[Feature] Add per-IP transfer scope filtering for file operations across protocols #2187

Is your feature request related to a problem? Please describe.

Description: We need a way to restrict file operation direction based on the client source IP/CIDR, while keeping normal authentication and admin access unaffected.

Problem: Today, SFTPGo’s built-in IP allow list is primarily a connection-level control. That works for allowing or denying connections, but it does not support this use case cleanly:

• clients from one network should be able to upload only
• clients from another network should be able to download only
• behavior should be consistent across supported transfer protocols

Using the existing connection-level allow list for this creates two problems:

1. Enabling it can block login/connect entirely, which is not desired for a data-plane-only policy

2. It cannot express per-IP transfer scope such as:

   • allow both upload and download
   • allow upload only
   • allow download only

Describe the solution you'd like

Proposed behavior:

Introduce transfer IP filtering as a distinct data-plane permission layer.

The feature should:

• evaluate the client IP/CIDR during file permission checks
• support these per-IP scopes:
  • allow upload and download
  • allow upload only
  • allow download only
• support explicit enforcement mode:
  • allow_unmatched
  • deny_unmatched
• support explicit scope:
  • data_only
  • all_requests (optional/future)
• be independently enabled/disabled from the existing connection allow list

Important requirements

• enforcement should apply consistently across shared permission checks, not only HTTP/UI
• unmatched IP behavior must be explicit
• missing remote IP or lookup errors should fail closed when the feature is enabled
• protocol normalization should correctly handle internal protocol names such as:
  • SFTP/SCP → SSH
  • HTTPShare/OIDC → HTTP

Suggested config
A separate feature toggle avoids interference with the existing connection allow list:

SFTPGO_IP_FILTER_ENABLED=1
SFTPGO_IP_FILTER_MODE=deny_unmatched
SFTPGO_IP_FILTER_SCOPE=data_only

UI expectations
In the admin IP manager, the UI should distinguish between:

• connection allow list status
• transfer IP filtering status

For example:

• “Connection allow list is disabled”
• “Transfer IP filtering is enabled for file operations”

Notes
This is intended to solve segmented-network workflows where the same users may authenticate normally, but allowed file actions depend on the source network.

Describe alternatives you've considered

No response

What are you using SFTPGo for?

Enterprise

Additional context

No response