@podosoft/podokit 1.4.2 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -59,3 +59,28 @@ test("users toolbar can pick the search field", async ({ page }) => {
   await page.getByRole("option", { name: "Name", exact: true }).click();
   await expect(fieldSelect).toContainText("Name");
 });
+
+test("users toolbar keeps the search box usable at phone width", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await ready(page, "/admin/users");
+  const input = await page.locator("#toolbar-search").boundingBox();
+  const field = await page.locator('button[data-slot="select-trigger"]').last().boundingBox();
+  const button = await page.getByRole("button", { name: "Search", exact: true }).boundingBox();
+  if (!input || !field || !button) throw new Error("expected the toolbar to render");
+  // The input wraps below the field select instead of shrinking beside it.
+  expect(input.width).toBeGreaterThanOrEqual(192);
+  expect(input.y).toBeGreaterThan(field.y + field.height);
+  expect(Math.abs(input.y + input.height / 2 - (button.y + button.height / 2))).toBeLessThan(1);
+  expect(await page.evaluate(() => document.documentElement.scrollWidth - document.documentElement.clientWidth))
+    .toBe(0);
+});
+
+test("users toolbar keeps the desktop search box on one row", async ({ page }) => {
+  await page.setViewportSize({ width: 1280, height: 800 });
+  await ready(page, "/admin/users");
+  const input = await page.locator("#toolbar-search").boundingBox();
+  const field = await page.locator('button[data-slot="select-trigger"]').last().boundingBox();
+  if (!input || !field) throw new Error("expected the toolbar to render");
+  expect(input.width).toBe(320);
+  expect(Math.abs(input.y + input.height / 2 - (field.y + field.height / 2))).toBeLessThan(1);
+});

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-hook.ts

@@ -1,4 +1,5 @@
 import { createAuthMiddleware } from "better-auth/api";
+import { clientAddressOf } from "../core/client-address";
 import { recordAudit } from "./audit-events";
 import { auditEnabled } from "./audit-enabled";
 
@@ -71,6 +72,6 @@ export const auditAfterHook = createAuthMiddleware(async (ctx) => {
     actorEmail: actor?.email ?? null,
     targetId,
     targetLabel,
-    ip: ctx.headers?.get("x-forwarded-for") ?? null,
+    ip: clientAddressOf(ctx.headers) ?? null,
   });
 });

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.spec.ts

@@ -2,6 +2,7 @@ import { afterEach, describe, expect, mock, test } from "bun:test";
 import { SQL } from "bun";
 import type { QueryRunner } from "typeorm";
 import type { AuthSession } from "../auth/auth.service";
+import { CLIENT_ADDRESS_HEADER } from "../core/client-address";
 import { InitAuditLogs1720300000000 } from "../migrations/1720300000000-InitAuditLogs";
 import { recordAudit, recordAuditLater } from "./audit-events";
 import { AppException } from "@podosoft/podokit-contracts";
@@ -176,6 +177,21 @@ describe("AuditService", () => {
     }
   });
 
+  test("records the address the API resolved, not the caller's forwarded header", async () => {
+    const capture = sqlCapture();
+    const service = new AuditService(capture.sql, { dialect: "postgres", enabled: on });
+    const session: AuthSession = { user: { id: "user-1" }, session: {} };
+    const headers = {
+      "x-forwarded-for": "198.51.100.66, 198.51.100.67",
+      [CLIENT_ADDRESS_HEADER]: "203.0.113.7",
+    };
+    await service.recordRequest("todo.create", new Request("http://localhost/todos", { headers }), session);
+    await service.recordRequest("todo.delete", new Request("http://localhost/todos", {
+      headers: { "x-forwarded-for": "198.51.100.66" },
+    }), session);
+    expect(capture.batches.map((batch) => batch[0]?.ip)).toEqual(["203.0.113.7", null]);
+  });
+
   test("a failing toggle read never breaks the caller", async () => {
     const sql = await sqliteDatabase();
     const service = new AuditService(sql, {

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.ts

@@ -2,6 +2,7 @@ import type { SQL } from "bun";
 import { AppException } from "@podosoft/podokit-contracts";
 import type { DatabaseProviderName } from "@podosoft/podokit-runtime";
 import type { AuthSession } from "../auth/auth.service";
+import { clientAddressOf } from "../core/client-address";
 import { setAuditRecorder, type AuditEntry } from "./audit-events";
 
 export interface AuditLogView extends AuditEntry {
@@ -412,7 +413,7 @@ export class AuditService {
       targetId: target.id ?? null,
       targetLabel: target.label ?? null,
       metadata: target.metadata ?? null,
-      ip: request.headers.get("x-forwarded-for") ?? null,
+      ip: clientAddressOf(request.headers) ?? null,
     };
     if (options.defer) this.recordLater(entry);
     else await this.record(entry);

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.module.ts

@@ -8,6 +8,7 @@ import {
   OPENAPI,
   REQUEST_GUARDS,
   REQUEST_IDENTITY,
+  RESOLVED_SESSIONS,
   type AppPlugin,
   type PodokitModule,
   type ServiceKey,
@@ -158,7 +159,9 @@ export const authModule: PodokitModule = {
     setMailConfigStore(authConfigStore);
     const accessPolicy = services.resolve(ACCESS_POLICY);
     const settings = new SettingsService(database.sql, authConfigStore, publishConfigChanged);
-    const authService = new AuthService(settings, accessPolicy);
+    const authService = new AuthService(settings, accessPolicy, {
+      resolvedSessions: services.resolve(RESOLVED_SESSIONS),
+    });
     services.register(SETTINGS, settings);
     services.register(AUTH_CONFIG, new AuthConfigService(database.sql, database.provider));
     services.register(AUTH, authService, () => authService.close());

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { AccessPolicy, type RequestIdentity } from "../core/services";
+import { AccessPolicy, ResolvedSessions, type RequestIdentity, type ResolvedSession } from "../core/services";
 import type { SettingsService } from "../settings/settings.service";
 import {
   AuthService,
@@ -21,7 +21,7 @@ function session(
 }
 
 function identityFor(resolver: SessionResolver): RequestIdentity {
-  return createRequestIdentity(new AuthService(settings(false), new AccessPolicy(), resolver));
+  return createRequestIdentity(new AuthService(settings(false), new AccessPolicy(), { resolveSession: resolver }));
 }
 
 describe("AuthService", () => {
@@ -33,12 +33,12 @@ describe("AuthService", () => {
   test("keeps explicitly public routes unauthenticated", async () => {
     const policy = new AccessPolicy();
     policy.register("GET", "/public", "public");
-    const service = new AuthService(settings(false), policy, async () => null);
+    const service = new AuthService(settings(false), policy, { resolveSession: async () => null });
     await expect(service.guard(new Request("http://localhost/public"))).resolves.toBeUndefined();
   });
 
   test("requires a session by default", async () => {
-    const service = new AuthService(settings(false), new AccessPolicy(), async () => null);
+    const service = new AuthService(settings(false), new AccessPolicy(), { resolveSession: async () => null });
     const result = service.guard(new Request("http://localhost/private"));
     await expect(result).rejects.toMatchObject({ code: "AUTH_REQUIRED", statusCode: 401 });
   });
@@ -47,7 +47,7 @@ describe("AuthService", () => {
     const service = new AuthService(
       settings(true),
       new AccessPolicy(),
-      async () => session({ twoFactorEnabled: false }),
+      { resolveSession: async () => session({ twoFactorEnabled: false }) },
     );
     const result = service.guard(new Request("http://localhost/private"));
     await expect(result).rejects.toMatchObject({ code: "TWO_FACTOR_REQUIRED", statusCode: 403 });
@@ -57,13 +57,61 @@ describe("AuthService", () => {
     const service = new AuthService(
       settings(false),
       new AccessPolicy(),
-      async () => session({ role: "user" }),
+      { resolveSession: async () => session({ role: "user" }) },
     );
     await expect(service.requireAdmin(new Request("http://localhost/account/settings")))
       .rejects.toMatchObject({ code: "ADMIN_REQUIRED", statusCode: 403 });
   });
 });
 
+describe("AuthService resolved sessions", () => {
+  const expiresAt = new Date("2030-01-02T03:04:05.000Z");
+
+  function reporting(resolver: SessionResolver): { service: AuthService; reported: ResolvedSession[] } {
+    const resolvedSessions = new ResolvedSessions();
+    const reported: ResolvedSession[] = [];
+    resolvedSessions.listen((resolved) => reported.push(resolved));
+    return {
+      service: new AuthService(settings(false), new AccessPolicy(), { resolveSession: resolver, resolvedSessions }),
+      reported,
+    };
+  }
+
+  test("reports each resolved session once per request, before callers continue", async () => {
+    const resolver = mock(async () => session({}, { token: "session-token", expiresAt }));
+    const { service, reported } = reporting(resolver);
+    const request = new Request("http://localhost/private");
+
+    await service.requireSession(request);
+    expect(reported).toEqual([{ token: "session-token", userId: "user-1", expiresAt }]);
+    await service.session(request);
+    expect(resolver).toHaveBeenCalledTimes(1);
+    expect(reported).toHaveLength(1);
+
+    // A serialized expiry is accepted too.
+    const serialized = reporting(async () => session({}, { token: "t2", expiresAt: expiresAt.toISOString() }));
+    await serialized.service.session(new Request("http://localhost/private"));
+    expect(serialized.reported).toEqual([{ token: "t2", userId: "user-1", expiresAt }]);
+  });
+
+  test("reports nothing without a session, a token, or a valid expiry, and keeps lookup errors", async () => {
+    for (const resolver of [
+      async () => null,
+      async () => session({}, { expiresAt }),
+      async () => session({}, { token: "session-token", expiresAt: "soon" }),
+    ]) {
+      const { service, reported } = reporting(resolver);
+      await service.session(new Request("http://localhost/private"));
+      expect(reported).toEqual([]);
+    }
+    const failing = reporting(async () => {
+      throw new Error("database down");
+    });
+    await expect(failing.service.session(new Request("http://localhost/private"))).rejects.toThrow("database down");
+    expect(failing.reported).toEqual([]);
+  });
+});
+
 describe("createRequestIdentity", () => {
   const request = (): Request => new Request("http://localhost/events");
 

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.service.ts

@@ -1,5 +1,5 @@
 import { AppException } from "@podosoft/podokit-contracts";
-import type { AccessPolicy, RequestIdentity } from "../core/services";
+import type { AccessPolicy, RequestIdentity, ResolvedSessions } from "../core/services";
 import type { SettingsService } from "../settings/settings.service";
 import { getAuth, refreshForRequest } from "./auth-provider";
 import { rethrowAuthError } from "./database-outage";
@@ -37,19 +37,34 @@ function activeOrganizationOf(session: AuthSession): string | undefined {
   return typeof value === "string" && value !== "" ? value : undefined;
 }
 
+export interface AuthServiceOptions {
+  /** Looks a request's session up; Better Auth's getSession by default. */
+  resolveSession?: SessionResolver;
+  /** Receives every session this service resolves, such as for the rate limiter. */
+  resolvedSessions?: ResolvedSessions;
+}
+
 export class AuthService {
   private readonly sessions = new WeakMap<Request, Promise<AuthSession | null>>();
+  private readonly resolveSession: SessionResolver;
+  private readonly resolvedSessions: ResolvedSessions | undefined;
 
   constructor(
     private readonly settings: SettingsService,
     private readonly accessPolicy: AccessPolicy,
-    private readonly resolveSession: SessionResolver = defaultSessionResolver,
-  ) {}
+    options: AuthServiceOptions = {},
+  ) {
+    this.resolveSession = options.resolveSession ?? defaultSessionResolver;
+    this.resolvedSessions = options.resolvedSessions;
+  }
 
   session(request: Request): Promise<AuthSession | null> {
     const cached = this.sessions.get(request);
     if (cached) return cached;
-    const result = this.resolveSession(request.headers);
+    const result = this.resolveSession(request.headers).then((session) => {
+      if (session) this.report(session);
+      return session;
+    });
     this.sessions.set(request, result);
     return result;
   }
@@ -84,6 +99,13 @@ export class AuthService {
   async close(): Promise<void> {
     await closeAuthDatabase();
   }
+
+  private report(session: AuthSession): void {
+    const { token, expiresAt } = session.session;
+    const expires = expiresAt instanceof Date ? expiresAt : new Date(String(expiresAt));
+    if (!this.resolvedSessions || typeof token !== "string" || Number.isNaN(expires.getTime())) return;
+    this.resolvedSessions.report({ token, userId: session.user.id, expiresAt: expires });
+  }
 }
 
 /** Answers identity questions for other modules from the one session lookup memoized per request. */

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -15,6 +15,8 @@ import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-contracts";
 import { runUserDeletedHandlers } from "./user-delete-handlers";
 import { authBaseUrl, authSecret } from "./auth-environment";
 import { isMaintenanceCommand } from "./maintenance";
+import { CLIENT_ADDRESS_HEADER } from "../core/client-address";
+import { revokeEveryOtherSession } from "./revoke-other-sessions";
 // podokit:begin:auth-imports
 // podokit:end:auth-imports
 
@@ -55,6 +57,8 @@ export function buildAuth(config: AuthConfig) {
     // First, so a disabled feature answers 404 before another plugin's onRequest
     // (such as the OIDC provider's discovery metadata) can answer.
     featureGatePlugin(gateSettings),
+    // "Sign out other sessions" revokes every other session, not only the first 100.
+    revokeEveryOtherSession(),
     twoFactor(),
     magicLink({
       sendMagicLink: async ({ email, url }: { email: string; url: string; token: string }) => {
@@ -235,9 +239,10 @@ export function buildAuth(config: AuthConfig) {
     baseURL: authBaseUrl(),
     advanced: {
       ipAddress: {
-        // The API sits behind the SvelteKit server proxy, which forwards the
-        // resolved client IP as x-forwarded-for; trust it so sessions record an IP.
-        ipAddressHeaders: ["x-forwarded-for"],
+        // The address the API resolved behind its trusted proxies, which it sets
+        // on every request, so sessions and Better Auth's own rate limits use the
+        // same client address as the rest of the API.
+        ipAddressHeaders: [CLIENT_ADDRESS_HEADER],
       },
       ...(isMaintenanceCommand() ? { database: { validateSchema: false } } : {}),
     },

package/dist/templates/modules/auth/files/apps/api/src/auth/revoke-other-sessions.spec.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+import { betterAuth, type BetterAuthPlugin } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+import { revokeEveryOtherSession } from "./revoke-other-sessions";
+
+type Row = Record<string, unknown>;
+
+// A user signed in once more than Better Auth's default findMany limit of 100
+// sessions per list allows, plus the 50 extra the endpoint used to leave behind.
+const EXTRA_SESSIONS = 150;
+
+async function signedInWithManySessions(plugins: BetterAuthPlugin[]): Promise<{
+  revokeOthers: () => Promise<unknown>;
+  sessions: () => Row[];
+  currentToken: string;
+}> {
+  const db: Record<string, Row[]> = { user: [], session: [], account: [], verification: [] };
+  const auth = betterAuth({
+    database: memoryAdapter(db),
+    secret: "revoke-other-sessions-test-secret-0123456789",
+    baseURL: "http://localhost:5002",
+    emailAndPassword: { enabled: true },
+    plugins,
+  });
+  const response = await auth.api.signUpEmail({
+    body: { email: "many@example.com", password: "Podokit3e-Str0ng!pw", name: "Many" },
+    asResponse: true,
+  });
+  const cookie = response.headers.getSetCookie().map((value) => value.split(";")[0]).join("; ");
+  const context = await auth.$context;
+  const userId = String(db.user[0]?.id);
+  for (let index = 0; index < EXTRA_SESSIONS; index += 1) {
+    await context.internalAdapter.createSession(userId);
+  }
+  const currentToken = String((await auth.api.getSession({ headers: new Headers({ cookie }) }))?.session.token);
+  return {
+    revokeOthers: () => auth.api.revokeOtherSessions({ headers: new Headers({ cookie }) }),
+    sessions: () => db.session ?? [],
+    currentToken,
+  };
+}
+
+describe("revokeEveryOtherSession", () => {
+  test("Better Auth alone revokes only the first 100 other sessions", async () => {
+    const user = await signedInWithManySessions([]);
+    expect(user.sessions()).toHaveLength(EXTRA_SESSIONS + 1);
+    await user.revokeOthers();
+    expect(user.sessions().length).toBeGreaterThan(1);
+  });
+
+  test("revokes every other session and keeps the current one", async () => {
+    const user = await signedInWithManySessions([revokeEveryOtherSession()]);
+    await user.revokeOthers();
+    expect(user.sessions().map((session) => session.token)).toEqual([user.currentToken]);
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/auth/revoke-other-sessions.ts

@@ -0,0 +1,45 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { createAuthMiddleware } from "better-auth/api";
+
+/** Sessions read and revoked per pass. */
+const BATCH_SIZE = 500;
+
+/**
+ * Makes `/revoke-other-sessions` revoke every other session of the user.
+ * Better Auth's endpoint lists the sessions through the adapter's default
+ * findMany limit of 100 and revokes only those, so a user with more sessions
+ * kept the rest after "sign out other sessions". This hook runs after the
+ * endpoint and revokes the remainder in batches through the internal adapter,
+ * which also clears their secondary-storage entries when one is configured.
+ */
+export function revokeEveryOtherSession(): BetterAuthPlugin {
+  return {
+    id: "podokit-revoke-every-other-session",
+    hooks: {
+      after: [
+        {
+          matcher: (context) => context.path === "/revoke-other-sessions",
+          handler: createAuthMiddleware(async (ctx) => {
+            const current = ctx.context.session;
+            if (!current) return;
+            let first: string | undefined;
+            for (;;) {
+              const others = await ctx.context.adapter.findMany<{ token: string }>({
+                model: "session",
+                where: [
+                  { field: "userId", value: current.user.id },
+                  { field: "token", value: current.session.token, operator: "ne" },
+                ],
+                limit: BATCH_SIZE,
+              });
+              // Stop when nothing is left, or when a pass removed nothing.
+              if (others.length === 0 || others[0]?.token === first) return;
+              first = others[0]?.token;
+              await ctx.context.internalAdapter.deleteSessions(others.map((session) => session.token));
+            }
+          }),
+        },
+      ],
+    },
+  };
+}

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.config.spec.ts

@@ -1,12 +1,8 @@
 import { describe, expect, test } from "bun:test";
-import {
-  clientAddressFromProxy,
-  rateLimitConfig,
-  sessionSigningSecret,
-} from "./rate-limit.config";
+import { rateLimitConfig, sessionSigningSecret } from "./rate-limit.config";
 
 describe("rate limit configuration", () => {
-  test("validates route limits and proxy settings", () => {
+  test("validates route limits", () => {
     expect(
       rateLimitConfig({
         RATE_LIMIT_KEY_PREFIX: "podokit:tenant-a:rate-limit",
@@ -15,8 +11,6 @@ describe("rate limit configuration", () => {
         RATE_LIMIT_AUTH_TTL: "45",
         RATE_LIMIT_AUTH_MAX: "15",
         RATE_LIMIT_RUNTIME_MAX: "900",
-        RATE_LIMIT_TRUSTED_PROXY_HOPS: "2",
-        RATE_LIMIT_PROXY_HEADER: "X-Real-IP",
         RATE_LIMIT_STORAGE_TIMEOUT_MS: "750",
         RATE_LIMIT_UNAVAILABLE_RETRY_AFTER: "3",
       }),
@@ -27,69 +21,18 @@ describe("rate limit configuration", () => {
       authTtlSeconds: 45,
       authLimit: 15,
       runtimeLimit: 900,
-      trustedProxyHops: 2,
-      proxyHeader: "x-real-ip",
       storageTimeoutMs: 750,
       unavailableRetryAfterSeconds: 3,
     });
     expect(() => rateLimitConfig({ RATE_LIMIT_MAX: "0" })).toThrow(
       "RATE_LIMIT_MAX must be a positive integer",
     );
-    expect(() =>
-      rateLimitConfig({ RATE_LIMIT_TRUSTED_PROXY_HOPS: "-1" }),
-    ).toThrow("must be a non-negative integer");
-    expect(() =>
-      rateLimitConfig({ RATE_LIMIT_PROXY_HEADER: "invalid header" }),
-    ).toThrow("must be a valid HTTP header name");
     expect(() => rateLimitConfig({ RATE_LIMIT_KEY_PREFIX: "invalid prefix!" })).toThrow(
       "RATE_LIMIT_KEY_PREFIX must be 1-128 characters",
     );
     expect(rateLimitConfig({}).keyPrefix).toBe("podokit:rate-limit");
   });
 
-  test("selects only the address outside the configured trusted proxy depth", () => {
-    const headers = {
-      "x-forwarded-for": "203.0.113.7, 198.51.100.8",
-    };
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 2,
-      }),
-    ).toBe("203.0.113.7");
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 1,
-      }),
-    ).toBe("198.51.100.8");
-    expect(
-      clientAddressFromProxy(headers, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 0,
-      }),
-    ).toBe("10.0.0.9");
-  });
-
-  test("ignores malformed or incomplete forwarded chains", () => {
-    expect(
-      clientAddressFromProxy(
-        { "x-forwarded-for": "attacker-controlled" },
-        "::ffff:10.0.0.9",
-        {
-          proxyHeader: "x-forwarded-for",
-          trustedProxyHops: 1,
-        },
-      ),
-    ).toBe("10.0.0.9");
-    expect(
-      clientAddressFromProxy({}, "10.0.0.9", {
-        proxyHeader: "x-forwarded-for",
-        trustedProxyHops: 1,
-      }),
-    ).toBe("10.0.0.9");
-  });
-
   test("reads the session signing secret the way the auth module does", () => {
     expect(
       sessionSigningSecret({ BETTER_AUTH_SECRET: "  session-secret-with-at-least-32-chars  " }),

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.config.ts

@@ -1,5 +1,3 @@
-import { isIP } from "node:net";
-
 export interface RateLimitConfig {
   keyPrefix: string;
   ttlSeconds: number;
@@ -7,8 +5,6 @@ export interface RateLimitConfig {
   authTtlSeconds: number;
   authLimit: number;
   runtimeLimit: number;
-  trustedProxyHops: number;
-  proxyHeader: string;
   storageTimeoutMs: number;
   unavailableRetryAfterSeconds: number;
 }
@@ -32,23 +28,6 @@ function positiveInteger(name: string, value: string | undefined, fallback: numb
   return parsed;
 }
 
-function nonNegativeInteger(name: string, value: string | undefined, fallback: number): number {
-  if (value === undefined || value === "") return fallback;
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed < 0) {
-    throw new Error(`${name} must be a non-negative integer`);
-  }
-  return parsed;
-}
-
-function headerName(value: string | undefined): string {
-  const normalized = (value || "x-forwarded-for").trim().toLowerCase();
-  if (!/^[a-z0-9!#$%&'*+.^_`|~-]+$/.test(normalized)) {
-    throw new Error("RATE_LIMIT_PROXY_HEADER must be a valid HTTP header name");
-  }
-  return normalized;
-}
-
 export function rateLimitConfig(env: NodeJS.ProcessEnv = process.env): RateLimitConfig {
   return {
     keyPrefix: keyPrefix(env.RATE_LIMIT_KEY_PREFIX),
@@ -65,12 +44,6 @@ export function rateLimitConfig(env: NodeJS.ProcessEnv = process.env): RateLimit
       env.RATE_LIMIT_RUNTIME_MAX,
       1000,
     ),
-    trustedProxyHops: nonNegativeInteger(
-      "RATE_LIMIT_TRUSTED_PROXY_HOPS",
-      env.RATE_LIMIT_TRUSTED_PROXY_HOPS,
-      0,
-    ),
-    proxyHeader: headerName(env.RATE_LIMIT_PROXY_HEADER),
     storageTimeoutMs: positiveInteger(
       "RATE_LIMIT_STORAGE_TIMEOUT_MS",
       env.RATE_LIMIT_STORAGE_TIMEOUT_MS,
@@ -90,41 +63,3 @@ export function rateLimitConfig(env: NodeJS.ProcessEnv = process.env): RateLimit
 export function sessionSigningSecret(env: NodeJS.ProcessEnv = process.env): string | undefined {
   return env.BETTER_AUTH_SECRET?.trim() || undefined;
 }
-
-function normalizeIp(value: string | undefined): string | undefined {
-  if (!value) return undefined;
-  const trimmed = value.trim();
-  const normalized = trimmed.startsWith("::ffff:")
-    ? trimmed.slice("::ffff:".length)
-    : trimmed;
-  return isIP(normalized) === 0 ? undefined : normalized;
-}
-
-function headerValue(headers: unknown, name: string): string | undefined {
-  if (headers instanceof Headers) return headers.get(name) ?? undefined;
-  if (!headers || typeof headers !== "object") return undefined;
-  const value = (headers as Record<string, unknown>)[name];
-  if (typeof value === "string") return value;
-  if (!Array.isArray(value)) return undefined;
-  const strings = value.filter((item): item is string => typeof item === "string");
-  return strings.length > 0 ? strings.join(",") : undefined;
-}
-
-export function clientAddressFromProxy(
-  headers: unknown,
-  remoteAddress: string | undefined,
-  config: Pick<RateLimitConfig, "proxyHeader" | "trustedProxyHops">,
-): string {
-  const direct = normalizeIp(remoteAddress) ?? "unknown";
-  if (config.trustedProxyHops === 0) return direct;
-
-  const forwarded = headerValue(headers, config.proxyHeader)
-    ?.split(",")
-    .map((value) => value.trim())
-    .filter(Boolean) ?? [];
-  const chain = [...forwarded, direct];
-  if (chain.length <= config.trustedProxyHops) return direct;
-
-  const selected = chain[chain.length - config.trustedProxyHops - 1];
-  return normalizeIp(selected) ?? direct;
-}