feat: separate internal and external open-task listing traffic

apps/web/src/app/api/open-tasks/route.ts

@@ -49,6 +49,29 @@ function resolveSourceIp(request: Request) {
   );
 }
 
+function isPrivateIp(ip: string | undefined) {
+  if (!ip) return false;
+  const normalized = ip.trim().toLowerCase();
+  if (!normalized || normalized === "unknown" || normalized === "::1" || normalized === "localhost") {
+    return true;
+  }
+
+  if (normalized.startsWith("127.") || normalized.startsWith("10.") || normalized.startsWith("192.168.")) {
+    return true;
+  }
+
+  if (normalized.startsWith("172.")) {
+    const secondOctet = Number(normalized.split(".")[1]);
+    return secondOctet >= 16 && secondOctet <= 31;
+  }
+
+  if (normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80")) {
+    return true;
+  }
+
+  return false;
+}
+
 function isLikelyAIAgentUserAgent(userAgent: string) {
   const normalized = userAgent.toLowerCase();
   return AI_USER_AGENT_HINTS.some((token) => normalized.includes(token));
@@ -83,6 +106,10 @@ function resolveExternalActor(request: Request) {
 }
 
 export async function GET(request: Request) {
+  const sourceIp = resolveSourceIp(request);
+  const isPublicIp = !isPrivateIp(sourceIp);
+  const trafficAction = isPublicIp ? "EXTERNAL_LIST_OPEN_TASKS" : "INTERNAL_LIST_OPEN_TASKS";
+
   const tasks = await prisma.task.findMany({
     where: { status: TaskStatus.OPEN },
     orderBy: { created_at: "desc" },
@@ -124,7 +151,7 @@ export async function GET(request: Request) {
 
   void sendTrafficAlert({
     level: "info",
-    action: "EXTERNAL_LIST_OPEN_TASKS",
+    action: trafficAction,
     surface: "public-open-tasks",
     actorType: actor.actorType,
     actorId: actor.actorId,
@@ -133,7 +160,7 @@ export async function GET(request: Request) {
     metadata: {
       source: "public-open-tasks",
       task_count: publicPayload.length,
-      source_ip: resolveSourceIp(request),
+      source_ip: sourceIp,
       user_agent: request.headers.get("user-agent") ?? "unknown",
     },
   });
@@ -145,13 +172,13 @@ export async function GET(request: Request) {
   void prisma.auditEvent.count({
     where: {
       createdAt: { gte: surgeWindowStart },
-      action: "EXTERNAL_LIST_OPEN_TASKS",
+      action: trafficAction,
     },
   }).then((eventCount) => {
     if (eventCount > 0 && eventCount % 25 === 0) {
       void sendTrafficAlert({
         level: "warning",
-        action: "EXTERNAL_LIST_OPEN_TASKS_SURGE",
+        action: isPublicIp ? "EXTERNAL_LIST_OPEN_TASKS_SURGE" : "INTERNAL_LIST_OPEN_TASKS_SURGE",
         surface: "public-open-tasks",
         actorType: "SYSTEM",
         actorId: "traffic-monitor",