src/middleware/adminIp.js

import { ADMIN_IP_ALLOWLIST } from "../config/security.js";

export function adminIp(req, res, next) {
  if (!ADMIN_IP_ALLOWLIST.includes(req.ip)) return res.sendStatus(403);
  next();
}