@open-mercato/onboarding 0.6.6-develop.6429.1.2fba7258d1 → 0.6.6-develop.6450.1.b493fb430c

package/dist/modules/onboarding/lib/consentClientIp.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/onboarding/lib/consentClientIp.ts"],
-  "sourcesContent": ["import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\n\n/**\n * Resolve the client IP to persist on a legal-consent record, honoring the\n * deployment-wide reverse-proxy trust depth (`RATE_LIMIT_TRUST_PROXY_DEPTH`)\n * exposed by the rate limiter service instead of a hardcoded depth. When the\n * trust depth is unknown, return null so a spoofable `X-Forwarded-For` value is\n * never signed into the consent integrity hash.\n */\nexport function resolveConsentClientIp(req: Request): string | null {\n  const rateLimiterService = getCachedRateLimiterService()\n  if (!rateLimiterService) return null\n  return getClientIp(req, rateLimiterService.trustProxyDepth) ?? null\n}\n"],
+  "sourcesContent": ["import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\n\n/**\n * Resolve the client IP to persist on a legal-consent record, honoring the\n * deployment-wide reverse-proxy trust depth (`RATE_LIMIT_TRUST_PROXY_DEPTH`)\n * exposed by the rate limiter service instead of a hardcoded depth. When the\n * trust depth is unknown, return null so spoofable proxy headers are never\n * signed into the consent integrity hash.\n */\nexport function resolveConsentClientIp(req: Request): string | null {\n  const rateLimiterService = getCachedRateLimiterService()\n  if (!rateLimiterService) return null\n  return getClientIp(req, rateLimiterService.trustProxyDepth) ?? null\n}\n"],
   "mappings": "AAAA,SAAS,mCAAmC;AAC5C,SAAS,mBAAmB;AASrB,SAAS,uBAAuB,KAA6B;AAClE,QAAM,qBAAqB,4BAA4B;AACvD,MAAI,CAAC,mBAAoB,QAAO;AAChC,SAAO,YAAY,KAAK,mBAAmB,eAAe,KAAK;AACjE;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.6-develop.6429.1.2fba7258d1",
+  "version": "0.6.6-develop.6450.1.b493fb430c",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,10 +70,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.6-develop.6429.1.2fba7258d1"
+    "@open-mercato/shared": "0.6.6-develop.6450.1.b493fb430c"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.6-develop.6429.1.2fba7258d1",
+    "@open-mercato/shared": "0.6.6-develop.6450.1.b493fb430c",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",

package/src/__tests__/consentClientIp.test.ts

@@ -33,10 +33,10 @@ describe('resolveConsentClientIp', () => {
     expect(resolveConsentClientIp(req)).toBe('edge')
   })
 
-  it('falls back to X-Real-IP when X-Forwarded-For is untrusted', () => {
+  it('ignores X-Real-IP when no proxy is trusted', () => {
     getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 0 })
     const req = makeRequest({ 'x-forwarded-for': '6.6.6.6', 'x-real-ip': '10.0.0.5' })
-    expect(resolveConsentClientIp(req)).toBe('10.0.0.5')
+    expect(resolveConsentClientIp(req)).toBeNull()
   })
 
   it('returns null when the rate limiter service is unavailable', () => {

package/src/modules/onboarding/lib/consentClientIp.ts

@@ -5,8 +5,8 @@ import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
  * Resolve the client IP to persist on a legal-consent record, honoring the
  * deployment-wide reverse-proxy trust depth (`RATE_LIMIT_TRUST_PROXY_DEPTH`)
  * exposed by the rate limiter service instead of a hardcoded depth. When the
- * trust depth is unknown, return null so a spoofable `X-Forwarded-For` value is
- * never signed into the consent integrity hash.
+ * trust depth is unknown, return null so spoofable proxy headers are never
+ * signed into the consent integrity hash.
  */
 export function resolveConsentClientIp(req: Request): string | null {
   const rateLimiterService = getCachedRateLimiterService()