Region-based Resource Rules #439

New Issue

MrUnknownDE · 2026-04-05T17:10:00+02:00

MrUnknownDE commented

2026-04-05 17:10:00 +02:00

Originally created by @infiniteWays on 12/22/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Hi Owen and Pangolins!

I just saw the pull request #2095 and was intrigued to add also a region rule.
I realized that something like that would be useful for regions of the earth with a high country density, it can be extremely tedious to create large amounts of rules.

I had a look around on what regional "classifications" there are and chose the one of the United Nations Statistical Division ("M49 Standard") which apparently also somehow got into Unicode.

This feature aims to add the rule cateogory "Region" based on that.

The numbers in parentheses are the M49 codes according to the UNSD.

Also included are three language localizations that I could do. English, German and Russian. I assume one could use a regular translator for the rest as the localizations are just single words. I however didn't want to mess with any "translation workflow", so I skipped on language I do not speak good enough.

Happy Holidays,
Dennis

How to test?

Testing this should work straight without any modifications to the way you run the container.
It is based on the same principles as the country rules.

I had some issues with integration testing resource accesses locally. If anyone has some time, a nice tutorial would be awesome!
Also, I had some issues with the drizzle.config.ts files in WSL/Windows. I had to exchange the const schema = [path.join(...)] with const schema = ["server/db/sqlite/schema/"]. Not sure if this is good or not, but it made me follow the instructions in the docs.

I however verified with curl that verifySession responds correctly according to the set rules shown above when messing around with the reported IP:

curl -X POST http://localhost:3001/api/v1/badger/verify-session -H "Content-Type: application/json" -d '{
"originalRequestURL": "http://test.example.com/api/test",
"scheme": "http",
"host": "test.example.com", 
"path": "/api/test",
"method": "GET", 
"tls": false, 
"requestIp": "{IP_of_your_choice}", 
"sessions": {}, 
"headers": {}, 
"query": {}  
}'

reports back

{"data":{"valid":true},"success":true,"error":false,"message":"Access allowed","status":200}

while exchanging the IP with an IP outside Europe, the API reports:

{"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200}

Please thoroughly double-check this on a working integration test server.

What could be improved?

Have the filter allow typing in countries and show their appropriate region. So if you type "Germany", show "Europe" and "Western Europe" in the dropdown
Maybe add "Country Groupings" like the EU, the Euro Zone, etc. But I would assume this to be another filter rule in general.

*Originally created by @infiniteWays on 12/22/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Hi Owen and Pangolins! I just saw the pull request #2095 and was intrigued to add also a region rule. I realized that something like that would be useful for regions of the earth with a high country density, it can be extremely tedious to create large amounts of rules. I had a look around on what regional "classifications" there are and chose the one of the [United Nations Statistical Division ("M49 Standard")](https://unstats.un.org/unsd/methodology/m49) which apparently also somehow got into [Unicode](https://www.unicode.org/cldr/charts/48/supplemental/territory_containment_un_m_49.html). This feature aims to add the rule cateogory "Region" based on that. <img width="633" height="467" alt="image" src="https://github.com/user-attachments/assets/deb98ebb-9002-4d77-816d-e16dd5d61699" /> <img width="1070" height="572" alt="image" src="https://github.com/user-attachments/assets/4dead3bf-3bf5-42ae-9ec4-09c75474d894" /> The numbers in parentheses are the M49 codes according to the UNSD. Also included are three language localizations that I could do. English, German and Russian. I assume one could use a regular translator for the rest as the localizations are just single words. I however didn't want to mess with any "translation workflow", so I skipped on language I do not speak good enough. Happy Holidays, Dennis ## How to test? Testing this should work straight without any modifications to the way you run the container. It is based on the same principles as the country rules. I had some issues with integration testing resource accesses locally. If anyone has some time, a nice tutorial would be awesome! Also, I had some issues with the drizzle.config.ts files in WSL/Windows. I had to exchange the `const schema = [path.join(...)]` with `const schema = ["server/db/sqlite/schema/"]`. Not sure if this is good or not, but it made me follow the instructions in the docs. I however verified with curl that verifySession responds correctly according to the set rules shown above when messing around with the reported IP: ``` curl -X POST http://localhost:3001/api/v1/badger/verify-session -H "Content-Type: application/json" -d '{ "originalRequestURL": "http://test.example.com/api/test", "scheme": "http", "host": "test.example.com", "path": "/api/test", "method": "GET", "tls": false, "requestIp": "{IP_of_your_choice}", "sessions": {}, "headers": {}, "query": {} }' ``` reports back ``` {"data":{"valid":true},"success":true,"error":false,"message":"Access allowed","status":200} ``` while exchanging the IP with an IP outside Europe, the API reports: ``` {"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200} ``` Please thoroughly double-check this on a working integration test server. ## What could be improved? - Have the filter allow typing in countries and show their appropriate region. So if you type "Germany", show "Europe" and "Western Europe" in the dropdown - Maybe add "Country Groupings" like the EU, the Euro Zone, etc. But I would assume this to be another filter rule in general.

MrUnknownDE closed this issue

2026-04-05 17:10:00 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#439