feat(vpn): use authenticated VPN route grants

ts/classes.dcrouter.ts

@@ -26,7 +26,7 @@ import { RadiusServer, type IRadiusServerConfig } from './radius/index.js';
 import { RemoteIngressManager, TunnelManager } from './remoteingress/index.js';
 import { VpnManager, type IVpnManagerConfig } from './vpn/index.js';
 import { RouteConfigManager, ApiTokenManager, GatewayClientManager, ReferenceResolver, DbSeeder, TargetProfileManager } from './config/index.js';
-import type { TIpAllowEntry } from './config/classes.route-config-manager.js';
+import type { TVpnClientAllowEntry } from './config/classes.route-config-manager.js';
 import { SecurityLogger, ContentScanner, IPReputationChecker, SecurityPolicyManager } from './security/index.js';
 import { type IHttp3Config, augmentRoutesWithHttp3 } from './http3/index.js';
 import { DnsManager } from './dns/manager.dns.js';
@@ -605,7 +605,7 @@ export class DcRouter {
             this.routeConfigManager = new RouteConfigManager(
               () => this.smartProxy,
               () => this.options.http3,
-              this.createVpnRouteAllowListResolver(),
+              this.createVpnClientAccessResolver(),
               this.referenceResolver,
               // Sync routes to RemoteIngressManager whenever routes change,
               // then push updated derived ports to the Rust hub binary
@@ -2399,10 +2399,10 @@ export class DcRouter {
   /**
    * Set up VPN server for VPN-based route access control.
    */
-  private createVpnRouteAllowListResolver(): ((
+  private createVpnClientAccessResolver(): ((
     route: import('../ts_interfaces/data/remoteingress.js').IDcRouterRouteConfig,
     routeId?: string,
-  ) => TIpAllowEntry[]) | undefined {
+  ) => TVpnClientAllowEntry[]) | undefined {
     if (!this.options.vpnConfig?.enabled) {
       return undefined;
     }
@@ -2416,12 +2416,11 @@ export class DcRouter {
         return [];
       }
 
-      return this.targetProfileManager.getMatchingClientIps(
+      return this.targetProfileManager.getMatchingVpnClients(
         route,
         routeId,
         this.vpnManager.listClients(),
         this.routeConfigManager?.getRoutes() || new Map(),
-        this.vpnManager.getClientSourceIpMap(),
       );
     };
   }
@@ -2453,22 +2452,21 @@ export class DcRouter {
       bridgeIpRangeStart: this.options.vpnConfig.bridgeIpRangeStart,
       bridgeIpRangeEnd: this.options.vpnConfig.bridgeIpRangeEnd,
       onClientChanged: () => {
-        // Re-apply routes so profile-based ipAllowLists get updated
+        // Re-apply routes so profile-based VPN client grants get updated
         // (serialized by RouteConfigManager's mutex — safe as fire-and-forget)
         this.routeConfigManager?.applyRoutes().catch((err) => {
           logger.log('warn', `Failed to re-apply routes after VPN client change: ${err?.message || err}`);
         });
       },
       onClientSourceIpsChanged: () => {
-        this.routeConfigManager?.applyRoutes().catch((err) => {
-          logger.log('warn', `Failed to re-apply routes after VPN client source IP change: ${err?.message || err}`);
-        });
+        // SmartProxy now receives the real source IP per connection via PROXY v2.
+        // Source-IP changes are reflected in status/UI only; route config is static.
       },
       getClientDirectTargets: (targetProfileIds: string[]) => {
         if (!this.targetProfileManager) return [];
         return this.targetProfileManager.getDirectTargetIps(targetProfileIds);
       },
-      getClientAllowedIPs: async (targetProfileIds: string[], clientId?: string, sourceIp?: string) => {
+      getClientAllowedIPs: async (targetProfileIds: string[], clientId?: string, _sourceIp?: string) => {
         const subnet = this.options.vpnConfig?.subnet || '10.8.0.0/24';
         const ips = new Set<string>([subnet]);
 
@@ -2479,7 +2477,6 @@ export class DcRouter {
         const { domains, targetIps } = this.targetProfileManager.getClientAccessSpec(
           targetProfileIds,
           allRoutes,
-          sourceIp,
         );
 
         // Add target IPs directly
@@ -2506,7 +2503,7 @@ export class DcRouter {
     await this.vpnManager.start();
 
     // Re-apply routes now that VPN clients are loaded — ensures vpnOnly routes
-    // get correct profile-based ipAllowLists
+    // get correct profile-based VPN client grants.
     await this.routeConfigManager?.applyRoutes();
   }
 
@@ -2602,7 +2599,7 @@ export class DcRouter {
     this.options.vpnConfig = config;
     this.vpnDomainIpCache.clear();
     this.warnedWildcardVpnDomains.clear();
-    this.routeConfigManager?.setVpnClientIpsResolver(this.createVpnRouteAllowListResolver());
+    this.routeConfigManager?.setVpnClientAccessResolver(this.createVpnClientAccessResolver());
 
     if (this.options.vpnConfig?.enabled) {
       await this.setupVpnServer();