import { BlockList, isIP } from "node:net"; import { Option } from "effect"; import type { TrustedProxyConfig } from "../config"; // ---------------------------------------------------------------------------// Client IP for Better Auth's rate limiter.//// Better Auth only reads the client IP from request headers. Nothing tells it// which TCP peer the request came from, so on a directly exposed self-host it// found no header, logged a warning, and pooled every caller into one bucket of// three sign-ins per ten seconds. The fix has two halves:////   1. The server stamps the socket peer address onto CLIENT_IP_HEADER before//      Better Auth sees the request, always overwriting anything the client//      sent. A direct client can only ever rate-limit itself.//   2. Behind a reverse proxy the peer is the proxy, so the operator names the//      header the proxy sets (EXECUTOR_TRUSTED_PROXY_HEADER) and the addresses//      it connects from (EXECUTOR_TRUSTED_PROXIES). That header is honoured only//      on connections from one of those addresses and stripped otherwise, so a//      client that reaches the container directly cannot assert a proxy header.//// Better Auth's own default reads `x-forwarded-for` from anyone. That is not// restored here: a client could rotate the header to dodge the limit. Behind// an unconfigured proxy every user therefore shares one bucket, so the stamper// warns the operator once when it sees a proxy-style header in that state.// --------------------------------------------------------------------------- /** Server-stamped socket peer address. Never trusted from the client. */export const CLIENT_IP_HEADER = "x-executor-client-ip"; /** * Headers a reverse proxy commonly sets to the client IP. Seeing one with no * trusted proxy configured is the signature of a proxied deployment that has * not told Executor about its proxy. */export const PROXY_HINT_HEADERS = [  "x-forwarded-for",  "x-real-ip",  "cf-connecting-ip",  "true-client-ip",] as const; export interface IpRange {  readonly address: string;  readonly prefix: number;  readonly family: "ipv4" | "ipv6";} /** * Parse an IP address or `address/prefix` CIDR range. `undefined` for anything * else, so a typo cannot silently become a non-matching (or all-matching) rule. */export const parseIpRange = (value: string): IpRange | undefined => {  const slash = value.indexOf("/");  const address = slash === -1 ? value : value.slice(0, slash);  const version = isIP(address);  if (version === 0) return undefined;  const family = version === 6 ? "ipv6" : "ipv4";  const maxPrefix = version === 6 ? 128 : 32;  if (slash === -1) return { address, prefix: maxPrefix, family };  const prefixText = value.slice(slash + 1);  if (!/^\d{1,3}$/.test(prefixText)) return undefined;  const prefix = Number(prefixText);  if (prefix > maxPrefix) return undefined;  return { address, prefix, family };}; const blockListOf = (ranges: readonly IpRange[]): BlockList => {  const list = new BlockList();  for (const range of ranges) list.addSubnet(range.address, range.prefix, range.family);  return list;}; // `isIP` rejects the `::ffff:` prefix form only when malformed; a dual-stack// socket may report an IPv4 peer as an IPv4-mapped IPv6 address, which// BlockList matches against IPv4 rules on its own.const isTrustedPeer = (list: BlockList, address: string): boolean => {  const version = isIP(address);  return version !== 0 && list.check(address, version === 6 ? "ipv6" : "ipv4");}; /** The `advanced.ipAddress` block handed to Better Auth. */export interface ClientIpAddressOptions {  /**   * Header names Better Auth walks, in order, to find the client IP. The   * proxy's header leads when one is configured; the server-stamped socket   * address is the fallback for requests that did not come through the proxy.   */  readonly ipAddressHeaders: string[];  /**   * Hops Better Auth strips from the right of a forwarded chain. Only present   * with a configured proxy; when every hop in a header is trusted, Better   * Auth finds no client in it and moves to the next header.   */  readonly trustedProxies?: string[];} export const clientIpAddressOptions = (  trustedProxy: TrustedProxyConfig | undefined,): ClientIpAddressOptions =>  trustedProxy    ? {        ipAddressHeaders: [trustedProxy.header, CLIENT_IP_HEADER],        trustedProxies: [...trustedProxy.proxies],      }    : { ipAddressHeaders: [CLIENT_IP_HEADER] }; /** * The request with its headers replaced, everything else passed through. * * Deliberately NOT `new Request(request, { headers })`: Bun's copy constructor * never delivers a body that is not one of its own native streams, and the * Vite dev middleware hands the handler `Readable.toWeb(req)`, so every * sign-in POST hung until the client gave up (the production Bun.serve path * was unaffected). Rebuilding from the parts with the body passed explicitly * behaves the same on both paths; `duplex: "half"` is what the Fetch spec * requires when a request body is a stream. */const withHeaders = (request: Request, headers: Headers): Request => {  const init: RequestInit & { duplex?: "half" } = {    method: request.method,    headers,    signal: request.signal,  };  if (request.body) {    init.body = request.body;    init.duplex = "half";  }  return new Request(request.url, init);}; export interface ClientIpStamperOptions {  /** Where the one-time unconfigured-proxy warning goes. Defaults to console.warn. */  readonly warn?: (message: string) => void;} const unconfiguredProxyWarning = (header: string): string =>  `[executor] An auth request carried ${header}, but no trusted proxy is configured, so every user behind that proxy shares one sign-in rate-limit bucket. Set EXECUTOR_TRUSTED_PROXY_HEADER and EXECUTOR_TRUSTED_PROXIES so the limit keys on the real client IP.`; /** * Build the per-request rewrite that stamps the socket peer address onto * CLIENT_IP_HEADER (or removes it when the runtime cannot report one) and * drops the trusted-proxy header unless the peer is a configured proxy. The * `remoteAddress` is the TCP peer as reported by the HTTP server, not anything * read from the request. * * With no trusted proxy configured, the first request that carries one of * PROXY_HINT_HEADERS triggers a single operator warning for the stamper's * lifetime (one stamper per server). */export const makeClientIpStamper = (  trustedProxy: TrustedProxyConfig | undefined,  options: ClientIpStamperOptions = {},): ((request: Request, remoteAddress: Option.Option<string>) => Request) => {  const proxies = trustedProxy    ? blockListOf(trustedProxy.proxies.flatMap((entry) => parseIpRange(entry) ?? []))    : undefined;  const warn = options.warn ?? ((message: string) => console.warn(message));  let warnedUnconfiguredProxy = false;  return (request, remoteAddress) => {    const headers = new Headers(request.headers);    const peer = Option.getOrUndefined(remoteAddress);    if (peer) {      headers.set(CLIENT_IP_HEADER, peer);    } else {      headers.delete(CLIENT_IP_HEADER);    }    if (trustedProxy && proxies && !(peer && isTrustedPeer(proxies, peer))) {      headers.delete(trustedProxy.header);    }    if (!trustedProxy && !warnedUnconfiguredProxy) {      const hint = PROXY_HINT_HEADERS.find((header) => headers.has(header));      if (hint) {        warnedUnconfiguredProxy = true;        warn(unconfiguredProxyWarning(hint));      }    }    return withHeaders(request, headers);  };};