Bypass cache for origin IP lookups to avoid serving stale data

Author: laurentpellegrino

src/main/java/co/ipregistry/api/client/IpregistryClient.java

@@ -126,6 +126,12 @@ public IpInfo lookup(final InetAddress ip, final IpregistryOption... options) th
      * @throws ClientException if a client issue happens.
      */
     public IpInfo lookup(final String ip, final IpregistryOption... options) throws ApiException, ClientException {
+        // Origin (requester) IP lookups cannot be safely cached: the actual IP is only known from
+        // the response, so an empty cache key would risk returning data for a different requester.
+        if (ip == null || ip.isEmpty()) {
+            return requestHandler.lookup(ip, options);
+        }
+
         final String cacheKey = buildCacheKey(ip, options);
         IpInfo cacheValue = this.cache.get(cacheKey);
 

src/test/java/co/ipregistry/api/client/IpregistryClientTest.java

@@ -38,6 +38,7 @@
 import co.ipregistry.api.client.exceptions.IpregistryException;
 import co.ipregistry.api.client.model.IpInfo;
 import co.ipregistry.api.client.model.IpInfoList;
+import co.ipregistry.api.client.model.RequesterIpInfo;
 import co.ipregistry.api.client.request.DefaultRequestHandler;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
@@ -164,6 +165,27 @@ void testBatchRequestAllCachedSkipsApiCall() throws IpregistryException {
         Assertions.assertSame(ipdata1111, response.get(1));
     }
 
+    @Test
+    void testOriginIpLookupBypassesCache() throws IpregistryException {
+        final IpregistryConfig config =
+                IpregistryConfig.builder().apiKey("test").build();
+
+        final IpregistryCache cache = Mockito.spy(new InMemoryCache());
+        final DefaultRequestHandler requestHandler = Mockito.spy(new DefaultRequestHandler(config));
+
+        final RequesterIpInfo originInfo = new RequesterIpInfo();
+        Mockito.doReturn(originInfo).when(requestHandler).lookup("");
+
+        final IpregistryClient client = new IpregistryClient(config, cache, requestHandler);
+
+        final RequesterIpInfo response = client.lookup();
+
+        // Origin lookups must never touch the cache, as they cannot be keyed by the actual IP.
+        Mockito.verify(cache, Mockito.never()).get(Mockito.anyString());
+        Mockito.verify(cache, Mockito.never()).put(Mockito.anyString(), Mockito.any(IpInfo.class));
+        Assertions.assertSame(originInfo, response);
+    }
+
     @Test
     void testCloseClosesRequestHandler() throws Exception {
         final IpregistryConfig config =