replaced fxa-geodb with load balancer header

Co-authored-by: timvisee <tim@visee.me>

server/amplitude.js

@@ -3,10 +3,6 @@ const fetch = require('node-fetch');
 const config = require('./config');
 const pkg = require('../package.json');
 
-const geoip = config.ip_db
-  ? require('fxa-geodb')({ dbPath: config.ip_db })
-  : () => ({});
-
 const HOUR = 1000 * 60 * 60;
 
 function truncateToHour(timestamp) {
@@ -24,20 +20,11 @@ function userId(fileId, ownerId) {
   return hash.digest('hex').substring(32);
 }
 
-function location(ip) {
-  try {
-    return geoip(ip);
-  } catch (e) {
-    return {};
-  }
-}
-
 function statUploadEvent(data) {
-  const loc = location(data.ip);
   const event = {
     session_id: -1,
-    country: loc.country,
-    region: loc.state,
+    country: data.country,
+    region: data.state,
     user_id: userId(data.id, data.owner),
     app_version: pkg.version,
     time: truncateToHour(Date.now()),
@@ -57,11 +44,10 @@ function statUploadEvent(data) {
 }
 
 function statDownloadEvent(data) {
-  const loc = location(data.ip);
   const event = {
     session_id: -1,
-    country: loc.country,
-    region: loc.state,
+    country: data.country,
+    region: data.state,
     user_id: userId(data.id, data.owner),
     app_version: pkg.version,
     time: truncateToHour(Date.now()),
@@ -77,11 +63,10 @@ function statDownloadEvent(data) {
 }
 
 function statDeleteEvent(data) {
-  const loc = location(data.ip);
   const event = {
     session_id: -1,
-    country: loc.country,
-    region: loc.state,
+    country: data.country,
+    region: data.state,
     user_id: userId(data.id, data.owner),
     app_version: pkg.version,
     time: truncateToHour(Date.now()),
@@ -96,8 +81,16 @@ function statDeleteEvent(data) {
   return sendBatch([event]);
 }
 
-function clientEvent(event, ua, language, session_id, deltaT, platform, ip) {
-  const loc = location(ip);
+function clientEvent(
+  event,
+  ua,
+  language,
+  session_id,
+  deltaT,
+  platform,
+  country,
+  state
+) {
   const ep = event.event_properties || {};
   const up = event.user_properties || {};
   const event_properties = {
@@ -133,7 +126,7 @@ function clientEvent(event, ua, language, session_id, deltaT, platform, ip) {
   };
   return {
     app_version: pkg.version,
-    country: loc.country,
+    country: country,
     device_id: event.device_id,
     event_properties,
     event_type: event.event_type,
@@ -141,7 +134,7 @@ function clientEvent(event, ua, language, session_id, deltaT, platform, ip) {
     os_name: ua.os.name,
     os_version: ua.os.version,
     platform,
-    region: loc.state,
+    region: state,
     session_id,
     time: event.time + deltaT,
     user_id: event.user_id,

server/routes/delete.js

@@ -11,6 +11,8 @@ module.exports = async function(req, res) {
     statDeleteEvent({
       id,
       ip: req.ip,
+      country: req.geo.country,
+      state: req.geo.state,
       owner: meta.owner,
       download_count: meta.dl,
       ttl,

server/routes/download.js

@@ -31,6 +31,8 @@ module.exports = async function(req, res) {
       statDownloadEvent({
         id,
         ip: req.ip,
+        country: req.geo.country,
+        state: req.geo.state,
         owner: meta.owner,
         download_count: dl,
         ttl,

server/routes/index.js

@@ -32,55 +32,54 @@ module.exports = function(app) {
   });
   if (!IS_DEV) {
     let csp = {
-        directives: {
-          defaultSrc: ["'self'"],
-          connectSrc: [
-            "'self'",
-            'wss://*.dev.lcip.org',
-            'wss://*.send.nonprod.cloudops.mozgcp.net',
-            config.base_url.replace(/^https:\/\//, 'wss://'),
-            'https://*.dev.lcip.org',
-            'https://accounts.firefox.com',
-            'https://*.accounts.firefox.com',
-            'https://sentry.prod.mozaws.net'
-          ],
-          imgSrc: [
-            "'self'",
-            'https://*.dev.lcip.org',
-            'https://firefoxusercontent.com',
-            'https://secure.gravatar.com'
-          ],
-          scriptSrc: [
-            "'self'",
-            function(req) {
-              return `'nonce-${req.cspNonce}'`;
-            }
-          ],
-          formAction: ["'none'"],
-          frameAncestors: ["'none'"],
-          objectSrc: ["'none'"],
-          reportUri: '/__cspreport__'
-        }
+      directives: {
+        defaultSrc: ["'self'"],
+        connectSrc: [
+          "'self'",
+          'wss://*.dev.lcip.org',
+          'wss://*.send.nonprod.cloudops.mozgcp.net',
+          config.base_url.replace(/^https:\/\//, 'wss://'),
+          'https://*.dev.lcip.org',
+          'https://accounts.firefox.com',
+          'https://*.accounts.firefox.com',
+          'https://sentry.prod.mozaws.net'
+        ],
+        imgSrc: [
+          "'self'",
+          'https://*.dev.lcip.org',
+          'https://firefoxusercontent.com',
+          'https://secure.gravatar.com'
+        ],
+        scriptSrc: [
+          "'self'",
+          function(req) {
+            return `'nonce-${req.cspNonce}'`;
+          }
+        ],
+        formAction: ["'none'"],
+        frameAncestors: ["'none'"],
+        objectSrc: ["'none'"],
+        reportUri: '/__cspreport__'
       }
+    };
 
-    csp.directives.connectSrc.push(config.base_url.replace(/^https:\/\//,'wss://'))
-    if(config.fxa_csp_oauth_url != ""){
-      csp.directives.connectSrc.push(config.fxa_csp_oauth_url)
-    }
-    if(config.fxa_csp_content_url != "" ){
-      csp.directives.connectSrc.push(config.fxa_csp_content_url)
-    }
-    if(config.fxa_csp_profile_url != "" ){
-      csp.directives.connectSrc.push(config.fxa_csp_profile_url)
-    }
-    if(config.fxa_csp_profileimage_url != ""){
-      csp.directives.imgSrc.push(config.fxa_csp_profileimage_url)
-    }
-
-
-    app.use(
-      helmet.contentSecurityPolicy(csp)
+    csp.directives.connectSrc.push(
+      config.base_url.replace(/^https:\/\//, 'wss://')
     );
+    if (config.fxa_csp_oauth_url != '') {
+      csp.directives.connectSrc.push(config.fxa_csp_oauth_url);
+    }
+    if (config.fxa_csp_content_url != '') {
+      csp.directives.connectSrc.push(config.fxa_csp_content_url);
+    }
+    if (config.fxa_csp_profile_url != '') {
+      csp.directives.connectSrc.push(config.fxa_csp_profile_url);
+    }
+    if (config.fxa_csp_profileimage_url != '') {
+      csp.directives.imgSrc.push(config.fxa_csp_profileimage_url);
+    }
+
+    app.use(helmet.contentSecurityPolicy(csp));
   }
 
   app.use(function(req, res, next) {
@@ -91,6 +90,19 @@ module.exports = function(app) {
     );
     next();
   });
+  app.use(function(req, res, next) {
+    try {
+      // set by the load balancer
+      const [country, state] = req.header('X-Client-Geo-Location').split(',');
+      req.geo = {
+        country,
+        state
+      };
+    } catch (e) {
+      req.geo = {};
+    }
+    next();
+  });
   app.use(bodyParser.json());
   app.use(bodyParser.text());
   app.get('/', language, pages.index);

server/routes/metrics.js

@@ -12,7 +12,8 @@ module.exports = async function(req, res) {
         data.session_id + deltaT,
         deltaT,
         data.platform,
-        req.ip
+        req.geo.country,
+        req.geo.state
       )
     );
     const status = await sendBatch(events);

server/routes/ws.js

@@ -111,6 +111,8 @@ module.exports = function(ws, req) {
         statUploadEvent({
           id: newId,
           ip: req.ip,
+          country: req.geo.country,
+          state: req.geo.state,
           owner,
           dlimit,
           timeLimit,