feat: saved user IP and added a check to verify it

prisma/migrations/20240907181905_add_ip/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "ip" TEXT;

prisma/schema.prisma

@@ -160,6 +160,7 @@ model User {
   upiIds            UpiId[]         @relation("UserUpiIds")
   solanaAddresses   SolanaAddress[] @relation("UserSolanaAddresses")
   githubUser        GitHubLink?     @relation("UserGithub")
+  ip                String?
 }
 
 model GitHubLink {
@@ -343,4 +344,3 @@ enum MigrationStatus {
   MIGRATED
   MIGRATION_ERROR
 }
-

src/app/api/user/route.ts

@@ -4,14 +4,21 @@ import db from '@/db';
 export async function GET(req: NextRequest) {
   const url = new URL(req.url);
   const token = url.searchParams.get('token');
-  if (!token) {
+  const ip = url.searchParams.get('ip');
+
+  if (!token || !ip) {
     return NextResponse.redirect(new URL('/invalidsession', req.url));
   }
   const user = await db.user.findFirst({
     where: {
       token,
     },
   });
+
+  if (!user || user.ip !== ip) {
+    return NextResponse.redirect(new URL('/invalidsession', req.url));
+  }
+
   return NextResponse.json({
     user,
   });

src/lib/auth.ts

@@ -114,7 +114,11 @@ export const authOptions = {
         username: { label: 'email', type: 'text', placeholder: '' },
         password: { label: 'password', type: 'password', placeholder: '' },
       },
-      async authorize(credentials: any) {
+
+      async authorize(credentials: any, req: any) {
+        const userIp =
+          req.headers['x-forwarded-for'] || req.socket.remoteAddress;
+
         try {
           if (process.env.LOCAL_CMS_PROVIDER) {
             return {
@@ -152,6 +156,7 @@ export const authOptions = {
               },
               data: {
                 token: jwt,
+                ip: userIp,
               },
             });
 
@@ -160,6 +165,7 @@ export const authOptions = {
               name: userDb.name,
               email: credentials.username,
               token: jwt,
+              ip: userIp,
             };
           }
           console.log('not in db');
@@ -191,6 +197,7 @@ export const authOptions = {
                   email: credentials.username,
                   token: jwt,
                   password: hashedPassword,
+                  ip: userIp,
                 },
               });
             } catch (e) {
@@ -202,6 +209,7 @@ export const authOptions = {
               name: user.data.name,
               email: credentials.username,
               token: jwt,
+              ip: userIp,
             };
           }
 

src/middleware.ts

@@ -8,11 +8,16 @@ export const config = {
 export default withAuth(async (req) => {
   if (process.env.LOCAL_CMS_PROVIDER) return;
   const token = req.nextauth.token;
+  const userIp =
+    req.headers.get('x-forwarded-for') ||
+    req.ip ||
+    req.headers.get('x-real-ip');
+
   if (!token) {
     return NextResponse.redirect(new URL('/invalidsession', req.url));
   }
   const user = await fetch(
-    `${process.env.NEXT_PUBLIC_BASE_URL_LOCAL}/api/user?token=${token.jwtToken}`,
+    `${process.env.NEXT_PUBLIC_BASE_URL_LOCAL}/api/user?token=${token.jwtToken}?ip=${userIp}`,
   );
 
   const json = await user.json();