@podosoft/podokit 1.4.1 → 1.5.0

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { AccessPolicy, type RequestIdentity } from "../core/services";
+import { AccessPolicy, ResolvedSessions, type RequestIdentity, type ResolvedSession } from "../core/services";
 import type { SettingsService } from "../settings/settings.service";
 import {
   AuthService,
@@ -21,7 +21,7 @@ function session(
 }
 
 function identityFor(resolver: SessionResolver): RequestIdentity {
-  return createRequestIdentity(new AuthService(settings(false), new AccessPolicy(), resolver));
+  return createRequestIdentity(new AuthService(settings(false), new AccessPolicy(), { resolveSession: resolver }));
 }
 
 describe("AuthService", () => {
@@ -33,12 +33,12 @@ describe("AuthService", () => {
   test("keeps explicitly public routes unauthenticated", async () => {
     const policy = new AccessPolicy();
     policy.register("GET", "/public", "public");
-    const service = new AuthService(settings(false), policy, async () => null);
+    const service = new AuthService(settings(false), policy, { resolveSession: async () => null });
     await expect(service.guard(new Request("http://localhost/public"))).resolves.toBeUndefined();
   });
 
   test("requires a session by default", async () => {
-    const service = new AuthService(settings(false), new AccessPolicy(), async () => null);
+    const service = new AuthService(settings(false), new AccessPolicy(), { resolveSession: async () => null });
     const result = service.guard(new Request("http://localhost/private"));
     await expect(result).rejects.toMatchObject({ code: "AUTH_REQUIRED", statusCode: 401 });
   });
@@ -47,7 +47,7 @@ describe("AuthService", () => {
     const service = new AuthService(
       settings(true),
       new AccessPolicy(),
-      async () => session({ twoFactorEnabled: false }),
+      { resolveSession: async () => session({ twoFactorEnabled: false }) },
     );
     const result = service.guard(new Request("http://localhost/private"));
     await expect(result).rejects.toMatchObject({ code: "TWO_FACTOR_REQUIRED", statusCode: 403 });
@@ -57,13 +57,61 @@ describe("AuthService", () => {
     const service = new AuthService(
       settings(false),
       new AccessPolicy(),
-      async () => session({ role: "user" }),
+      { resolveSession: async () => session({ role: "user" }) },
     );
     await expect(service.requireAdmin(new Request("http://localhost/account/settings")))
       .rejects.toMatchObject({ code: "ADMIN_REQUIRED", statusCode: 403 });
   });
 });
 
+describe("AuthService resolved sessions", () => {
+  const expiresAt = new Date("2030-01-02T03:04:05.000Z");
+
+  function reporting(resolver: SessionResolver): { service: AuthService; reported: ResolvedSession[] } {
+    const resolvedSessions = new ResolvedSessions();
+    const reported: ResolvedSession[] = [];
+    resolvedSessions.listen((resolved) => reported.push(resolved));
+    return {
+      service: new AuthService(settings(false), new AccessPolicy(), { resolveSession: resolver, resolvedSessions }),
+      reported,
+    };
+  }
+
+  test("reports each resolved session once per request, before callers continue", async () => {
+    const resolver = mock(async () => session({}, { token: "session-token", expiresAt }));
+    const { service, reported } = reporting(resolver);
+    const request = new Request("http://localhost/private");
+
+    await service.requireSession(request);
+    expect(reported).toEqual([{ token: "session-token", userId: "user-1", expiresAt }]);
+    await service.session(request);
+    expect(resolver).toHaveBeenCalledTimes(1);
+    expect(reported).toHaveLength(1);
+
+    // A serialized expiry is accepted too.
+    const serialized = reporting(async () => session({}, { token: "t2", expiresAt: expiresAt.toISOString() }));
+    await serialized.service.session(new Request("http://localhost/private"));
+    expect(serialized.reported).toEqual([{ token: "t2", userId: "user-1", expiresAt }]);
+  });
+
+  test("reports nothing without a session, a token, or a valid expiry, and keeps lookup errors", async () => {
+    for (const resolver of [
+      async () => null,
+      async () => session({}, { expiresAt }),
+      async () => session({}, { token: "session-token", expiresAt: "soon" }),
+    ]) {
+      const { service, reported } = reporting(resolver);
+      await service.session(new Request("http://localhost/private"));
+      expect(reported).toEqual([]);
+    }
+    const failing = reporting(async () => {
+      throw new Error("database down");
+    });
+    await expect(failing.service.session(new Request("http://localhost/private"))).rejects.toThrow("database down");
+    expect(failing.reported).toEqual([]);
+  });
+});
+
 describe("createRequestIdentity", () => {
   const request = (): Request => new Request("http://localhost/events");
 

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.ts

@@ -1,5 +1,5 @@
 import { AppException } from "@podosoft/podokit-contracts";
-import type { AccessPolicy, RequestIdentity } from "../core/services";
+import type { AccessPolicy, RequestIdentity, ResolvedSessions } from "../core/services";
 import type { SettingsService } from "../settings/settings.service";
 import { getAuth, refreshForRequest } from "./auth-provider";
 import { rethrowAuthError } from "./database-outage";
@@ -37,19 +37,34 @@ function activeOrganizationOf(session: AuthSession): string | undefined {
   return typeof value === "string" && value !== "" ? value : undefined;
 }
 
+export interface AuthServiceOptions {
+  /** Looks a request's session up; Better Auth's getSession by default. */
+  resolveSession?: SessionResolver;
+  /** Receives every session this service resolves, such as for the rate limiter. */
+  resolvedSessions?: ResolvedSessions;
+}
+
 export class AuthService {
   private readonly sessions = new WeakMap<Request, Promise<AuthSession | null>>();
+  private readonly resolveSession: SessionResolver;
+  private readonly resolvedSessions: ResolvedSessions | undefined;
 
   constructor(
     private readonly settings: SettingsService,
     private readonly accessPolicy: AccessPolicy,
-    private readonly resolveSession: SessionResolver = defaultSessionResolver,
-  ) {}
+    options: AuthServiceOptions = {},
+  ) {
+    this.resolveSession = options.resolveSession ?? defaultSessionResolver;
+    this.resolvedSessions = options.resolvedSessions;
+  }
 
   session(request: Request): Promise<AuthSession | null> {
     const cached = this.sessions.get(request);
     if (cached) return cached;
-    const result = this.resolveSession(request.headers);
+    const result = this.resolveSession(request.headers).then((session) => {
+      if (session) this.report(session);
+      return session;
+    });
     this.sessions.set(request, result);
     return result;
   }
@@ -84,6 +99,13 @@ export class AuthService {
   async close(): Promise<void> {
     await closeAuthDatabase();
   }
+
+  private report(session: AuthSession): void {
+    const { token, expiresAt } = session.session;
+    const expires = expiresAt instanceof Date ? expiresAt : new Date(String(expiresAt));
+    if (!this.resolvedSessions || typeof token !== "string" || Number.isNaN(expires.getTime())) return;
+    this.resolvedSessions.report({ token, userId: session.user.id, expiresAt: expires });
+  }
 }
 
 /** Answers identity questions for other modules from the one session lookup memoized per request. */

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -3,7 +3,7 @@ import { APIError } from "better-auth/api";
 import { twoFactor, haveIBeenPwned, magicLink, emailOTP, username, multiSession, phoneNumber, organization, jwt, bearer, openAPI } from "better-auth/plugins";
 import { actionEmail, sendMail } from "../mail/mailer";
 import { sendSms } from "../sms/sms";
-import { assertUserCreationAllowed, createFeatureGate, readSignupOpen } from "./feature-gate";
+import { assertUserCreationAllowed, createFeatureGate, featureGatePlugin, readSignupOpen, type FeatureGateSettings } from "./feature-gate";
 import { featureFlags, isSignupOpen } from "./auth-config-store";
 import { orgAc, orgRoles } from "./org-permissions";
 import { authDatabase } from "./db";
@@ -15,6 +15,8 @@ import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-contracts";
 import { runUserDeletedHandlers } from "./user-delete-handlers";
 import { authBaseUrl, authSecret } from "./auth-environment";
 import { isMaintenanceCommand } from "./maintenance";
+import { CLIENT_ADDRESS_HEADER } from "../core/client-address";
+import { revokeEveryOtherSession } from "./revoke-other-sessions";
 // podokit:begin:auth-imports
 // podokit:end:auth-imports
 
@@ -48,7 +50,15 @@ function buildSocial(config: AuthConfig): NonNullable<BetterAuthOptions["socialP
 // server-enforced toggles) apply without a restart. Everything below the injection
 // markers is contributed by other PodoKit modules (admin-dashboard, audit-log).
 export function buildAuth(config: AuthConfig) {
+  // The feature gate reads the process-wide settings snapshot, so a rebuild does
+  // not start a new cache.
+  const gateSettings: FeatureGateSettings = { flags: featureFlags, signupOpen: isSignupOpen };
   const plugins: BetterAuthPlugin[] = [
+    // First, so a disabled feature answers 404 before another plugin's onRequest
+    // (such as the OIDC provider's discovery metadata) can answer.
+    featureGatePlugin(gateSettings),
+    // "Sign out other sessions" revokes every other session, not only the first 100.
+    revokeEveryOtherSession(),
     twoFactor(),
     magicLink({
       sendMagicLink: async ({ email, url }: { email: string; url: string; token: string }) => {
@@ -179,11 +189,11 @@ export function buildAuth(config: AuthConfig) {
   };
 
   // Request-time hooks. The feature gate turns the admin Settings toggles into a
-  // real server boundary (disabled features 404). It reads the process-wide
-  // settings snapshot, so a rebuild does not start a new cache. Other PodoKit
-  // modules add their own hooks below the marker.
+  // real server boundary (disabled features 404) for endpoint calls, including
+  // in-process auth.api calls the plugin above never sees. Other PodoKit modules
+  // add their own hooks below the marker.
   const hooks: NonNullable<BetterAuthOptions["hooks"]> = {
-    before: createFeatureGate({ flags: featureFlags, signupOpen: isSignupOpen }),
+    before: createFeatureGate(gateSettings),
   };
   // podokit:begin:auth-hooks
   // podokit:end:auth-hooks
@@ -229,9 +239,10 @@ export function buildAuth(config: AuthConfig) {
     baseURL: authBaseUrl(),
     advanced: {
       ipAddress: {
-        // The API sits behind the SvelteKit server proxy, which forwards the
-        // resolved client IP as x-forwarded-for; trust it so sessions record an IP.
-        ipAddressHeaders: ["x-forwarded-for"],
+        // The address the API resolved behind its trusted proxies, which it sets
+        // on every request, so sessions and Better Auth's own rate limits use the
+        // same client address as the rest of the API.
+        ipAddressHeaders: [CLIENT_ADDRESS_HEADER],
       },
       ...(isMaintenanceCommand() ? { database: { validateSchema: false } } : {}),
     },

package/dist/templates/modules/auth/files/apps/api/src/auth/feature-gate.spec.ts

@@ -1,7 +1,14 @@
 import { describe, expect, test } from "bun:test";
+import { oauthProvider } from "@better-auth/oauth-provider";
+import { betterAuth } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+import { jwt } from "better-auth/plugins";
 import { FLAG_DEFAULTS, flagsFrom } from "../settings/flag-defaults";
 import {
+  authRequestPath,
   enforceFeatureGate,
+  featureForPath,
+  featureGatePlugin,
   PUBLIC_SIGNUP_DISABLED,
   signupOpenFrom,
   type FeatureFlags,
@@ -56,3 +63,79 @@ describe("feature gate", () => {
     expect(signupOpenFrom(new Map())).toBe(true);
   });
 });
+
+describe("OIDC provider gate", () => {
+  test("covers the provider's endpoints but not the jwt plugin's", () => {
+    for (const path of [
+      "/oauth2/authorize",
+      "/oauth2/token",
+      "/oauth2/userinfo",
+      "/oauth2/register",
+      "/oauth2/consent",
+      "/oauth2/create-client",
+      "/oauth2/end-session",
+      "/admin/oauth2/create-client",
+      "/.well-known/openid-configuration",
+      "/.well-known/oauth-authorization-server",
+      "/.well-known/oauth-authorization-server/api/auth",
+    ]) {
+      expect(featureForPath(path)).toBe("oidcProvider");
+    }
+    for (const path of ["/jwks", "/token", "/get-session", "/sign-in/email"]) {
+      expect(featureForPath(path)).toBeUndefined();
+    }
+  });
+
+  test("resolves request paths against the auth base URL", () => {
+    const base = "http://localhost:5002/api/auth";
+    expect(authRequestPath("http://localhost:5002/api/auth/oauth2/authorize?client_id=x", base))
+      .toBe("/oauth2/authorize");
+    expect(authRequestPath("http://localhost:5002/api/auth/.well-known/openid-configuration", `${base}/`))
+      .toBe("/.well-known/openid-configuration");
+    expect(authRequestPath("http://localhost:5002/.well-known/oauth-authorization-server/api/auth", base))
+      .toBe("/.well-known/oauth-authorization-server/api/auth");
+    expect(authRequestPath("http://localhost:5002/api/authority/oauth2/token", base))
+      .toBe("/api/authority/oauth2/token");
+  });
+
+  test("answers the provider's discovery with 404 while it is disabled and serves it once enabled", async () => {
+    let enabled = false;
+    const auth = betterAuth({
+      database: memoryAdapter({ jwks: [] }),
+      baseURL: "http://localhost:5002",
+      secret: "feature-gate-spec-secret-0123456789abcdef",
+      logger: { disabled: true },
+      plugins: [
+        featureGatePlugin({
+          flags: async () => ({ ...FLAG_DEFAULTS, oidcProvider: enabled }),
+          signupOpen: async () => true,
+        }),
+        jwt(),
+        // Serves the discovery metadata from its own onRequest hook.
+        oauthProvider({ loginPage: "/login", consentPage: "/oauth2/consent" }),
+      ],
+    });
+    const request = (path: string): Promise<Response> =>
+      auth.handler(new Request(`http://localhost:5002${path}`));
+    const discovery = [
+      "/api/auth/.well-known/openid-configuration",
+      "/api/auth/.well-known/oauth-authorization-server",
+      "/.well-known/oauth-authorization-server/api/auth",
+    ];
+
+    for (const path of discovery) {
+      const response = await request(path);
+      expect(response.status).toBe(404);
+      expect(await response.json()).toEqual({ message: "This feature is disabled." });
+    }
+    expect((await request("/api/auth/oauth2/authorize?client_id=probe")).status).toBe(404);
+    expect((await request("/api/auth/jwks")).status).toBe(200);
+
+    enabled = true;
+    for (const path of discovery) {
+      const response = await request(path);
+      expect(response.status).toBe(200);
+      expect((await response.json()).issuer).toBe("http://localhost:5002/api/auth");
+    }
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/auth/feature-gate.ts

@@ -1,10 +1,13 @@
+import type { BetterAuthPlugin } from "better-auth";
 import { APIError, createAuthMiddleware } from "better-auth/api";
 import { FLAG_DEFAULTS, type FeatureFlag } from "../settings/flag-defaults";
 
 export const PUBLIC_SIGNUP_DISABLED = "PUBLIC_SIGNUP_DISABLED" as const;
 
 /** Auth-relative path prefixes owned by each admin-toggleable feature. A path is
- *  gated when it equals a prefix or starts with a prefix ending in "/". */
+ *  gated when it starts with one of its feature's prefixes. The OIDC provider's
+ *  JWKS (`/jwks`) and session JWT (`/token`) belong to the always-on `jwt`
+ *  plugin, so they stay available while the provider is off. */
 const FEATURE_PATHS: Array<{ flag: FeatureFlag; prefixes: string[] }> = [
   { flag: "twoFactor", prefixes: ["/two-factor/"] },
   { flag: "magicLink", prefixes: ["/sign-in/magic-link", "/magic-link/"] },
@@ -15,9 +18,37 @@ const FEATURE_PATHS: Array<{ flag: FeatureFlag; prefixes: string[] }> = [
   { flag: "apiKey", prefixes: ["/api-key/"] },
   { flag: "passkey", prefixes: ["/passkey/", "/sign-in/passkey"] },
   { flag: "organization", prefixes: ["/organization"] },
-  { flag: "oidcProvider", prefixes: ["/oauth2/", "/.well-known/openid-configuration", "/.well-known/oauth-authorization-server", "/.well-known/oauth-protected-resource"] },
+  {
+    flag: "oidcProvider",
+    prefixes: [
+      "/oauth2/",
+      "/admin/oauth2/",
+      "/.well-known/openid-configuration",
+      // Also matches the RFC 8414 form outside the base path,
+      // /.well-known/oauth-authorization-server/api/auth.
+      "/.well-known/oauth-authorization-server",
+      "/.well-known/oauth-protected-resource",
+    ],
+  },
 ];
 
+/** The admin-toggleable feature that owns an auth-relative path, if any. */
+export function featureForPath(path: string): FeatureFlag | undefined {
+  return FEATURE_PATHS.find((f) => f.prefixes.some((p) => path.startsWith(p)))?.flag;
+}
+
+/** A request's path relative to Better Auth's base URL. A path outside the base
+ *  path is returned whole. */
+export function authRequestPath(requestUrl: string, baseURL: string): string {
+  const pathname = new URL(requestUrl).pathname;
+  const basePath = new URL(baseURL).pathname.replace(/\/+$/, "");
+  return basePath && pathname.startsWith(`${basePath}/`) ? pathname.slice(basePath.length) : pathname;
+}
+
+function featureDisabled(): APIError {
+  return new APIError("NOT_FOUND", { message: "This feature is disabled." });
+}
+
 export type FeatureFlags = Record<FeatureFlag, boolean>;
 
 /** Live settings the gate reads per request, normally the shared settings snapshot. */
@@ -75,12 +106,9 @@ export async function enforceFeatureGate(path: string, settings: FeatureGateSett
     assertUserCreationAllowed(await readSignupOpen(settings.signupOpen), path);
     return;
   }
-  const feature = FEATURE_PATHS.find((f) =>
-    f.prefixes.some((p) => path === p || path.startsWith(p)),
-  );
+  const feature = featureForPath(path);
   if (!feature) return;
-  const enabled = (await readFeatureFlags(settings.flags))[feature.flag];
-  if (!enabled) throw new APIError("NOT_FOUND", { message: "This feature is disabled." });
+  if (!(await readFeatureFlags(settings.flags))[feature]) throw featureDisabled();
 }
 
 /** Better Auth middleware over {@link enforceFeatureGate}. The settings come from
@@ -91,3 +119,19 @@ export function createFeatureGate(settings: FeatureGateSettings): ReturnType<typ
     await enforceFeatureGate(ctx.path, settings);
   });
 }
+
+/** Rejects HTTP requests to a disabled feature before any plugin's `onRequest`
+ *  runs. `hooks.before` alone is not enough: the OAuth provider answers its
+ *  discovery metadata from `onRequest`, which Better Auth runs before endpoint
+ *  hooks. Register this plugin ahead of every other plugin. */
+export function featureGatePlugin(settings: FeatureGateSettings): BetterAuthPlugin {
+  return {
+    id: "podokit-feature-gate",
+    onRequest: async (request, ctx) => {
+      const feature = featureForPath(authRequestPath(request.url, ctx.baseURL));
+      if (!feature || (await readFeatureFlags(settings.flags))[feature]) return undefined;
+      const error = featureDisabled();
+      return { response: Response.json(error.body, { status: error.statusCode }) };
+    },
+  };
+}

package/dist/templates/modules/auth/files/apps/api/src/auth/revoke-other-sessions.spec.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+import { betterAuth, type BetterAuthPlugin } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+import { revokeEveryOtherSession } from "./revoke-other-sessions";
+
+type Row = Record<string, unknown>;
+
+// A user signed in once more than Better Auth's default findMany limit of 100
+// sessions per list allows, plus the 50 extra the endpoint used to leave behind.
+const EXTRA_SESSIONS = 150;
+
+async function signedInWithManySessions(plugins: BetterAuthPlugin[]): Promise<{
+  revokeOthers: () => Promise<unknown>;
+  sessions: () => Row[];
+  currentToken: string;
+}> {
+  const db: Record<string, Row[]> = { user: [], session: [], account: [], verification: [] };
+  const auth = betterAuth({
+    database: memoryAdapter(db),
+    secret: "revoke-other-sessions-test-secret-0123456789",
+    baseURL: "http://localhost:5002",
+    emailAndPassword: { enabled: true },
+    plugins,
+  });
+  const response = await auth.api.signUpEmail({
+    body: { email: "many@example.com", password: "Podokit3e-Str0ng!pw", name: "Many" },
+    asResponse: true,
+  });
+  const cookie = response.headers.getSetCookie().map((value) => value.split(";")[0]).join("; ");
+  const context = await auth.$context;
+  const userId = String(db.user[0]?.id);
+  for (let index = 0; index < EXTRA_SESSIONS; index += 1) {
+    await context.internalAdapter.createSession(userId);
+  }
+  const currentToken = String((await auth.api.getSession({ headers: new Headers({ cookie }) }))?.session.token);
+  return {
+    revokeOthers: () => auth.api.revokeOtherSessions({ headers: new Headers({ cookie }) }),
+    sessions: () => db.session ?? [],
+    currentToken,
+  };
+}
+
+describe("revokeEveryOtherSession", () => {
+  test("Better Auth alone revokes only the first 100 other sessions", async () => {
+    const user = await signedInWithManySessions([]);
+    expect(user.sessions()).toHaveLength(EXTRA_SESSIONS + 1);
+    await user.revokeOthers();
+    expect(user.sessions().length).toBeGreaterThan(1);
+  });
+
+  test("revokes every other session and keeps the current one", async () => {
+    const user = await signedInWithManySessions([revokeEveryOtherSession()]);
+    await user.revokeOthers();
+    expect(user.sessions().map((session) => session.token)).toEqual([user.currentToken]);
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/auth/revoke-other-sessions.ts

@@ -0,0 +1,45 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { createAuthMiddleware } from "better-auth/api";
+
+/** Sessions read and revoked per pass. */
+const BATCH_SIZE = 500;
+
+/**
+ * Makes `/revoke-other-sessions` revoke every other session of the user.
+ * Better Auth's endpoint lists the sessions through the adapter's default
+ * findMany limit of 100 and revokes only those, so a user with more sessions
+ * kept the rest after "sign out other sessions". This hook runs after the
+ * endpoint and revokes the remainder in batches through the internal adapter,
+ * which also clears their secondary-storage entries when one is configured.
+ */
+export function revokeEveryOtherSession(): BetterAuthPlugin {
+  return {
+    id: "podokit-revoke-every-other-session",
+    hooks: {
+      after: [
+        {
+          matcher: (context) => context.path === "/revoke-other-sessions",
+          handler: createAuthMiddleware(async (ctx) => {
+            const current = ctx.context.session;
+            if (!current) return;
+            let first: string | undefined;
+            for (;;) {
+              const others = await ctx.context.adapter.findMany<{ token: string }>({
+                model: "session",
+                where: [
+                  { field: "userId", value: current.user.id },
+                  { field: "token", value: current.session.token, operator: "ne" },
+                ],
+                limit: BATCH_SIZE,
+              });
+              // Stop when nothing is left, or when a pass removed nothing.
+              if (others.length === 0 || others[0]?.token === first) return;
+              first = others[0]?.token;
+              await ctx.context.internalAdapter.deleteSessions(others.map((session) => session.token));
+            }
+          }),
+        },
+      ],
+    },
+  };
+}

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.config.spec.ts

@@ -1,12 +1,8 @@
 import { describe, expect, test } from "bun:test";
-import {
-  clientAddressFromProxy,
-  rateLimitConfig,
-  sessionSigningSecret,
-} from "./rate-limit.config";
+import { rateLimitConfig, sessionSigningSecret } from "./rate-limit.config";
 
 describe("rate limit configuration", () => {
-  test("validates route limits and proxy settings", () => {
+  test("validates route limits", () => {
     expect(
       rateLimitConfig({
         RATE_LIMIT_KEY_PREFIX: "podokit:tenant-a:rate-limit",
@@ -15,8 +11,6 @@ describe("rate limit configuration", () => {
         RATE_LIMIT_AUTH_TTL: "45",
         RATE_LIMIT_AUTH_MAX: "15",
         RATE_LIMIT_RUNTIME_MAX: "900",
-        RATE_LIMIT_TRUSTED_PROXY_HOPS: "2",
-        RATE_LIMIT_PROXY_HEADER: "X-Real-IP",
         RATE_LIMIT_STORAGE_TIMEOUT_MS: "750",
         RATE_LIMIT_UNAVAILABLE_RETRY_AFTER: "3",
       }),
@@ -27,69 +21,18 @@ describe("rate limit configuration", () => {
       authTtlSeconds: 45,
       authLimit: 15,
       runtimeLimit: 900,
-      trustedProxyHops: 2,
-      proxyHeader: "x-real-ip",
       storageTimeoutMs: 750,
       unavailableRetryAfterSeconds: 3,
     });
     expect(() => rateLimitConfig({ RATE_LIMIT_MAX: "0" })).toThrow(
       "RATE_LIMIT_MAX must be a positive integer",
     );
-    expect(() =>
-      rateLimitConfig({ RATE_LIMIT_TRUSTED_PROXY_HOPS: "-1" }),
-    ).toThrow("must be a non-negative integer");
-    expect(() =>
-      rateLimitConfig({ RATE_LIMIT_PROXY_HEADER: "invalid header" }),
-    ).toThrow("must be a valid HTTP header name");
     expect(() => rateLimitConfig({ RATE_LIMIT_KEY_PREFIX: "invalid prefix!" })).toThrow(
       "RATE_LIMIT_KEY_PREFIX must be 1-128 characters",
     );
     expect(rateLimitConfig({}).keyPrefix).toBe("podokit:rate-limit");
   });
 
-  test("selects only the address outside the configured trusted proxy depth", () => {
-    const headers = {
-      "x-forwarded-for": "203.0.113.7, 198.51.100.8",
-    };
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 2,
-      }),
-    ).toBe("203.0.113.7");
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 1,
-      }),
-    ).toBe("198.51.100.8");
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 0,
-      }),
-    ).toBe("10.0.0.9");
-  });
-
-  test("ignores malformed or incomplete forwarded chains", () => {
-    expect(
-      clientAddressFromProxy(
-        { "x-forwarded-for": "attacker-controlled" },
-        "::ffff:10.0.0.9",
-        {
-          proxyHeader: "x-forwarded-for",
-          trustedProxyHops: 1,
-        },
-      ),
-    ).toBe("10.0.0.9");
-    expect(
-      clientAddressFromProxy({}, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 1,
-      }),
-    ).toBe("10.0.0.9");
-  });
-
   test("reads the session signing secret the way the auth module does", () => {
     expect(
       sessionSigningSecret({ BETTER_AUTH_SECRET: "  session-secret-with-at-least-32-chars  " }),