(clientIp, routeConfig.ipBlacklist)) return false;
+      if (isIpInBlacklist(clientIp, routeConfig.ipBlacklist)) ipResult = false;
     }
 
     const countryResult = checkCountryAccess(clientIp, routeConfig, middleware.geoIpHandler);
-    if (countryResult !== null) return countryResult;
 
+    if (ipResult === false || countryResult === false) return false;
+    if (ipResult === true || countryResult === true) return true;
     return null;
   /* v8 ignore start -- catch block requires ipaddr.parse to throw on a value that already passed validation */
   } catch {

packages/core/src/utils.ts

@@ -4,7 +4,7 @@ import ipaddr from 'ipaddr.js';
 import { multipartPartEntries, parseFormPairs, parseMediaTypeParams, parseMultipartParts } from './detection-engine/body-form-scan.js';
 import type { ResolvedSecurityConfig } from './models/config.js';
 import { defaultLogger } from './models/logger.js';
-import { requestClientIp } from './core/client-identity.js';
+import { requestClientIp, UNKNOWN_CLIENT_IDENTITY } from './core/client-identity.js';
 import { canonicalIpText, canonicalizeIp, ipInList } from './ip-identity.js';
 import type { Logger } from './models/logger.js';
 import type { AgentHandlerProtocol } from './protocols/agent.js';
@@ -445,7 +445,9 @@ export async function checkIpCountry(
   const country = geoIpHandler.getCountry(ip);
   if (!country) {
     logCountryCheckResult(ip, null, 'no_geolocation', config);
-    return false;
+    /* Reference _resolve_country_verdict: an ungeolocated client is blocked
+       only when a country whitelist is configured. */
+    return config.whitelistCountries.length > 0;
   }
 
   if (config.whitelistCountries.length > 0) {
@@ -471,18 +473,27 @@ export async function isIpAllowed(
   geoIpHandler?: GeoIPHandler | null,
 ): Promise<boolean> {
   try {
+    /* Reference _check_unknown_identity_access: an unknown client identity
+       only blocks when a whitelist or country whitelist is configured. */
+    if (ip === UNKNOWN_CLIENT_IDENTITY) {
+      return !((config.whitelist?.length ?? 0) > 0 || config.whitelistCountries.length > 0);
+    }
+
     if (canonicalIpText(ip) === null) return false;
 
     /* Reference _check_ip_lists_detail: a configured whitelist alone decides;
-       the blacklist applies only when no whitelist is configured. */
+       the blacklist applies only when no whitelist is configured, and a
+       whitelist match skips the country verdict. */
+    let whitelisted = false;
     if (config.whitelist && config.whitelist.length > 0) {
       if (!ipInList(ip, config.whitelist)) return false;
+      whitelisted = true;
     } else if (ipInList(ip, config.blacklist)) {
       return false;
     }
 
     /* v8 ignore start -- geoIpHandler branch unreachable in recursive JSON check because dangerousPatterns check returns first */
-    if (geoIpHandler) {
+    if (geoIpHandler && !whitelisted) {
       const blocked = await checkIpCountry(ip, config, geoIpHandler);
       if (blocked) return false;
     }

packages/core/tests/test-core/websocket-guard.test.ts

@@ -51,9 +51,15 @@ describe('guardWebSocketUpgrade', () => {
     });
   });
 
-  it('falls through to the allow check for an unknown identity when failSecure is off', async () => {
+  it('lets an unknown identity through the allow check when failSecure is off and no whitelist is set', async () => {
     const components = await buildComponents({ failSecure: false });
     const verdict = await guardWebSocketUpgrade(wsRequest({ clientHost: null }), components);
+    expect(verdict).toMatchObject({ allowed: true });
+  });
+
+  it('rejects an unknown identity at the allow check when a whitelist is configured and failSecure is off', async () => {
+    const components = await buildComponents({ failSecure: false, whitelist: ['8.8.4.4'] });
+    const verdict = await guardWebSocketUpgrade(wsRequest({ clientHost: null }), components);
     expect(verdict).toMatchObject({ allowed: false, close: WS_CLOSE_IP_NOT_ALLOWED });
   });