create-kelpie 0.4.1 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kelpie",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Scaffold a self-hosted Kelpie assembly. Run it with npm create kelpie.",
   "keywords": [
     "kelpie",

package/templates/README.md

@@ -64,6 +64,7 @@ lists every problem at once.
 | `API_PORT` | The same number again, for the dev server's proxy |
 | `WEB_PORT` | The Vite dev server's port. Development only |
 | `DATABASE_URL` | A `postgres://` or `postgresql://` connection string |
+| `APP_BASE_URL` | The address people reach this Kelpie on. Emailed links (verification, password reset, invitations) are built from it. In development that is the Vite dev server; a deployment sets its real origin |
 | `LOG_LEVEL` | `debug`, `info`, `warn`, or `error` |
 | `EMAIL_PROVIDER` | `log` or `smtp`. `log` writes invitations and resets to the log instead of sending them |
 | `EMAIL_FROM` | The address transactional mail comes from |

package/templates/env

@@ -16,6 +16,11 @@ WEB_PORT=__WEB_PORT__
 
 DATABASE_URL=__DATABASE_URL__
 
+# The address people reach this Kelpie on, used to build the links in emails
+# (verification, password reset, invitations). In development that is the Vite
+# dev server below; a deployment sets its real origin.
+APP_BASE_URL=http://localhost:__WEB_PORT__
+
 # Seals secrets the service reads back, such as webhook signing secrets. This
 # one was generated for this project. Losing it makes those secrets unreadable;
 # changing it needs the rotation procedure in README.md.

package/templates/src/server.ts

@@ -16,6 +16,7 @@ import {
   readModuleConfigFile,
   registerModules,
   resolveActorFrom,
+  resolveClientIpFrom,
   runMigrations,
   serveWebBundle,
 } from '@kelpie/server'
@@ -76,10 +77,16 @@ async function start(): Promise<void> {
     credentials,
     createId,
     rateLimit: config.rateLimit,
-    // The real socket address. A header-based fallback would be spoofable, so
-    // this is resolved from the connection itself rather than defaulted
-    // inside `createApp`.
-    resolveClientIp: (context) => getConnInfo(context).remote.address ?? 'unknown',
+    // The socket address, then `X-Forwarded-For` only as far as the configured
+    // number of trusted proxies allows. Resolved from the connection itself
+    // rather than defaulted inside `createApp`, and trusting the header any
+    // further than `TRUSTED_PROXY_HOP_COUNT` would be spoofable.
+    resolveClientIp: (context) =>
+      resolveClientIpFrom(
+        getConnInfo(context).remote.address ?? 'unknown',
+        context.req.header('X-Forwarded-For'),
+        config.trustedProxyHopCount,
+      ),
   })
 
   // After `createApp`, so every API route is registered ahead of the fallback.