cauthy-auth 0.38.2 → 0.39.0

package/README.md

@@ -235,7 +235,7 @@ npx cauthy-auth init
 npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
-The same client is your application's own identity: it manages its organizations with no person's token.
+The same client is your application's own identity: it manages its organizations with no person's token. When people sign in with a public client (no secret) and the application's identity is a confidential client beside it, give the key that client's id: `systemKey: { privateKey, keyId, clientId }`. Its sign-ins then carry the proof that tells Cauthy which application signed the person in, and from what address.
 
 ```ts
 const org = await auth.system.organizations.create({ name: 'Acme' })

package/dist/index.js

@@ -1561,13 +1561,13 @@ function createCauthy(given = {}) {
       return null;
     }
   }
-  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").pop()?.trim() || void 0);
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").map((a) => a.trim()).reverse().find((a) => a !== "" && !ownNetwork(a)));
   let noProofUntil = 0;
   async function passedOn(request) {
     if (Date.now() < noProofUntil) return {};
     const ip = clientIp(request);
     try {
-      const proof = { "x-cauthy-system-token": await ownSystem.token() };
+      const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
       return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
     } catch {
       noProofUntil = Date.now() + 5 * 6e4;
@@ -2472,6 +2472,10 @@ function legalOf(raw) {
     consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
   };
 }
+function ownNetwork(address) {
+  const a = address.toLowerCase();
+  return /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(a) || /^172\.(1[6-9]|2\d|3[01])\./.test(a) || a === "::1" || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith("::ffff:127.") || a === "localhost";
+}
 
 // src/connect.ts
 function sessionSecret() {