@lenne.tech/nest-server 11.32.4 → 11.33.1

package/src/core/modules/auth/services/legacy-auth-rate-limiter.service.ts

@@ -1,15 +1,15 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Injectable, Logger, OnModuleInit, Optional } from '@nestjs/common';
 
 import { IAuthRateLimit } from '../../../common/interfaces/server-options.interface';
 import { ConfigService } from '../../../common/services/config.service';
-
-/**
- * Rate limit entry for tracking requests
- */
-interface RateLimitEntry {
-  count: number;
-  resetTime: number;
-}
+import { CoreRedisService } from '../../../common/services/core-redis.service';
+import {
+  InMemoryRateLimitStore,
+  rateLimitKey,
+  rateLimitKeyPrefix,
+  RateLimitStore,
+  RedisRateLimitStore,
+} from '../../../common/services/rate-limit-store';
 
 /**
  * Result of a rate limit check
@@ -41,10 +41,11 @@ const DEFAULT_CONFIG: Required<IAuthRateLimit> = {
 };
 
 /**
- * In-memory rate limiter for Legacy Auth endpoints
+ * Rate limiter for Legacy Auth endpoints
  *
  * This service provides rate limiting to protect against brute-force attacks
- * on authentication endpoints. It uses an in-memory store with automatic cleanup.
+ * on authentication endpoints. Counters live in a {@link RateLimitStore}: shared
+ * via Redis when `ServerOptions.redis` is configured, process-local otherwise.
  *
  * Features:
  * - Configurable request limits and time windows
@@ -68,15 +69,11 @@ const DEFAULT_CONFIG: Required<IAuthRateLimit> = {
  */
 @Injectable()
 export class LegacyAuthRateLimiter implements OnModuleInit {
-  private readonly logger = new Logger(LegacyAuthRateLimiter.name);
-  private readonly store = new Map<string, RateLimitEntry>();
-  private config: Required<IAuthRateLimit> = DEFAULT_CONFIG;
-  private cleanupInterval: NodeJS.Timeout | null = null;
+  protected readonly logger = new Logger(LegacyAuthRateLimiter.name);
+  protected config: Required<IAuthRateLimit> = DEFAULT_CONFIG;
+  protected store?: RateLimitStore;
 
-  constructor() {
-    // Start cleanup interval (every 5 minutes)
-    this.startCleanup();
-  }
+  constructor(@Optional() protected readonly coreRedisService?: CoreRedisService) {}
 
   /**
    * Auto-configure from ConfigService on module initialization
@@ -127,7 +124,7 @@ export class LegacyAuthRateLimiter implements OnModuleInit {
    * @param endpoint - Endpoint name (e.g., 'signIn', 'signUp')
    * @returns Rate limit check result
    */
-  check(ip: string, endpoint: string): RateLimitResult {
+  async check(ip: string, endpoint: string): Promise<RateLimitResult> {
     // If rate limiting is disabled, always allow
     if (!this.config.enabled) {
       return {
@@ -140,43 +137,21 @@ export class LegacyAuthRateLimiter implements OnModuleInit {
     }
 
     const limit = this.config.max;
-    const key = `${ip}:${endpoint}`;
-    const now = Date.now();
-
-    // Get or create entry
-    let entry = this.store.get(key);
-
-    if (!entry || now >= entry.resetTime) {
-      // Create new entry or reset expired one
-      entry = {
-        count: 1,
-        resetTime: now + this.config.windowSeconds * 1000,
-      };
-      this.store.set(key, entry);
-
-      return {
-        allowed: true,
-        current: 1,
-        limit,
-        remaining: limit - 1,
-        resetIn: this.config.windowSeconds,
-      };
-    }
-
-    // Increment count
-    entry.count++;
+    // rateLimitKey(), not string concatenation: an IP that itself contains the separator (every
+    // IPv6 address does) would otherwise straddle the ip/endpoint boundary and share a counter
+    // with a different caller.
+    const { count, resetIn } = await this.getStore().hit(rateLimitKey(ip, endpoint), this.config.windowSeconds);
 
-    const resetIn = Math.ceil((entry.resetTime - now) / 1000);
-    const allowed = entry.count <= limit;
-    const remaining = Math.max(0, limit - entry.count);
+    const allowed = count <= limit;
+    const remaining = Math.max(0, limit - count);
 
     if (!allowed) {
-      this.logger.warn(`Rate limit exceeded for IP ${this.maskIp(ip)} on ${endpoint}: ${entry.count}/${limit}`);
+      this.logger.warn(`Rate limit exceeded for IP ${this.maskIp(ip)} on ${endpoint}: ${count}/${limit}`);
     }
 
     return {
       allowed,
-      current: entry.count,
+      current: count,
       limit,
       remaining,
       resetIn,
@@ -202,39 +177,50 @@ export class LegacyAuthRateLimiter implements OnModuleInit {
    *
    * @param ip - Client IP address
    */
-  reset(ip: string): void {
-    for (const key of this.store.keys()) {
-      if (key.startsWith(`${ip}:`)) {
-        this.store.delete(key);
-      }
-    }
+  async reset(ip: string): Promise<void> {
+    await this.getStore().resetByPrefix(rateLimitKeyPrefix(ip));
   }
 
   /**
    * Clear all rate limit entries (useful for testing)
    */
-  clear(): void {
-    this.store.clear();
+  async clear(): Promise<void> {
+    await this.getStore().clear();
   }
 
   /**
    * Get statistics about the rate limiter
+   *
+   * `activeEntries` is `-1` when a Redis store is in use — the entry count is
+   * not cheaply known there.
    */
   getStats(): { activeEntries: number; enabled: boolean } {
     return {
-      activeEntries: this.store.size,
+      activeEntries: this.store?.size() ?? 0,
       enabled: this.config.enabled,
     };
   }
 
   /**
-   * Stop the cleanup interval (for graceful shutdown)
+   * Stop the in-memory cleanup interval (for graceful shutdown)
    */
   onModuleDestroy(): void {
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval);
-      this.cleanupInterval = null;
+    // Not `instanceof InMemoryRateLimitStore`: a RedisRateLimitStore owns an in-memory fallback
+    // whose cleanup interval would otherwise outlive the app.
+    this.store?.destroy?.();
+  }
+
+  /**
+   * Lazily select the counter store: Redis when configured and enabled,
+   * process-local otherwise.
+   */
+  protected getStore(): RateLimitStore {
+    if (!this.store) {
+      this.store = this.coreRedisService?.enabled
+        ? new RedisRateLimitStore(this.coreRedisService, 'legacy-auth')
+        : new InMemoryRateLimitStore();
     }
+    return this.store;
   }
 
   /**
@@ -250,34 +236,4 @@ export class LegacyAuthRateLimiter implements OnModuleInit {
     const parts = ip.split(':');
     return `${parts[0]}:****`;
   }
-
-  /**
-   * Start periodic cleanup of expired entries
-   */
-  private startCleanup(): void {
-    // Clean up every 5 minutes
-    this.cleanupInterval = setInterval(
-      () => {
-        const now = Date.now();
-        let cleaned = 0;
-
-        for (const [key, entry] of this.store.entries()) {
-          if (now >= entry.resetTime) {
-            this.store.delete(key);
-            cleaned++;
-          }
-        }
-
-        if (cleaned > 0) {
-          this.logger.debug(`Cleaned up ${cleaned} expired rate limit entries`);
-        }
-      },
-      5 * 60 * 1000,
-    );
-
-    // Prevent the interval from keeping the process alive
-    if (this.cleanupInterval.unref) {
-      this.cleanupInterval.unref();
-    }
-  }
 }

package/src/core/modules/better-auth/core-better-auth-email-verification.service.ts

@@ -1,4 +1,5 @@
 import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
+import { randomUUID } from 'node:crypto';
 import ejs = require('ejs');
 import * as fs from 'fs';
 import * as path from 'path';
@@ -7,6 +8,7 @@ import { maskEmail } from '../../common/helpers/logging.helper';
 import { IBetterAuthEmailVerificationConfig } from '../../common/interfaces/server-options.interface';
 import { BrevoService } from '../../common/services/brevo.service';
 import { ConfigService } from '../../common/services/config.service';
+import { CoreRedisService } from '../../common/services/core-redis.service';
 import { EmailService } from '../../common/services/email.service';
 import { TemplateService } from '../../common/services/template.service';
 import { formatProjectName } from './better-auth.config';
@@ -75,7 +77,6 @@ export interface SendVerificationEmailOptions {
  * @example
  * ```typescript
  * // Override to customize email sending
- * @Injectable()
  * export class MyEmailVerificationService extends CoreBetterAuthEmailVerificationService {
  *   override async sendVerificationEmail(options: SendVerificationEmailOptions): Promise<void> {
  *     // Custom logic before
@@ -87,6 +88,12 @@ export interface SendVerificationEmailOptions {
  *
  * @since 11.13.0
  */
+/**
+ * Sentinel returned when the slot was taken on the process-local path, where there is no Redis key
+ * to compare against. Distinguishes "acquired locally" from "acquired in Redis with this token".
+ */
+const LOCAL_SLOT_TOKEN = 'local';
+
 @Injectable()
 export class CoreBetterAuthEmailVerificationService {
   protected readonly logger = new Logger(CoreBetterAuthEmailVerificationService.name);
@@ -96,7 +103,12 @@ export class CoreBetterAuthEmailVerificationService {
    * In-memory tracking of last send time per email address for cooldown enforcement.
    * Key: email address (lowercase), Value: timestamp (ms) of last send
    */
-  private readonly lastSendTimes = new Map<string, number>();
+  protected readonly lastSendTimes = new Map<string, number>();
+
+  /**
+   * Pending cleanup timer per email, so a released slot can never expire a LATER cooldown
+   */
+  protected readonly sendTimers = new Map<string, NodeJS.Timeout>();
 
   /**
    * Token for optional BrevoService injection.
@@ -113,6 +125,7 @@ export class CoreBetterAuthEmailVerificationService {
     @Optional()
     @Inject(CoreBetterAuthEmailVerificationService.BREVO_SERVICE_TOKEN)
     protected readonly brevoService?: BrevoService | null,
+    @Optional() protected readonly coreRedisService?: CoreRedisService,
   ) {
     this.configure();
   }
@@ -157,94 +170,209 @@ export class CoreBetterAuthEmailVerificationService {
     const { token, user } = options;
     let { url } = options;
 
-    // Check resend cooldown per email address
-    if (this.isInCooldown(user.email)) {
+    // Reserve the cooldown slot per email address (atomic across replicas with Redis).
+    // `slotToken`, not `token` — `token` is already the verification token from the options.
+    const slotToken = await this.acquireSendSlot(user.email);
+    if (!slotToken) {
       this.logger.debug(`Resend cooldown active for ${this.maskEmail(user.email)}, skipping email send`);
       return;
     }
 
-    // Override URL if callbackURL is configured (frontend-based verification)
-    if (this.config.callbackURL) {
-      url = this.buildFrontendVerificationUrl(token);
-    }
+    // Only a SUCCESSFUL send may burn the cooldown — the slot is released again below otherwise
+    let sent = false;
 
-    // Log verification URL in non-production environments for debugging and test capture
-    // Uses console.log directly to ensure reliable capture in test environments (Vitest)
-    // NestJS Logger may buffer output which makes interception unreliable in tests
-    if (process.env.NODE_ENV !== 'production') {
-      // oxlint-disable-next-line no-console
-      console.log(`[EMAIL VERIFICATION] User: ${user.email}, URL: ${url}`);
-    }
+    try {
+      // Override URL if callbackURL is configured (frontend-based verification)
+      if (this.config.callbackURL) {
+        url = this.buildFrontendVerificationUrl(token);
+      }
+
+      // Log verification URL in non-production environments for debugging and test capture
+      // Uses console.log directly to ensure reliable capture in test environments (Vitest)
+      // NestJS Logger may buffer output which makes interception unreliable in tests
+      if (process.env.NODE_ENV !== 'production') {
+        // oxlint-disable-next-line no-console
+        console.log(`[EMAIL VERIFICATION] User: ${user.email}, URL: ${url}`);
+      }
+
+      // Brevo template path: send via Brevo transactional API if configured
+      if (this.config.brevoTemplateId && this.brevoService) {
+        try {
+          const appName = this.getAppName();
+          const result = await this.brevoService.sendMail(user.email, this.config.brevoTemplateId, {
+            appName,
+            expiresIn: this.formatExpiresIn(this.config.expiresIn),
+            link: url,
+            name: user.name || user.email.split('@')[0],
+          });
+
+          // `sendMail()` swallows SDK errors and resolves to `null` (unless `brevo.throwOnError` is
+          // set), so "did not throw" is NOT "was delivered". Recording a send here on a null would
+          // mark the address as mailed, log success, and skip the SMTP fallback below — leaving the
+          // user with no verification email at all on a Brevo outage or a revoked key.
+          if (result === null) {
+            this.logger.error(
+              `Brevo verification send failed for ${this.maskEmail(user.email)} — falling back to SMTP`,
+            );
+            // Deliberately no `return`: fall through to the EmailService path.
+          } else {
+            sent = true;
+            this.logger.debug(`Verification email sent via Brevo to ${this.maskEmail(user.email)}`);
+            return;
+          }
+        } catch (error) {
+          this.logger.error(
+            `Failed to send verification email via Brevo to ${this.maskEmail(user.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+          );
+          throw error;
+        }
+      }
+
+      if (!this.emailService) {
+        this.logger.warn('EmailService not available, cannot send verification email');
+        return;
+      }
 
-    // Brevo template path: send via Brevo transactional API if configured
-    if (this.config.brevoTemplateId && this.brevoService) {
       try {
+        const resolved = await this.resolveTemplatePath(this.config.template, this.config.locale);
         const appName = this.getAppName();
-        const result = await this.brevoService.sendMail(user.email, this.config.brevoTemplateId, {
+
+        const templateData = {
           appName,
           expiresIn: this.formatExpiresIn(this.config.expiresIn),
           link: url,
           name: user.name || user.email.split('@')[0],
-        });
-
-        // `sendMail()` swallows SDK errors and resolves to `null` (unless `brevo.throwOnError` is
-        // set), so "did not throw" is NOT "was delivered". Recording a send here on a null would
-        // mark the address as mailed, log success, and skip the SMTP fallback below — leaving the
-        // user with no verification email at all on a Brevo outage or a revoked key.
-        if (result === null) {
-          this.logger.error(`Brevo verification send failed for ${this.maskEmail(user.email)} — falling back to SMTP`);
-          // Deliberately no `return`: fall through to the EmailService path.
+        };
+
+        if (resolved.isAbsolute) {
+          // Fallback template from nest-server: render directly via EJS
+          const templateContent = fs.readFileSync(`${resolved.path}.ejs`, 'utf-8');
+          const html = ejs.render(templateContent, templateData);
+
+          await this.emailService.sendMail(user.email, this.getEmailSubject(appName), { html });
         } else {
-          this.trackSend(user.email);
-          this.logger.debug(`Verification email sent via Brevo to ${this.maskEmail(user.email)}`);
-          return;
+          // Project template: use TemplateService (relative path)
+          await this.emailService.sendMail(user.email, this.getEmailSubject(appName), {
+            htmlTemplate: resolved.path,
+            templateData,
+          });
         }
+
+        sent = true;
+        this.logger.debug(`Verification email sent to ${this.maskEmail(user.email)}`);
       } catch (error) {
         this.logger.error(
-          `Failed to send verification email via Brevo to ${this.maskEmail(user.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+          `Failed to send verification email to ${this.maskEmail(user.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
         );
         throw error;
       }
+    } finally {
+      if (!sent) {
+        await this.releaseSendSlot(user.email, slotToken);
+      }
     }
+  }
 
-    if (!this.emailService) {
-      this.logger.warn('EmailService not available, cannot send verification email');
-      return;
+  /**
+   * Reserve the resend-cooldown slot for an email address.
+   *
+   * With Redis configured this is a single atomic `SET NX PX`, so two replicas
+   * handling concurrent resend requests cannot both pass the cooldown. Without
+   * Redis it falls back to the process-local {@link isInCooldown}/{@link trackSend}.
+   *
+   * @returns a truthy slot token when the caller may send, `null` while the cooldown is active.
+   *   The token is what {@link releaseSendSlot} compares against before deleting the key, so a
+   *   release can only ever clear the slot IT acquired. A subclass overriding this and returning a
+   *   plain `true` still works — release then falls back to the previous unconditional delete.
+   */
+  protected async acquireSendSlot(email: string): Promise<null | string> {
+    const cooldown = this.config.resendCooldownSeconds;
+    if (cooldown <= 0) {
+      return LOCAL_SLOT_TOKEN;
     }
 
-    try {
-      const resolved = await this.resolveTemplatePath(this.config.template, this.config.locale);
-      const appName = this.getAppName();
-
-      const templateData = {
-        appName,
-        expiresIn: this.formatExpiresIn(this.config.expiresIn),
-        link: url,
-        name: user.name || user.email.split('@')[0],
-      };
-
-      if (resolved.isAbsolute) {
-        // Fallback template from nest-server: render directly via EJS
-        const templateContent = fs.readFileSync(`${resolved.path}.ejs`, 'utf-8');
-        const html = ejs.render(templateContent, templateData);
-
-        await this.emailService.sendMail(user.email, this.getEmailSubject(appName), { html });
-      } else {
-        // Project template: use TemplateService (relative path)
-        await this.emailService.sendMail(user.email, this.getEmailSubject(appName), {
-          htmlTemplate: resolved.path,
-          templateData,
-        });
+    if (this.coreRedisService?.enabled) {
+      try {
+        const token = randomUUID();
+        const result = await this.coreRedisService
+          .getClient()
+          .set(this.cooldownKey(email), token, 'PX', cooldown * 1000, 'NX');
+        return result === 'OK' ? token : null;
+      } catch (error) {
+        // Degrade to the process-local cooldown rather than failing closed. An unhandled error
+        // here reads as "cooldown active" and would stop verification mail entirely for the
+        // duration of a Redis blip — locking new users out of their accounts. The local counter
+        // is the pre-Redis behavior: still a real anti-flood bound, just per replica.
+        this.logger.warn(
+          `Redis cooldown unavailable, falling back to the per-replica counter: ${
+            error instanceof Error ? error.message : 'Unknown error'
+          }`,
+        );
       }
+    }
+
+    if (this.isInCooldown(email)) {
+      return null;
+    }
+    this.trackSend(email);
+    return LOCAL_SLOT_TOKEN;
+  }
 
-      this.trackSend(user.email);
-      this.logger.debug(`Verification email sent to ${this.maskEmail(user.email)}`);
-    } catch (error) {
-      this.logger.error(
-        `Failed to send verification email to ${this.maskEmail(user.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
-      );
-      throw error;
+  /**
+   * Release a slot reserved by {@link acquireSendSlot} — used when no email was
+   * actually sent, so a failed send does not burn the cooldown.
+   */
+  protected async releaseSendSlot(email: string, token?: null | string): Promise<void> {
+    if (this.config.resendCooldownSeconds <= 0) {
+      return;
+    }
+
+    if (this.coreRedisService?.enabled) {
+      // Releasing runs in a `finally` after a FAILED send. Letting a Redis error escape here
+      // would replace the real send failure with a connection error in the caller's log — and
+      // the key expires on its own TTL anyway, so the worst case is one cooldown served out.
+      // Compare-and-delete, never a bare DEL. Releasing runs in a `finally` after a FAILED send,
+      // and a send can fail SLOWER than the cooldown (an SMTP socket timeout outlives a 60s
+      // window comfortably). By then our key has expired and a later request holds a new one — an
+      // unconditional delete would clear THAT request's cooldown, and repeating the trick floods
+      // a chosen address with valid verification links. Same pattern as the migration lock and
+      // the TUS locker.
+      if (typeof token === 'string' && token !== LOCAL_SLOT_TOKEN) {
+        const script = `if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) end return 0`;
+        await this.coreRedisService
+          .getClient()
+          .eval(script, 1, this.cooldownKey(email), token)
+          .catch(() => undefined);
+      } else if (token === undefined) {
+        // No token supplied (a subclass acquired the slot the old way) — preserve the previous
+        // behavior rather than silently skipping the release.
+        await this.coreRedisService
+          .getClient()
+          .del(this.cooldownKey(email))
+          .catch(() => undefined);
+      }
+      // Deliberately NOT `return`: when acquire fell back to the local counter because Redis
+      // errored, the Redis key was never written and only the local entry exists. Branching on
+      // `enabled` alone would leave it in place, so the failed send would burn the cooldown —
+      // the exact semantics the acquire/release split exists to preserve. Clearing both is
+      // harmless: the local map is empty whenever Redis actually served the acquire.
     }
+
+    // Clear the pending cleanup timer too. Left running, it would fire `cooldown` seconds
+    // after the FAILED send and delete whatever entry exists then — which is the entry of a
+    // later, successful send. The cooldown would end early and the anti-flood control it
+    // exists to be would quietly weaken.
+    const key = email.toLowerCase();
+    clearTimeout(this.sendTimers.get(key));
+    this.sendTimers.delete(key);
+    this.lastSendTimes.delete(key);
+  }
+
+  /**
+   * Redis key for the resend cooldown of an email address
+   */
+  protected cooldownKey(email: string): string {
+    return this.coreRedisService!.key('email-verification-cooldown', email.toLowerCase());
   }
 
   /**
@@ -451,10 +579,18 @@ export class CoreBetterAuthEmailVerificationService {
 
     this.lastSendTimes.set(key, Date.now());
 
-    // Schedule cleanup to prevent memory leak
+    // Schedule cleanup to prevent memory leak. Any timer left over from an earlier,
+    // RELEASED send is cancelled first — it would otherwise delete THIS entry when it
+    // fires and end the new cooldown early.
     const cooldown = this.config.resendCooldownSeconds;
     if (cooldown > 0) {
-      setTimeout(() => this.lastSendTimes.delete(key), cooldown * 1000);
+      clearTimeout(this.sendTimers.get(key));
+      const timer = setTimeout(() => {
+        this.lastSendTimes.delete(key);
+        this.sendTimers.delete(key);
+      }, cooldown * 1000);
+      timer.unref?.();
+      this.sendTimers.set(key, timer);
     }
   }
 

package/src/core/modules/better-auth/core-better-auth-rate-limit.middleware.ts

@@ -36,7 +36,7 @@ export class CoreBetterAuthRateLimitMiddleware implements NestMiddleware {
     private readonly betterAuthService: CoreBetterAuthService,
   ) {}
 
-  use(req: Request, res: Response, next: NextFunction) {
+  async use(req: Request, res: Response, next: NextFunction) {
     // Skip if Better-Auth is not enabled
     if (!this.betterAuthService.isEnabled()) {
       return next();
@@ -55,7 +55,7 @@ export class CoreBetterAuthRateLimitMiddleware implements NestMiddleware {
     const path = req.path.startsWith(basePath) ? req.path.substring(basePath.length) : req.path;
 
     // Check rate limit
-    const result = this.rateLimiter.check(ip, path);
+    const result = await this.rateLimiter.check(ip, path);
 
     // Add rate limit headers
     this.addRateLimitHeaders(res, result);
@@ -77,24 +77,17 @@ export class CoreBetterAuthRateLimitMiddleware implements NestMiddleware {
   }
 
   /**
-   * Extract client IP address from request
-   * Handles proxied requests via X-Forwarded-For header
+   * Get the client IP that the rate limit counter is keyed on.
+   *
+   * `req.ip` — NOT `x-forwarded-for` directly. Express derives `req.ip` from the forwarded chain
+   * only as far as the app's `trust proxy` setting allows, and falls back to the socket address
+   * otherwise. Reading the header ourselves skips that check entirely, so any client simply picks
+   * its own bucket by sending a fresh value per request: the counter never reaches the limit, and
+   * the brute-force protection on the auth endpoints is off. A deployment behind a proxy must
+   * therefore configure `trust proxy` — that is the one place where "which hop do I believe"
+   * belongs.
    */
   private getClientIp(req: Request): string {
-    // Check X-Forwarded-For header (for proxied requests)
-    const forwardedFor = req.headers['x-forwarded-for'];
-    if (forwardedFor) {
-      const ips = Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor.split(',')[0];
-      return ips.trim();
-    }
-
-    // Check X-Real-IP header (nginx)
-    const realIp = req.headers['x-real-ip'];
-    if (realIp) {
-      return Array.isArray(realIp) ? realIp[0] : realIp;
-    }
-
-    // Fall back to connection remote address
     return req.ip || req.socket?.remoteAddress || 'unknown';
   }