Not blocking pages really

We've looked at the code. This will likely still be an issue in 4.x

I also need to file another issue about how restrict_ip_js_alter() can break JS rendering for anonymous users. Essentially, core will cache the partial JS payload and not reset that for anon users who *are* on the proper ip.

Thanks @agentrickard! This is absolutely possible. We also found several things that could / should be improved after becoming Co-Maintainers a while ago.

Would it make sense for you to become (co-)maintainer and help to push things forward here?

I don't have a ton of time right now, though I am trying to unblock a project. It can't hurt to give me access, though I can't promise anything.

For page-level caching, we had to use a ServiceProvider override to override the core getCacheId() method to add an "ip_allowed" or "ip_deneid" string to the cache id.

@agentrickard thanks, I think anyone with a lot of experience, like you, can help to push things forward here. I'll add you as co-maintainer.
Hopefully we all can improve things here sooner or later.

PS: And we should have tests, whereever possible!