Improved demo

src/routes/user/UserRouter.ts

@@ -53,18 +53,26 @@ router.use(function(req, res, next) {
         return
     }
 
-    const serviceManager = user.serviceManager
-
     // All requests except GET might be making changes to some stuff that are not designed for an asynchronous process
     // I'm being extra cautious. But removal of this lock mechanism requires testing and consideration of edge cases.
     if (Utils.isNotGetRequest(req)) {
-        if (EnvVars.IS_DEMO_MODE) {
-            let response = new BaseApi(
-                ApiStatusCodes.STATUS_ERROR_GENERIC,
-                'Demo mode is only for viewing purposes.'
-            )
-            res.send(response)
-            return
+        if (!!EnvVars.DEMO_MODE_ADMIN_IP) {
+            const realIp = `${req.headers['x-real-ip']}`
+            const forwardedIp = `${req.headers['x-forwarded-for']}`
+            if (
+                !realIp ||
+                !Utils.isValidIp(realIp) ||
+                realIp !== forwardedIp ||
+                EnvVars.DEMO_MODE_ADMIN_IP !== realIp
+            ) {
+                let response = new BaseApi(
+                    ApiStatusCodes.STATUS_ERROR_GENERIC,
+                    'Demo mode is only for viewing purposes.'
+                )
+                res.send(response)
+
+                return
+            }
         }
 
         if (threadLockNamespace[namespace]) {

src/utils/EnvVars.ts

@@ -4,7 +4,7 @@ export = {
         CAPTAIN_IS_DEBUG: 'CAPTAIN_IS_DEBUG',
         DEFAULT_PASSWORD: 'DEFAULT_PASSWORD',
         IS_CAPTAIN_INSTANCE: 'IS_CAPTAIN_INSTANCE',
-        IS_DEMO_MODE: 'IS_DEMO_MODE',
+        DEMO_MODE_ADMIN_IP: 'DEMO_MODE_ADMIN_IP',
     },
 
     BY_PASS_PROXY_CHECK: process.env.BY_PASS_PROXY_CHECK,
@@ -17,7 +17,7 @@ export = {
 
     IS_CAPTAIN_INSTANCE: process.env.IS_CAPTAIN_INSTANCE,
 
-    IS_DEMO_MODE: !!process.env.IS_DEMO_MODE,
+    DEMO_MODE_ADMIN_IP: process.env.DEMO_MODE_ADMIN_IP,
 
     DEFAULT_PASSWORD: process.env.DEFAULT_PASSWORD,
 }