Use IPinfo Max anonymous signals

Author: jahooma

web/src/server/__tests__/free-mode-country.test.ts

@@ -106,6 +106,24 @@ describe('free mode country access', () => {
     expect(access.ipPrivacy?.signals).toEqual(['vpn'])
   })
 
+  test('blocks allowlisted countries when IPinfo reports a residential proxy', async () => {
+    const access = await getFreeModeCountryAccess(
+      makeReq({
+        'cf-ipcountry': 'US',
+        'x-forwarded-for': '203.0.113.10',
+      }),
+      {
+        ipinfoToken: 'test-token',
+        lookupIpPrivacy: async () => ({
+          signals: ['res_proxy'],
+        }),
+      },
+    )
+    expect(access.allowed).toBe(false)
+    expect(access.blockReason).toBe('anonymous_network')
+    expect(access.ipPrivacy?.signals).toEqual(['res_proxy'])
+  })
+
   test('allows allowlisted countries when privacy lookup finds no anonymous signals', async () => {
     const access = await getFreeModeCountryAccess(
       makeReq({
@@ -141,25 +159,49 @@ describe('free mode country access', () => {
     expect(access.ipPrivacy).toBe(null)
   })
 
-  test('parses IPinfo privacy signals', async () => {
+  test('parses IPinfo Max anonymous signals', async () => {
+    let requestedUrl = ''
+    const fetch = async (url: string | URL | Request) => {
+      requestedUrl = String(url)
+      return Response.json({
+        anonymous: {
+          is_proxy: false,
+          is_relay: true,
+          is_tor: true,
+          is_vpn: false,
+          is_res_proxy: true,
+        },
+        is_anonymous: true,
+        is_hosting: true,
+      })
+    }
+
+    const privacy = await lookupIpinfoPrivacy({
+      ip: IPINFO_PRIVACY_TEST_IP,
+      token: 'test-token',
+      fetch: fetch as unknown as typeof globalThis.fetch,
+    })
+
+    expect(requestedUrl).toContain('https://api.ipinfo.io/lookup/')
+    expect(privacy).toEqual({
+      signals: ['tor', 'relay', 'res_proxy', 'hosting'],
+    })
+  })
+
+  test('blocks generic IPinfo anonymous results without a specific signal', async () => {
     const fetch = async () =>
       Response.json({
-        vpn: true,
-        proxy: false,
-        tor: true,
-        relay: false,
-        hosting: true,
-        service: 'Example VPN',
+        is_anonymous: true,
       })
 
     const privacy = await lookupIpinfoPrivacy({
-      ip: IPINFO_PRIVACY_TEST_IP,
+      ip: '198.51.100.43',
       token: 'test-token',
       fetch: fetch as unknown as typeof globalThis.fetch,
     })
 
     expect(privacy).toEqual({
-      signals: ['vpn', 'tor', 'hosting', 'service'],
+      signals: ['anonymous'],
     })
   })
 })

web/src/server/free-mode-country.ts

@@ -31,10 +31,12 @@ export type FreeModeCountryBlockReason =
   | 'unresolved_client_ip'
 
 export type FreeModeIpPrivacySignal =
+  | 'anonymous'
   | 'vpn'
   | 'proxy'
   | 'tor'
   | 'relay'
+  | 'res_proxy'
   | 'hosting'
   | 'service'
 
@@ -114,18 +116,28 @@ function setIpinfoPrivacyCache(
 function privacySignalsFromIpinfo(
   data: Record<string, unknown>,
 ): FreeModeIpPrivacySignal[] {
+  const anonymous =
+    data.anonymous && typeof data.anonymous === 'object'
+      ? (data.anonymous as Record<string, unknown>)
+      : {}
   const signals: FreeModeIpPrivacySignal[] = []
-  if (data.vpn === true) signals.push('vpn')
-  if (data.proxy === true) signals.push('proxy')
-  if (data.tor === true) signals.push('tor')
-  if (data.relay === true) signals.push('relay')
-  if (data.hosting === true) signals.push('hosting')
+  if (data.vpn === true || anonymous.is_vpn === true) signals.push('vpn')
+  if (data.proxy === true || anonymous.is_proxy === true) signals.push('proxy')
+  if (data.tor === true || anonymous.is_tor === true) signals.push('tor')
+  if (data.relay === true || anonymous.is_relay === true) signals.push('relay')
+  if (anonymous.is_res_proxy === true) signals.push('res_proxy')
+  if (data.hosting === true || data.is_hosting === true) {
+    signals.push('hosting')
+  }
   if (
     data.service === true ||
     (typeof data.service === 'string' && data.service.length > 0)
   ) {
     signals.push('service')
   }
+  if (signals.length === 0 && data.is_anonymous === true) {
+    signals.push('anonymous')
+  }
   return signals
 }
 
@@ -140,7 +152,7 @@ export async function lookupIpinfoPrivacy(params: {
   }
 
   const response = await params.fetch(
-    `https://ipinfo.io/${encodeURIComponent(params.ip)}/privacy?token=${encodeURIComponent(params.token)}`,
+    `https://api.ipinfo.io/lookup/${encodeURIComponent(params.ip)}?token=${encodeURIComponent(params.token)}`,
   )
   if (!response.ok) {
     return null