Let the server derive the delivery allow-list by default - #2
Merged
Conversation
The API appends the requester's resolved address to delivery_ips on every create, so the CLI no longer sends a default list — omitting the field entirely and keeping explicit --ip values verbatim. delivery_ips is now optional in the library API. The public-IP lookup becomes diagnostics-only: after create it checks whether this machine's externally observed IP is in the returned allow-list and, if not, warns with the exact fix — the API path and the delivery path can exit from different addresses behind VPNs and NAT pools, which otherwise surfaces as an unexplained delivery 401. The lookup rejects private and reserved addresses, never shapes the request, and never blocks a create. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
createno longer sends a defaultdelivery_ips— the API locks delivery to the requester's resolved address on its own, so the default request body carries no IP list. Explicit--ipvalues are sent verbatim, unchanged.delivery_ipsis now optional in the library API (ProvisionRequest).--force --ip <ip>fix if not. Behind VPNs and NAT pools the API path and the media delivery path can exit from different addresses, which otherwise surfaces later as an unexplained delivery 401.Why
Simplest possible default contract: the server owns the allow-list unless the caller explicitly overrides it, and the CLI's only added value on the IP front is telling users when the lock won't match their delivery path — not guessing on their behalf.
Testing
npm test— 51/51 (node:test, in-process HTTP stubs). Coverage includes: default request omitsdelivery_ips, explicit--ippassthrough with zero lookups, private/reserved echo responses treated as undetermined, mismatch-warning trigger conditions. Verified end-to-end against the live API: default create → cloud provisioned, delivery locked to the caller, sample asset delivered with transformations.🤖 Generated with Claude Code