feat(portal): refine account identity controls

packages/network/src/index.ts

@@ -118,6 +118,26 @@ export class ProxyCheckProvider implements IpIntelligenceProvider {
   }
 }
 
+export function addressGroup(ipAddress: string) {
+  const hostAddress = ipAddress.split("/", 1)[0] ?? ipAddress;
+  if (!isIP(hostAddress)) return ipAddress;
+
+  let address = ipaddr.parse(hostAddress);
+  if (address instanceof ipaddr.IPv6 && address.isIPv4MappedAddress()) {
+    address = address.toIPv4Address();
+  }
+
+  const prefixLength = address.kind() === "ipv4" ? 24 : 64;
+  const bytes = address.toByteArray();
+  for (let bit = prefixLength; bit < bytes.length * 8; bit += 1) {
+    const byteIndex = Math.floor(bit / 8);
+    const bitMask = 1 << (7 - (bit % 8));
+    bytes[byteIndex] = (bytes[byteIndex] ?? 0) & ~bitMask;
+  }
+
+  return `${ipaddr.fromByteArray(bytes).toString()}/${prefixLength}`;
+}
+
 export function isPublicIp(ipAddress: string) {
   if (!isIP(ipAddress)) return false;
 

packages/network/test/address-groups.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { addressGroup } from "../src/index";
+
+describe("access address groups", () => {
+  it("groups nearby IPv4 and IPv6 addresses by their stable network prefix", () => {
+    expect(addressGroup("198.51.100.21")).toBe("198.51.100.0/24");
+    expect(addressGroup("198.51.100.240")).toBe("198.51.100.0/24");
+    expect(addressGroup("198.51.100.99/32")).toBe("198.51.100.0/24");
+    expect(addressGroup("2001:db8:abcd:1234:1111::1")).toBe("2001:db8:abcd:1234::/64");
+    expect(addressGroup("2001:db8:abcd:1234:ffff::9")).toBe("2001:db8:abcd:1234::/64");
+  });
+});