feat: enforce tenant login IP whitelists

server/admin_internal_config.go

@@ -34,6 +34,18 @@ type adminInternalClient struct {
 	http   *http.Client
 }
 
+type tenantLoginIPWhitelistConfig struct {
+	TenantID types.TenantID `json:"tenant_id"`
+	AppList  []string       `json:"app_list"`
+	WebList  []string       `json:"web_list"`
+}
+
+type tenantLoginIPWhitelistProvider interface {
+	TenantLoginIPWhitelist(id types.TenantID) (*tenantLoginIPWhitelistConfig, error)
+}
+
+var loginIPWhitelistProvider tenantLoginIPWhitelistProvider
+
 type adminInternalTenantDTO struct {
 	ID         types.TenantID    `json:"id"`
 	Code       string            `json:"code"`
@@ -50,6 +62,7 @@ type adminInternalTenantDTO struct {
 
 func initAdminInternalAPI(raw json.RawMessage) error {
 	store.SetAdminInternalConfigProvider(nil)
+	loginIPWhitelistProvider = nil
 	if len(raw) == 0 || string(raw) == "null" {
 		return nil
 	}
@@ -71,10 +84,12 @@ func initAdminInternalAPI(raw json.RawMessage) error {
 	if cfg.BaseURL == "" || strings.TrimSpace(cfg.Secret) == "" {
 		return errors.New("admin_internal_api enabled but base_url or secret is empty")
 	}
-	store.SetAdminInternalConfigProvider(&adminInternalClient{
+	client := &adminInternalClient{
 		config: cfg,
 		http:   &http.Client{Timeout: time.Duration(cfg.TimeoutMS) * time.Millisecond},
-	})
+	}
+	store.SetAdminInternalConfigProvider(client)
+	loginIPWhitelistProvider = client
 	logs.Info.Printf("Admin internal config client enabled: base_url=%s service=%s", cfg.BaseURL, cfg.ServiceName)
 	return nil
 }
@@ -152,6 +167,25 @@ func (c *adminInternalClient) ThirdPartyConfig(group string, keys ...string) (ma
 	return wrapper.Values, nil
 }
 
+func (c *adminInternalClient) TenantLoginIPWhitelist(id types.TenantID) (*tenantLoginIPWhitelistConfig, error) {
+	if !id.IsValid() {
+		return nil, types.ErrMalformed
+	}
+	var result tenantLoginIPWhitelistConfig
+	path := "/internal/im-config/tenants/by-id/" + strconv.FormatInt(int64(id), 10) + "/login-ip-whitelist"
+	if err := c.getJSON(path, nil, &result); err != nil {
+		return nil, err
+	}
+	result.TenantID = id
+	if result.AppList == nil {
+		result.AppList = []string{}
+	}
+	if result.WebList == nil {
+		result.WebList = []string{}
+	}
+	return &result, nil
+}
+
 func (c *adminInternalClient) getJSON(path string, query url.Values, out any) error {
 	if c == nil || c.http == nil {
 		return types.ErrUnsupported