v0.7.3

Your own GeoIP mirror

MaxMind rate-limits its download API per licence key. Run enough containers and every one of them downloads on boot, the budget runs out, and the instances that lose start with no geolocation data — which quietly disables adaptive MFA risk factors rather than failing loudly.

Point the toolkit at a copy you control instead. No MaxMind credentials are involved at all:

src/config/auth.config.ts

geoLocation: {
  maxMind: {
    dbPath: '/app/data/maxmind',
    download: {
      from: 'url',
      url: 'https://cdn.example.com/geoip/{edition}.tar.gz',
      auth: { username: process.env.GEOIP_USER, password: process.env.GEOIP_PASSWORD },
    },
  },
},

{edition} is substituted per configured edition; pass an object instead to give each edition its own URL. The source may serve MaxMind's own .tar.gz — so a straight mirror of their archive works untouched — or a bare .mmdb. Which one it is gets detected from the response bytes rather than the file extension, so presigned URLs with a query string are fine.

HTTPS only. s3:// is rejected: the toolkit ships no AWS SDK and does not sign S3 requests, so use the bucket's HTTPS endpoint, a presigned URL, or a CDN in front of it.

Startup waits for the database

NAuth.create() and the NestJS module both await geolocation initialisation, so a boot-time download completes before the first request is served. With a custom mirror, failing to load any database now aborts startup rather than logging a warning — booting anyway would leave every lookup silently answering with nothing, which is the failure a mirror exists to prevent. Control it with requireDatabaseOnStartup.

Breaking: the geoLocation.maxMind shape

The config used to answer "where do the database files come from?" with two overlapping booleans, one combination of which was contradictory. It is now a single download block.

Before	Now
skipDownloads: true	omit download entirely
licenseKey + accountId	download: { from: 'maxmind', licenseKey, accountId }
autoDownloadOnStartup: true	download: { ..., onStartup: true } — now the default
autoDownloadOnStartup: false	download: { ..., onStartup: false }

src/config/auth.config.ts

geoLocation: {
  maxMind: {
    dbPath: '/app/data/maxmind',
    editions: ['GeoLite2-City', 'GeoLite2-Country'],
    download: {
      from: 'maxmind',
      licenseKey: process.env.MAXMIND_LICENSE_KEY,
      accountId: Number(process.env.MAXMIND_ACCOUNT_ID),
    },
  },
},

Watch the onStartup default, which flipped from false to true. If your own scheduler calls updateGeoLocationDatabase() on a cron, set onStartup: false or you will also download at every boot.

The removed keys are not silently ignored — a stale config fails at startup naming its replacement, for example geoLocation.maxMind.skipDownloads has been removed. Omit 'download' entirely to load files already on disk.

See Geolocation for the full shape.

Also fixed

• Geolocation never initialised on Express or Fastify. NAuth.create() never ran the init hook, so the readers stayed empty and every lookup returned nothing. Only NestJS, which runs the hook itself, was unaffected. If you use adaptive MFA on Express or Fastify, risk factors that depend on country were never firing.
• Startup no longer claims "No MaxMind database files found" when the files are there but will not open; it names the real cause.
• Listing an edition the toolkit does not read, such as GeoLite2-ASN, now warns instead of downloading a file nothing uses. Only GeoLite2-City and GeoLite2-Country are read for lookups.