server.js

import "dotenv/config"; // loads .env into process.env (any Node version)
import express from "express";
import { ipReputation } from "./src/ipReputation.js";

const app = express();

// Behind Heroku/Render/Nginx/Cloudflare this is what makes req.ip
// resolve to the real visitor instead of the proxy. Set it to the
// number of hops you actually run, or `true` if you terminate at one
// trusted proxy. `true` is the wrong default if anyone can reach your
// app directly, because then X-Forwarded-For is attacker-controlled.
app.set("trust proxy", true);

app.use(
    ipReputation({
        failOpen: true,
        onBlock: (req, res) =>
            res.status(403).json({ error: "Access denied", ip: req.ip }),
        onChallenge: (req, res, next) => {
            // Wire this to your real CAPTCHA / rate limiter.
            res.set("X-Require-Challenge", "1");
            next();
        },
        onStepUp: (req, res, next) => {
            res.set("X-Require-MFA", "1");
            next();
        },
    })
);

app.get("/api/data", (req, res) => {
    res.json({
        ok: true,
        seenFrom: req.ip,
        reputation: {
            threat_score: req.ipReputation?.threat_score,
            is_vpn: req.ipReputation?.is_vpn,
            is_proxy: req.ipReputation?.is_proxy,
            is_tor: req.ipReputation?.is_tor,
            is_bot: req.ipReputation?.is_bot,
            is_known_attacker: req.ipReputation?.is_known_attacker,
        },
    });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`listening on :${PORT}`));