python-ipware 3.0.0__py3-none-any.whl → 4.1.0__py3-none-any.whl

python_ipware/__init__.py

@@ -1,2 +1,6 @@
-from .python_ipware import IpWare  # noqa
-from .__version__ import __version__  # noqa
+from .__version__ import __version__
+from .legacy import LegacyIpWare
+from .modern import ModernIpWare
+from .router import IpWare
+
+__all__ = ["IpWare", "LegacyIpWare", "ModernIpWare", "__version__"]

python_ipware/__version__.py

@@ -1 +1 @@
-__version__ = "3.0.0"
+__version__ = "4.1.0"

python_ipware-3.0.0.dist-info/METADATA → python_ipware/legacy/README.md

@@ -1,33 +1,15 @@
-Metadata-Version: 2.1
-Name: python-ipware
-Version: 3.0.0
-Summary: A Python package to retrieve user's IP address
-Author-email: Val Neekman <info@neekware.com>
-License: MIT
-Project-URL: Documentation, https://github.com/un33k/python-ipware#readme
-Project-URL: Issues, https://github.com/un33k/python-ipware/issues
-Project-URL: Source, https://github.com/un33k/python-ipware
-Project-URL: Changelog, https://github.com/un33k/python-ipware/blob/main/CHANGELOG.md
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: Natural Language :: English
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.7
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Provides-Extra: dev
-Requires-Dist: ruff ; extra == 'dev'
-Requires-Dist: coveralls ~=3.3 ; extra == 'dev'
-Requires-Dist: coverage[toml] ; extra == 'dev'
-Requires-Dist: twine ; extra == 'dev'
+# Legacy engine (v3) — how to use
+
+> This is the original python-ipware 3.x guide, kept for reference. The legacy engine is frozen and only runs when requested explicitly with `IpWare(algorithm="legacy")`. For current usage see the [main README](../../README.md).
+
+```python
+from python_ipware import IpWare
+
+ipw = IpWare(algorithm="legacy")
+ip, trusted_route = ipw.get_client_ip(request.META)
+```
+
+---
 
 # Python IPware (A Python Package)
 

python_ipware/legacy/__init__.py

@@ -0,0 +1,12 @@
+"""Frozen v3 algorithm.
+
+This subpackage preserves the exact behavior of python-ipware 3.x. It is kept
+byte-for-byte stable so that projects upgrading to 4.x can pin
+``algorithm="legacy"`` and get identical results to what they had before.
+
+Do not "improve" this module. New behavior belongs in ``python_ipware.modern``.
+"""
+
+from .engine import IpWare as LegacyIpWare
+
+__all__ = ["LegacyIpWare"]

python_ipware/modern/__init__.py

@@ -0,0 +1,5 @@
+"""The modern (v4) python-ipware algorithm."""
+
+from .engine import ModernIpWare
+
+__all__ = ["ModernIpWare"]

python_ipware/modern/defaults.py

@@ -0,0 +1,52 @@
+"""Default header precedence for the modern engine.
+
+Superset of the v3 list, adding widely-deployed CDN/edge headers. Headers are
+scanned in order; the first one that yields a globally routable IP wins, with
+private and then loopback addresses as fallbacks.
+
+Ordering rule: existing entries never move. New headers are added only in the
+block just above ``REMOTE_ADDR``, so a new header can outrank the raw socket
+address but never a header that already resolved a request in an earlier
+release.
+
+Every default here can be forged by a client that reaches the app directly.
+If all traffic arrives through one known edge, pass an explicit
+``precedence`` naming only that edge's header.
+"""
+
+DEFAULT_PRECEDENCE: tuple[str, ...] = (
+    "X_FORWARDED_FOR",
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_CLIENT_IP",
+    "HTTP_X_REAL_IP",
+    "HTTP_X_FORWARDED",
+    "HTTP_X_CLUSTER_CLIENT_IP",
+    "HTTP_FORWARDED_FOR",  # de facto variant; not defined by RFC 7239
+    "HTTP_FORWARDED",  # RFC 7239 (for=...;proto=...), parsed per element
+    "HTTP_CF_CONNECTING_IP",  # Cloudflare
+    "HTTP_TRUE_CLIENT_IP",  # Cloudflare Enterprise / Akamai
+    "HTTP_FASTLY_CLIENT_IP",  # Fastly / Firebase
+    "HTTP_FLY_CLIENT_IP",  # Fly.io
+    "HTTP_X_APPENGINE_USER_IP",  # Google App Engine
+    "X-CLIENT-IP",  # Azure
+    "X-REAL-IP",  # NGINX
+    "X-CLUSTER-CLIENT-IP",  # Rackspace
+    "X_FORWARDED",
+    "FORWARDED_FOR",
+    "CF-CONNECTING-IP",
+    "TRUE-CLIENT-IP",
+    "FASTLY-CLIENT-IP",
+    "FLY-CLIENT-IP",
+    "FORWARDED",
+    "CLIENT-IP",
+    # --- added after 4.0.0: below every earlier entry, above REMOTE_ADDR ---
+    "HTTP_X_CLIENT_IP",  # Azure X-Client-IP in Django/WSGI form
+    "X-APPENGINE-USER-IP",  # Google App Engine, raw header form
+    "HTTP_X_AZURE_CLIENTIP",  # Azure Front Door
+    "X-AZURE-CLIENTIP",
+    "HTTP_DO_CONNECTING_IP",  # DigitalOcean App Platform
+    "DO-CONNECTING-IP",
+    "HTTP_X_ENVOY_EXTERNAL_ADDRESS",  # Envoy / Istio
+    "X-ENVOY-EXTERNAL-ADDRESS",
+    "REMOTE_ADDR",  # direct connection; always last
+)

python_ipware/modern/engine.py

@@ -0,0 +1,256 @@
+"""The modern python-ipware engine.
+
+Same inputs, outputs and proxy semantics as v3, with a better best-match:
+
+* Superset header precedence (Forwarded parsing, more CDN / edge headers).
+* Robust IPv6 / bracketed-port / IPv4-mapped / RFC 7239 parsing.
+* Explicit ranking: global > private > link-local > loopback. Unspecified,
+  multicast, broadcast and reserved addresses are never returned.
+* Without trusted-proxy config, the first *globally routable* hop of a chain
+  wins, not just the first hop, so ``10.0.0.1, 177.139.233.139`` yields the
+  public address. With ``proxy_count`` / ``proxy_list`` the client position is
+  fixed by the config, exactly as in v3.
+* Same ``strict`` semantics for proxy_count / proxy_list validation.
+* Trusted-proxy matching anchored to the end of the chain. Each ``proxy_list``
+  entry is a CIDR network (``"100.64.0.0/10"``, ``"fd7a:115c:a1e0::/48"``), a
+  complete IP matched exactly, or an IP prefix matched on octet / group
+  boundaries (``"10.1."``, ``"10.1"`` -> 10.1.x.x only).
+* ``trusted_route`` is True whenever the returned IP came from a chain that
+  passed the configured proxy validation, whatever its tier.
+* Misconfiguration fails loudly at construction instead of silently trusting
+  or never matching.
+"""
+
+import ipaddress
+from collections.abc import Mapping
+from typing import Any, Optional, Union
+
+from .defaults import DEFAULT_PRECEDENCE
+from .parsers import (
+    TIER_GLOBAL,
+    TIER_REJECT,
+    IpAddressType,
+    IpNetworkType,
+    ip_tier,
+    split_proxy_chain,
+    unwrap_ipv4,
+    unwrap_ipv4_network,
+)
+
+OptionalIp = Optional[IpAddressType]
+ProxyMatcher = Union[str, IpNetworkType]
+
+_PREFIX_CHARS = frozenset("0123456789abcdef.:")
+
+
+def _compile_proxy_matcher(pattern: str) -> ProxyMatcher:
+    """Compile one ``proxy_list`` entry.
+
+    * ``"10.0.0.0/8"`` -> network, matched by membership.
+    * ``"198.84.193.157"`` (a complete IP) -> exact /32 or /128 network, so it
+      can never match ``198.84.193.15x`` and IPv6 spelling (case, zeros) does
+      not matter.
+    * ``"198.84."`` / ``"10.1"`` / ``"2001:db8:"`` -> text prefix, matched on
+      octet / group boundaries only. An entry ending in ``:`` is always a
+      prefix, since ``"2001:db8::"`` historically meant "anything under it".
+    """
+    if "/" in pattern:
+        try:
+            # strict=False accepts host bits set, e.g. "10.0.0.5/24" -> 10.0.0.0/24.
+            return unwrap_ipv4_network(ipaddress.ip_network(pattern, strict=False))
+        except ValueError as exc:
+            msg = f"Invalid CIDR in proxy_list: {pattern!r}"
+            raise ValueError(msg) from exc
+    if not pattern.endswith(":"):
+        try:
+            return ipaddress.ip_network(unwrap_ipv4(ipaddress.ip_address(pattern)))
+        except ValueError:
+            pass
+    prefix = pattern.lower()
+    if not set(prefix) <= _PREFIX_CHARS:
+        msg = f"proxy_list entry is not an IP, CIDR or IP prefix: {pattern!r}"
+        raise ValueError(msg)
+    return prefix
+
+
+def _proxy_matches(ip: IpAddressType, matcher: ProxyMatcher) -> bool:
+    if isinstance(matcher, str):
+        text = str(ip)
+        if not text.startswith(matcher):
+            return False
+        # Boundary check: "10.1" matches 10.1.x.x but not 10.100.x.x.
+        rest = text[len(matcher) :]
+        return not rest or matcher[-1] in ".:" or rest[0] in ".:%"
+    # Membership across IP versions is simply False, never an error.
+    return ip.version == matcher.version and ip in matcher
+
+
+def _fold(key: str) -> str:
+    return key.upper().replace("-", "_")
+
+
+def _build_folded(meta: Mapping[Any, Any]) -> dict[str, object]:
+    """Case- and dash-insensitive view of ``meta`` for lowercase-key adapters.
+
+    When several spellings fold to the same name, the result must not depend
+    on dict order. Real header names use dashes, while an underscore spelling
+    in a raw header dict can only come from the client, so dash spellings win.
+    If several dash spellings disagree, the header is treated as absent.
+    """
+    groups: dict[str, list[tuple[str, object]]] = {}
+    for key, value in meta.items():
+        if isinstance(key, str):
+            groups.setdefault(_fold(key), []).append((key, value))
+    folded: dict[str, object] = {}
+    for name, items in groups.items():
+        dashed = [v for k, v in items if "-" in k]
+        pool = dashed or [v for _, v in items]
+        distinct: list[object] = []
+        for value in pool:
+            if value not in distinct:
+                distinct.append(value)
+        if len(distinct) == 1:
+            folded[name] = distinct[0]
+    return folded
+
+
+class ModernIpWare:
+    def __init__(
+        self,
+        precedence: Optional[tuple[str, ...]] = None,
+        leftmost: bool = True,
+        proxy_count: Optional[int] = None,
+        proxy_list: Optional[list[str]] = None,
+    ) -> None:
+        if proxy_count is not None and (
+            isinstance(proxy_count, bool) or not isinstance(proxy_count, int) or proxy_count < 0
+        ):
+            raise ValueError("proxy_count must be a non-negative integer")
+        # A bare string is iterable and would silently become one prefix per
+        # character ("10.0.0.1" -> "1", "0", ...), trusting almost anything.
+        if isinstance(proxy_list, str) or (
+            proxy_list is not None and not all(isinstance(p, str) for p in proxy_list)
+        ):
+            raise ValueError("proxy_list must be a list of strings.")
+        proxy_list = [p.strip() for p in proxy_list or []]
+        # An empty prefix matches every address, which would mark any spoofed
+        # chain as trusted. It is always a misconfiguration (e.g. a trailing
+        # comma in an env var), so fail loudly instead.
+        if any(not p for p in proxy_list):
+            raise ValueError("proxy_list entries must not be empty.")
+        # proxy_count and proxy_list may both be set and may differ (v3 API):
+        # the count is a hop-count requirement (minimum, or exact when strict)
+        # and the list pins the client position. See _best_from_chain.
+        if isinstance(precedence, str) or (
+            precedence is not None and not all(isinstance(h, str) for h in precedence)
+        ):
+            raise ValueError("precedence must be a sequence of header-name strings.")
+
+        # Copy, so later changes to the caller's objects cannot leak in.
+        self.precedence = tuple(precedence) if precedence else DEFAULT_PRECEDENCE
+        self.leftmost = leftmost
+        self.proxy_count = proxy_count
+        self.proxy_list = proxy_list
+        self._proxy_matchers = [_compile_proxy_matcher(p) for p in self.proxy_list]
+
+    # -- meta access --------------------------------------------------------
+
+    def _get_meta_values(self, meta: Optional[Mapping[Any, Any]]) -> list[str]:
+        if meta is None:
+            return []
+        if not isinstance(meta, Mapping):
+            msg = f"meta must be a mapping of header names to values, got {type(meta).__name__}"
+            raise TypeError(msg)
+        folded = _build_folded(meta)
+        values: list[str] = []
+        for key in self.precedence:
+            value = meta.get(key)
+            if value is None:
+                value = meta.get(key.replace("_", "-"))
+            # Exact keys win; the folded view only fills gaps, so lowercase
+            # keys (AWS Lambda / API Gateway v2, raw ASGI dicts) still match.
+            if value is None:
+                value = folded.get(_fold(key))
+            # Header values are text; anything else (None, bytes, lists from
+            # a misbehaving adapter) is ignored rather than crashing.
+            if isinstance(value, str) and value.strip():
+                values.append(value.strip())
+        return values
+
+    # -- validation ---------------------------------------------------------
+
+    def _proxy_count_valid(self, chain: list[IpAddressType], strict: bool) -> bool:
+        if self.proxy_count is None:
+            return True
+        proxies = len(chain) - 1
+        if strict:
+            return proxies == self.proxy_count
+        return proxies >= self.proxy_count
+
+    def _proxy_list_valid(self, chain: list[IpAddressType], strict: bool) -> bool:
+        if not self.proxy_list:
+            return True
+        count = len(self.proxy_list)
+        if strict and (len(chain) - 1) != count:
+            return False
+        if (len(chain) - 1) < count:
+            return False
+        # Compare the trailing proxies against the trusted entries in order.
+        return all(
+            _proxy_matches(ip, matcher)
+            for ip, matcher in zip(chain[-count:], self._proxy_matchers)
+        )
+
+    # -- selection ----------------------------------------------------------
+
+    def _best_from_chain(self, chain: list[IpAddressType]) -> tuple[OptionalIp, bool]:
+        # ``chain`` is already client-first (see get_client_ip) and non-empty.
+        if self.proxy_list:
+            return chain[-(len(self.proxy_list) + 1)], True
+        if self.proxy_count is not None:
+            return chain[-(self.proxy_count + 1)], True
+        # No trusted-proxy config, so no position in the chain is verified.
+        # Take the first globally routable hop; otherwise the best-ranked hop,
+        # earliest on ties. This never picks a worse address than v3's chain[0].
+        best: OptionalIp = None
+        best_tier = TIER_REJECT
+        for ip in chain:
+            tier = ip_tier(ip)
+            if tier == TIER_GLOBAL:
+                return ip, False
+            if tier > best_tier:
+                best, best_tier = ip, tier
+        return best, False
+
+    # -- public API ---------------------------------------------------------
+
+    def get_client_ip(self, meta: Optional[Mapping[Any, Any]], strict: bool = False) -> tuple[OptionalIp, bool]:
+        # Best non-global candidate so far. Strictly-greater comparison keeps
+        # the earliest header on ties, preserving header precedence.
+        fallback: OptionalIp = None
+        fallback_tier = TIER_REJECT
+        fallback_trusted = False
+
+        for raw in self._get_meta_values(meta):
+            chain = split_proxy_chain(raw, strict)
+            if not chain:
+                continue
+            # Put the chain in client-first order ONCE, before any validation, so
+            # the proxy checks and the client pick look at the same end.
+            if not self.leftmost:
+                chain.reverse()
+            if not self._proxy_count_valid(chain, strict):
+                continue
+            if not self._proxy_list_valid(chain, strict):
+                continue
+
+            ip, trusted = self._best_from_chain(chain)
+            if ip is None:
+                continue
+            tier = ip_tier(ip)
+            if tier == TIER_GLOBAL:
+                return ip, trusted
+            if tier > fallback_tier:
+                fallback, fallback_tier, fallback_trusted = ip, tier, trusted
+
+        return fallback, fallback_trusted

python_ipware/modern/parsers.py

@@ -0,0 +1,210 @@
+"""Framework-agnostic IP parsing helpers for the modern engine.
+
+Pure stdlib. Knows how to clean raw header tokens, strip ports/brackets,
+read RFC 7239 ``Forwarded`` elements, validate IPv4/IPv6, and split proxy
+chains.
+"""
+
+import ipaddress
+from typing import Optional, Union
+
+IpAddressType = Union[ipaddress.IPv4Address, ipaddress.IPv6Address]
+IpNetworkType = Union[ipaddress.IPv4Network, ipaddress.IPv6Network]
+
+# RFC 6052 well-known NAT64 prefix; the low 32 bits are the IPv4 client.
+_NAT64_WKP = ipaddress.IPv6Network("64:ff9b::/96")
+# RFC 8215 local-use NAT64 prefix. The IPv4 position depends on the operator's
+# chosen prefix length, so it is not unwrapped; it is ranked as private.
+_NAT64_LOCAL = ipaddress.IPv6Network("64:ff9b:1::/48")
+# IPv4-mapped IPv6 space. Hops in it are unwrapped to IPv4.
+_IPV4_MAPPED = ipaddress.IPv6Network("::ffff:0:0/96")
+# RFC 1122 "this network": never a valid source address.
+_THIS_NETWORK = ipaddress.IPv4Network("0.0.0.0/8")
+
+# How good an address is as a client IP; higher wins. REJECT is never returned.
+TIER_REJECT = 0
+TIER_LOOPBACK = 1
+TIER_LINK_LOCAL = 2
+TIER_PRIVATE = 3  # RFC 1918, ULA, CGNAT 100.64/10, documentation ranges, ...
+TIER_GLOBAL = 4
+
+
+def ip_tier(ip: IpAddressType) -> int:
+    """Rank ``ip`` as a client address candidate.
+
+    Check order matters: Python reports multicast (``224.0.0.1``, ``ff02::1``),
+    site-local ``fec0::/10`` and the deprecated ``::a.b.c.d`` form as
+    ``is_global``, and ``::1`` and ``64:ff9b:1::/48`` as ``is_reserved``, so
+    those are resolved before ``is_reserved`` / ``is_global`` are trusted.
+    Unspecified, ``0.0.0.0/8``, multicast, broadcast and reserved addresses can
+    never be a real client and are rejected outright. NAT64 well-known-prefix
+    addresses never reach here: ``parse_ip`` unwraps them to IPv4 first.
+
+    Global/private classification comes from the running Python's
+    ``ipaddress`` tables, which changed in 3.12 (e.g. 6to4 ``2002::/16`` is
+    global on 3.11 but private on 3.12+).
+    """
+    if ip.is_unspecified or ip.is_multicast:
+        return TIER_REJECT
+    if isinstance(ip, ipaddress.IPv4Address) and ip in _THIS_NETWORK:
+        return TIER_REJECT
+    if ip.is_loopback:
+        return TIER_LOOPBACK
+    if isinstance(ip, ipaddress.IPv6Address) and ip in _NAT64_LOCAL:
+        return TIER_PRIVATE  # Python calls it reserved (it sits in ::/8)
+    if ip.is_reserved:  # 240.0.0.0/4 incl. 255.255.255.255; unallocated IPv6
+        return TIER_REJECT
+    if isinstance(ip, ipaddress.IPv6Address) and ip.is_site_local:
+        return TIER_PRIVATE  # deprecated fec0::/10, which Python calls global
+    if ip.is_global:
+        return TIER_GLOBAL
+    if ip.is_link_local:
+        return TIER_LINK_LOCAL
+    return TIER_PRIVATE
+
+
+def _is_port(value: str) -> bool:
+    # isascii() guards against Unicode digits such as "²" that isdigit() accepts.
+    return value.isascii() and value.isdigit() and int(value) <= 65535
+
+
+def strip_port(value: str) -> str:
+    """Remove a trailing ``:port`` (IPv4) or ``[addr]:port`` (IPv6) suffix.
+
+    Returns ``""`` for a malformed token (unclosed bracket, text after the
+    bracket, or a non-numeric/out-of-range port) so it is rejected rather than
+    silently truncated into something that looks valid.
+    """
+    value = value.strip()
+    if not value:
+        return value
+
+    if value.startswith("["):  # [addr] or [addr]:port
+        end = value.find("]")
+        if end == -1:
+            return ""
+        rest = value[end + 1 :]
+        if rest and not (rest.startswith(":") and _is_port(rest[1:])):
+            return ""
+        return value[1:end]
+
+    if value.count(":") == 1:  # IPv4:port
+        host, _, port = value.partition(":")
+        return host if _is_port(port) else ""
+
+    return value  # bare IPv6 or bare IPv4
+
+
+def split_unquoted(value: str, sep: str) -> list[str]:
+    """Split ``value`` on ``sep``, ignoring separators inside double quotes.
+
+    RFC 7239 values may be quoted strings (``by="a,b"``), and a separator
+    inside one must not start a new hop or parameter. Backslash escapes inside
+    quotes are honoured. An unclosed quote swallows the rest of the value, so
+    that token fails to parse instead of leaking a fragment as a fake hop.
+    """
+    if '"' not in value:
+        return value.split(sep)
+    parts: list[str] = []
+    buf: list[str] = []
+    quoted = escaped = False
+    for ch in value:
+        if escaped:
+            escaped = False
+        elif quoted and ch == "\\":
+            escaped = True
+        elif ch == '"':
+            quoted = not quoted
+        elif ch == sep and not quoted:
+            parts.append("".join(buf))
+            buf = []
+            continue
+        buf.append(ch)
+    parts.append("".join(buf))
+    return parts
+
+
+def forwarded_for(element: str) -> str:
+    """Return the ``for=`` value of one RFC 7239 ``Forwarded`` element.
+
+    ``for=192.0.2.60;proto=http;by=203.0.113.43`` -> ``192.0.2.60``. Parameter
+    names are case-insensitive, and ``;`` inside quoted values is not a
+    separator. Returns ``""`` when the element has no ``for`` parameter, so the
+    hop counts as invalid instead of being guessed at.
+    """
+    for pair in split_unquoted(element, ";"):
+        key, sep, val = pair.partition("=")
+        if sep and key.strip().lower() == "for":
+            return val.strip()
+    return ""
+
+
+def clean_ip(value: Optional[str]) -> str:
+    """Normalize a raw candidate token into a bare IP string."""
+    if not value:
+        return ""
+    value = value.strip().strip('"').strip("'")
+    value = strip_port(value)
+    return value.strip()
+
+
+def parse_ip(value: Optional[str]) -> Optional[IpAddressType]:
+    """Return a validated ip_address object, or None.
+
+    Unwraps IPv4-mapped IPv6 (``::ffff:a.b.c.d``) and the RFC 6052 NAT64
+    well-known prefix (``64:ff9b::a.b.c.d``) to the embedded IPv4 client.
+    """
+    cleaned = clean_ip(value)
+    if not cleaned:
+        return None
+    try:
+        return unwrap_ipv4(ipaddress.ip_address(cleaned))
+    except ValueError:
+        return None
+
+
+def unwrap_ipv4(ip: IpAddressType) -> IpAddressType:
+    """Return the IPv4 address embedded in an IPv4-mapped or NAT64-WKP address."""
+    if isinstance(ip, ipaddress.IPv6Address):
+        if ip.ipv4_mapped is not None:
+            return ip.ipv4_mapped
+        if ip in _NAT64_WKP:
+            return ipaddress.IPv4Address(int(ip) & 0xFFFFFFFF)
+    return ip
+
+
+def unwrap_ipv4_network(net: IpNetworkType) -> IpNetworkType:
+    """IPv4 network embedded in a /96-or-longer IPv4-mapped or NAT64-WKP network.
+
+    Hops in those ranges are unwrapped to IPv4 before matching, so a trusted
+    proxy written as ``::ffff:10.0.0.0/104`` must match the IPv4 hop too.
+    """
+    if isinstance(net, ipaddress.IPv6Network) and net.prefixlen >= 96:
+        for embedding in (_IPV4_MAPPED, _NAT64_WKP):
+            if net.subnet_of(embedding):
+                return ipaddress.IPv4Network((int(net.network_address) & 0xFFFFFFFF, net.prefixlen - 96))
+    return net
+
+
+def split_proxy_chain(raw: Optional[str], strict: bool = False) -> Optional[list[IpAddressType]]:
+    """Split a comma-separated proxy chain into ordered ``ip_address`` objects.
+
+    Order is preserved left-to-right as it appears in the header. Tokens in
+    RFC 7239 form (``for=...;proto=...``) are reduced to their ``for`` value;
+    obfuscated identifiers such as ``for=unknown`` or ``for=_hidden`` are not
+    IPs and count as invalid. In strict mode, any invalid or empty token makes
+    the whole chain invalid (returns None), since a malformed header should not
+    be trusted. Otherwise invalid and empty tokens are skipped.
+    """
+    if not raw:
+        return []
+    result: list[IpAddressType] = []
+    for token in split_unquoted(raw, ","):
+        # No plain IP token contains "=", only RFC 7239 Forwarded elements do.
+        candidate = forwarded_for(token) if "=" in token else token
+        ip = parse_ip(candidate)
+        if ip is not None:
+            result.append(ip)
+        elif strict:
+            return None
+    return result

python_ipware/router.py

@@ -0,0 +1,83 @@
+"""Public ``IpWare`` facade with an algorithm router.
+
+python-ipware 4.x ships two engines:
+
+* ``legacy``  -> the frozen, byte-compatible v3 algorithm.
+* ``modern``  -> the enhanced v4 algorithm (more headers, hardened parsing).
+
+The ``algorithm`` selector chooses between them. ``"auto"`` (the default) is a
+clean alias for ``"modern"`` — the enhanced engine is where development moves
+forward. It passes the full v3 suite, and a differential test checks it never
+returns a worse address than v3. It picks better where v3 did not: a public
+hop behind a private first hop, no multicast / unspecified results, and
+``trusted_route`` for private clients behind trusted proxies (see CHANGELOG).
+``legacy`` remains available as an explicit escape hatch for projects that
+need byte-for-byte v3 behavior. There is no silent runtime fallback, so
+behavior stays predictable.
+
+    from python_ipware import IpWare
+
+    IpWare()                      # auto -> modern (the forward-moving default)
+    IpWare(algorithm="modern")    # explicit modern
+    IpWare(algorithm="legacy")    # frozen v3 behavior (escape hatch)
+"""
+
+from typing import Literal, Optional
+
+from .legacy import LegacyIpWare
+from .modern import ModernIpWare
+
+Algorithm = Literal["auto", "modern", "legacy"]
+_VALID = ("auto", "modern", "legacy")
+
+
+class IpWare:
+    """Best-effort client IP resolver with a pluggable algorithm."""
+
+    def __init__(
+        self,
+        precedence: Optional[tuple[str, ...]] = None,
+        leftmost: bool = True,
+        proxy_count: Optional[int] = None,
+        proxy_list: Optional[list[str]] = None,
+        algorithm: Algorithm = "auto",
+    ) -> None:
+        if algorithm not in _VALID:
+            msg = f"algorithm must be one of {_VALID}, got {algorithm!r}"
+            raise ValueError(msg)
+
+        self.algorithm: Algorithm = algorithm
+        # "auto" resolves to "modern": the enhanced engine is the forward-moving
+        # default. "legacy" stays available as an explicit escape hatch.
+        resolved = "modern" if algorithm == "auto" else algorithm
+        self.resolved_algorithm = resolved
+
+        if resolved == "legacy":
+            self._impl = LegacyIpWare(
+                precedence=precedence,
+                leftmost=leftmost,
+                proxy_count=proxy_count,
+                proxy_list=proxy_list,
+            )
+        else:
+            self._impl = ModernIpWare(
+                precedence=precedence,
+                leftmost=leftmost,
+                proxy_count=proxy_count,
+                proxy_list=proxy_list,
+            )
+
+    @property
+    def engine(self) -> "LegacyIpWare | ModernIpWare":
+        """The concrete engine instance selected by ``algorithm`` (read-only)."""
+        return self._impl
+
+    def get_client_ip(self, meta, strict: bool = False):
+        """Delegate to the resolved engine. Returns ``(ip, trusted_route)``."""
+        return self._impl.get_client_ip(meta, strict)
+
+    def __repr__(self) -> str:
+        return (
+            f"IpWare(algorithm={self.algorithm!r} -> "
+            f"{self.resolved_algorithm!r})"
+        )

python_ipware-4.1.0.dist-info/METADATA

@@ -0,0 +1,372 @@
+Metadata-Version: 2.5
+Name: python-ipware
+Version: 4.1.0
+Summary: A Python package to retrieve a client's real IP address.
+Project-URL: Homepage, https://github.com/un33k/python-ipware
+Project-URL: Documentation, https://github.com/un33k/python-ipware#readme
+Project-URL: Repository, https://github.com/un33k/python-ipware
+Project-URL: Issues, https://github.com/un33k/python-ipware/issues
+Project-URL: Changelog, https://github.com/un33k/python-ipware/blob/main/CHANGELOG.md
+Author-email: Val Neekman <info@neekware.com>
+Maintainer-email: Val Neekman <info@neekware.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: client ip,ip,ipware,proxy,python,real ip,remote addr,x-forwarded-for
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: coverage[toml]; extra == 'dev'
+Requires-Dist: ruff==0.16.8; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Provides-Extra: test
+Requires-Dist: coverage[toml]; extra == 'test'
+Requires-Dist: ruff==0.16.8; extra == 'test'
+Description-Content-Type: text/markdown
+
+# Python IPware
+
+Best-effort client IP detection for Python server applications — Django, Flask, or any WSGI/ASGI framework.
+
+[![status-image]][status-link]
+[![version-image]][version-link]
+[![coverage-image]][coverage-link]
+[![maintained-image]][maintained-link]
+
+## Quickstart
+
+```sh
+python -m pip install --upgrade python-ipware
+```
+
+```python
+from python_ipware import IpWare
+
+ipw = IpWare()
+
+# Django: request.META  |  Flask: request.environ
+ip, trusted_route = ipw.get_client_ip(request.META)
+
+if ip:
+    # ip is an ipaddress.IPv4Address or IPv6Address
+    ip.is_global     # publicly routable
+    ip.is_private    # private network
+    ip.is_loopback   # 127.0.0.1 / ::1
+
+if trusted_route:
+    # the request came through your configured proxies (proxy_count / proxy_list)
+    ...
+```
+
+Python 3.9+ is supported (tested on 3.9 – 3.14), with no upper version cap. No runtime dependencies.
+On a newer Python that isn't in the test matrix yet? It should just work — if it doesn't,
+[open an issue](https://github.com/un33k/python-ipware/issues) and we'll fix it.
+
+> **Legacy:** the frozen 3.x algorithm is still available with `IpWare(algorithm="legacy")`.
+> See the [legacy guide](https://github.com/un33k/python-ipware/blob/main/python_ipware/legacy/README.md).
+
+## What it's used for
+
+```mermaid
+flowchart LR
+    R["Incoming request"] --> I["IpWare().get_client_ip(...)"]
+    I --> RL["Rate limiting and throttling"]
+    I --> GEO["Geo-location and localization"]
+    I --> LOG["Audit and access logs"]
+    I --> FR["Abuse and fraud signals<br/>(check trusted_route)"]
+    I --> AUTH["Login anomaly checks<br/>(check trusted_route)"]
+```
+
+## Security notice
+
+> **Found a security issue?** Please email **info@neekware.com** privately — do not open a public
+> issue or pull request. See [SECURITY.md](https://github.com/un33k/python-ipware/blob/main/SECURITY.md).
+
+There is no perfect defense against IP address spoofing. Headers such as `X-Forwarded-For` are set by
+clients and proxies, and can be forged. If you use `python-ipware` for authentication, rate limiting, or
+anti-fraud, configure `proxy_count` and/or `proxy_list` for your network topology and treat it as one
+layer alongside your firewall — never as the only defense.
+
+```mermaid
+sequenceDiagram
+    participant A as Attacker (real IP 8.8.8.8)
+    participant P as Your proxy chain
+    participant App as Your app
+    A->>P: X-Forwarded-For: 1.2.3.4 (forged)
+    P->>App: X-Forwarded-For: 1.2.3.4, 8.8.8.8, 104.16.0.1, 34.120.0.1
+    Note over App: IpWare() trusts the left-most entry and returns 1.2.3.4 (spoofed)
+    Note over App: IpWare(proxy_count=2) counts from the right and returns 8.8.8.8
+    Note over App: Adding strict=True rejects the tampered header entirely
+```
+
+## API
+
+```python
+IpWare(
+    precedence=None,     # tuple of header keys to check, in order
+    leftmost=True,       # client is the left-most IP in the chain
+    proxy_count=None,    # expected number of proxies in front of your server
+    proxy_list=None,     # trusted proxies: CIDR networks or IP prefixes
+)
+
+ip, trusted_route = ipw.get_client_ip(meta, strict=False)
+```
+
+| Parameter | Description |
+| --- | --- |
+| `precedence` | Header keys to search, top to bottom. Defaults to the list below. |
+| `leftmost` | `True` (default) follows the de-facto `client, proxy1, proxy2` order. Use `False` only for networks that put the client right-most. |
+| `proxy_count` | Number of proxies expected after the client. `0` is valid; `None` disables the check. |
+| `proxy_list` | Trusted proxies nearest your server, one entry per hop. Each entry is a CIDR network (`"100.64.0.0/10"`, `"fd7a:115c:a1e0::/48"`), a complete IP matched exactly (`"198.84.193.157"`), or an IP prefix matched on whole octets (`"10.1."`). See [Trusted proxies](#trusted-proxies). |
+| `strict` | `False`: at least `proxy_count` / `proxy_list` proxies. `True`: exactly that many — extra or invalid entries reject the header. |
+
+| Output | Description |
+| --- | --- |
+| `ip` | `IPv4Address`, `IPv6Address`, or `None` |
+| `trusted_route` | `True` when `proxy_count` or `proxy_list` was configured and matched, for any returned IP (v3 only set it for public IPs) |
+
+### Selection rules
+
+Headers are checked in precedence order. Every address is ranked:
+
+| Rank | Addresses |
+| --- | --- |
+| 1. public | globally routable |
+| 2. private | RFC 1918, IPv6 ULA, CGNAT `100.64.0.0/10`, documentation ranges |
+| 3. link-local | `169.254.0.0/16`, `fe80::/10` |
+| 4. loopback | `127.0.0.0/8`, `::1` |
+| never returned | `0.0.0.0`, `::`, multicast, broadcast, reserved |
+
+The first **public** IP wins. If none is found, the best-ranked IP wins, and the earlier header
+wins a tie.
+
+Within one header, the client entry depends on your proxy settings:
+
+- **`proxy_count` / `proxy_list` set:** the entry just before your trusted proxies, exactly as in v3.
+- **Neither set:** the first public entry in the chain, not only the first entry. So
+  `10.0.0.1, 177.139.233.139` yields `177.139.233.139` (v3 returned `10.0.0.1`). With
+  `leftmost=False` the chain is scanned from the right. That public entry may be an upstream proxy
+  rather than the client. If you need to identify private clients (intranet, VPN), set
+  `proxy_count` or `proxy_list` so the client position is fixed.
+
+Every default header can be sent by a client, and the modern engine now also reads `Forwarded`,
+which sits above the CDN headers. Behind a CDN, pass an explicit `precedence` naming that CDN's
+header (see below).
+
+```mermaid
+flowchart TD
+    A["Request headers (...)"] --> B["Take the next header in precedence order"]
+    B --> C{"Header present?"}
+    C -->|no| B
+    C -->|yes| D["Split the chain: client, proxy1, proxy2"]
+    D --> E{"Matches proxy_count and proxy_list?"}
+    E -->|no| B
+    E -->|yes| F["Pick the client entry"]
+    F --> G{"Public IP?"}
+    G -->|yes| H["Return (ip, trusted_route)"]
+    G -->|no| I["Keep if it outranks the current fallback"]
+    I --> B
+    B -->|no headers left| J["Return the best fallback, else None"]
+```
+
+The legacy engine keeps v3's rules. A combination suite checks that the modern engine never returns a
+worse address than legacy for the same input.
+
+Ports are stripped (`1.2.3.4:8080`, `[2001:db8::1]:443`). IPv4-mapped (`::ffff:1.2.3.4`) and NAT64
+well-known-prefix (`64:ff9b::1.2.3.4`) addresses are returned as plain IPv4. RFC 7239 `Forwarded` elements are read by their
+`for=` value (`for="[2001:db8::1]:4711";proto=https`). Malformed tokens such as `[::1`,
+`[::1]junk`, or `1.2.3.4:abc` are rejected rather than truncated. Header names match
+case-insensitively, so lowercase keys (AWS Lambda / API Gateway v2) work too.
+
+## Default header precedence
+
+```python
+(
+    "X_FORWARDED_FOR",           # load balancers / proxies (AWS ELB, etc.)
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_CLIENT_IP",            # Amazon EC2, Heroku
+    "HTTP_X_REAL_IP",
+    "HTTP_X_FORWARDED",          # Squid
+    "HTTP_X_CLUSTER_CLIENT_IP",  # Rackspace LB, Riverbed Stingray
+    "HTTP_FORWARDED_FOR",        # de facto variant
+    "HTTP_FORWARDED",            # RFC 7239
+    "HTTP_CF_CONNECTING_IP",     # Cloudflare
+    "HTTP_TRUE_CLIENT_IP",       # Cloudflare Enterprise, Akamai
+    "HTTP_FASTLY_CLIENT_IP",     # Fastly, Firebase
+    "HTTP_FLY_CLIENT_IP",        # Fly.io
+    "HTTP_X_APPENGINE_USER_IP",  # Google App Engine
+    "X-CLIENT-IP",               # Microsoft Azure
+    "X-REAL-IP",                 # NGINX
+    "X-CLUSTER-CLIENT-IP",       # Rackspace Cloud Load Balancers
+    "X_FORWARDED",
+    "FORWARDED_FOR",
+    "CF-CONNECTING-IP",
+    "TRUE-CLIENT-IP",
+    "FASTLY-CLIENT-IP",
+    "FLY-CLIENT-IP",
+    "FORWARDED",
+    "CLIENT-IP",
+    # added after 4.0.0 — always below every earlier entry, above REMOTE_ADDR
+    "HTTP_X_CLIENT_IP",          # Microsoft Azure (Django/WSGI form)
+    "X-APPENGINE-USER-IP",       # Google App Engine (raw form)
+    "HTTP_X_AZURE_CLIENTIP",     # Azure Front Door
+    "X-AZURE-CLIENTIP",
+    "HTTP_DO_CONNECTING_IP",     # DigitalOcean App Platform
+    "DO-CONNECTING-IP",
+    "HTTP_X_ENVOY_EXTERNAL_ADDRESS",  # Envoy / Istio
+    "X-ENVOY-EXTERNAL-ADDRESS",
+    "REMOTE_ADDR",               # direct connection
+)
+```
+
+Headers released earlier never move. New ones are added only just above `REMOTE_ADDR`, so an
+upgrade can never let a new header outrank one that already resolved your requests.
+
+Narrow it to what your infrastructure actually sets:
+
+```python
+ipw = IpWare(precedence=("HTTP_X_FORWARDED_FOR", "REMOTE_ADDR"))
+```
+
+If **all** your traffic comes through a CDN, put its header first. Only do this when the app is not
+reachable directly, because clients can send these headers themselves:
+
+```python
+# Behind Cloudflare only
+ipw = IpWare(precedence=("HTTP_CF_CONNECTING_IP", "HTTP_X_FORWARDED_FOR", "REMOTE_ADDR"))
+```
+
+## Trusted proxies
+
+If your server sits behind known proxies, pass their IPs or prefixes:
+
+Each entry can be (modern engine):
+
+- **a complete IP**, matched exactly: `"198.84.193.157"` never matches `198.84.193.15x`, and IPv6
+  spelling (case, leading zeros) does not matter;
+- **a CIDR network** (IPv4 or IPv6), matched by membership. This is the recommended form for IPv6;
+- **an IP prefix**, matched on whole octets or groups: `"10.1"` and `"10.1."` match `10.1.x.x` but not
+  `10.100.x.x`. IPv6 prefixes compare against the compressed form (`2001:db8::5`), so prefer CIDR.
+
+IPv4-mapped (`::ffff:a.b.c.d`) and NAT64 (`64:ff9b::a.b.c.d`) hops are unwrapped to IPv4 before matching.
+Misconfiguration raises `ValueError` at construction: a bare string instead of a list, empty or
+non-IP entries, an invalid CIDR, or a negative or non-integer `proxy_count`. `proxy_count` and
+`proxy_list` may both be set: the list fixes the client position, and the count is a hop-count
+requirement (a minimum, or exact when `strict=True`).
+
+```python
+ipw = IpWare(proxy_list=["198.84.193.157"])            # one proxy
+ipw = IpWare(proxy_list=["198.84.193.157", "198.84.193.158"])  # two proxies
+ipw = IpWare(proxy_list=["177.139.", "177.140"])       # prefixes for dynamic IPs
+ipw = IpWare(proxy_list=["100.64.0.0/10"])             # CIDR network (IPv4 or IPv6)
+
+# non-strict — X-Forwarded-For: <fake>, <client>, <proxy1>, <proxy2>
+ip, trusted_route = ipw.get_client_ip(request.META)
+
+# strict — X-Forwarded-For must be exactly: <client>, <proxy1>, <proxy2>
+ip, trusted_route = ipw.get_client_ip(request.META, strict=True)
+```
+
+```mermaid
+flowchart LR
+    RC["Real client<br/>8.8.8.8"] --> LB["Trusted proxy<br/>198.84.193.157"]
+    LB -->|"XFF: 8.8.8.8, 198.84.193.157"| APP["Your app<br/>proxy_list: 198.84.193.157"]
+    FC["Fake client<br/>5.6.7.8"] -->|"bypasses the proxy<br/>XFF: 1.2.3.4 (forged)"| APP
+    APP --> OK["Real request: (8.8.8.8, True)"]
+    APP --> NO["Fake request: (None, False)"]
+```
+
+## Proxy count
+
+If you know how many proxies are in front of you but not their IPs (for example, across providers):
+
+```python
+ipw = IpWare(proxy_count=2)
+
+# non-strict — at least 2 proxies
+ip, trusted_route = ipw.get_client_ip(request.META)
+
+# strict — exactly 2 proxies: <client>, <proxy1>, <proxy2>
+ip, trusted_route = ipw.get_client_ip(request.META, strict=True)
+```
+
+```mermaid
+flowchart LR
+    C["Client<br/>8.8.8.8"] --> P1["Proxy 1<br/>104.16.0.1"] --> P2["Proxy 2<br/>34.120.0.1"] --> APP["Your app<br/>proxy_count=2"]
+    APP --> H1["XFF: 8.8.8.8, 104.16.0.1, 34.120.0.1<br/>returns (8.8.8.8, True)"]
+    APP --> H2["XFF: 1.2.3.4, 8.8.8.8, 104.16.0.1, 34.120.0.1<br/>forged prefix ignored: (8.8.8.8, True)<br/>strict=True: (None, False)"]
+```
+
+Combine both for the tightest check:
+
+```python
+ipw = IpWare(proxy_count=1, proxy_list=["198.84.193.157"])
+```
+
+## Right-most client networks
+
+The [de-facto standard](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For) puts the
+originating client left-most. For the rare network that puts it right-most:
+
+```python
+ipw = IpWare(leftmost=False)
+```
+
+```mermaid
+flowchart LR
+    S["Standard: client, proxy1, proxy2"] -->|"leftmost=True (default)"| A["client = first entry"]
+    R["Reversed: proxy2, proxy1, client"] -->|"leftmost=False"| B["client = last entry"]
+```
+
+See [docs/nginx.md](https://github.com/un33k/python-ipware/blob/main/docs/nginx.md) for an NGINX configuration example.
+
+## Development
+
+```sh
+python -m pip install -e '.[dev]'
+ruff check .
+python -m unittest discover -s tests -p "tests_*.py"   # full suite
+python -m tests.legacy.run_against_legacy             # v3 suite against the legacy engine
+python -m build && python -m twine check dist/*
+```
+
+## License
+
+Released under the [MIT](https://github.com/un33k/python-ipware/blob/main/LICENSE) license.
+
+## Maintenance
+
+`python-ipware` is actively maintained with [Dojo](https://heydojo.ai) ⛩️. The legacy engine is frozen for
+backward compatibility; all improvements target the modern engine. Need support? Reach
+[Neekware Inc.](https://neekware.com) at info@neekware.com.
+
+## Sponsors
+
+[Neekware Inc.](https://neekware.com) — creator of [Dojo Workspace](https://heydojo.ai), your AI workspace for building, learning, and getting things done.
+
+🚀 Created with [Dojo](https://heydojo.ai) ⛩️
+
+[status-image]: https://github.com/un33k/python-ipware/actions/workflows/ci.yml/badge.svg
+[status-link]: https://github.com/un33k/python-ipware/actions/workflows/ci.yml
+[version-image]: https://img.shields.io/pypi/v/python-ipware.svg
+[version-link]: https://pypi.org/project/python-ipware/
+[coverage-image]: https://coveralls.io/repos/github/un33k/python-ipware/badge.svg?branch=main
+[coverage-link]: https://coveralls.io/github/un33k/python-ipware?branch=main
+[maintained-image]: https://img.shields.io/badge/maintained%20with-Dojo%20%E2%9B%A9%EF%B8%8F-1f2937
+[maintained-link]: https://heydojo.ai

python_ipware-4.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+python_ipware/__init__.py,sha256=BuZ3sY_v_GTeXmATXqNc_GqRGVDLGP0mj8pWj_StKrA,199
+python_ipware/__version__.py,sha256=jegJMYuSW90VKiMotVdNAakBvYVPirm-A5oeyJVuhH8,22
+python_ipware/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+python_ipware/router.py,sha256=ZLEBbBW3xoOfrvwFfBx_V8Bp2rF1tA1jAEjSY5Rnbqo,3097
+python_ipware/legacy/README.md,sha256=h33u11bhkvmU3IJMnPE0p6lXI3f6QiYN1RrI3eIFHsk,14519
+python_ipware/legacy/__init__.py,sha256=NuIwZ_yvPVJudz4WttTc9piiPlvxAlS1iooRyX2Kc1w,397
+python_ipware/legacy/engine.py,sha256=IotMZQIGSOu2XCbmdYH4WuhBvXm-lJVJHe3FXylSMvc,12725
+python_ipware/modern/__init__.py,sha256=uzxoWK47NOaeYVizW2-G7pQSXzQ1Zq9fSu2kru9sR70,109
+python_ipware/modern/defaults.py,sha256=pZkXt6iMVUwfklpBzFQFF36Xd2n1_8Xej7VViBW3spY,2032
+python_ipware/modern/engine.py,sha256=7CQL7O9z4dY85k_YmoyW4TxDjtdHODKS9wIZz2Amnjw,10942
+python_ipware/modern/parsers.py,sha256=qHAR5SQwVapsj8zrb76W3yCuybvJJB7enJDUE8XGtag,8081
+python_ipware-4.1.0.dist-info/METADATA,sha256=H_NvIBXdDmpo0L0KlX0jcaEoqixlMwSoPaGW7lrLx7Q,15650
+python_ipware-4.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+python_ipware-4.1.0.dist-info/licenses/LICENSE,sha256=MLpNxpqfTc4TLdcDk3x6k7Vz4lJGBNLV-SxQZlFMDU8,1103
+python_ipware-4.1.0.dist-info/RECORD,,

{python_ipware-3.0.0.dist-info → python_ipware-4.1.0.dist-info}/WHEEL

@@ -1,5 +1,4 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.43.0)
+Generator: hatchling 1.32.4
 Root-Is-Purelib: true
 Tag: py3-none-any
-

python_ipware-3.0.0.dist-info/RECORD

@@ -1,9 +0,0 @@
-python_ipware/__init__.py,sha256=TCZx4mt5Gxr2D_zNU6j0ynopdsAN_v4xeiTWz1OXSpY,87
-python_ipware/__version__.py,sha256=EPmgXOdWKks5S__ZMH7Nu6xpAeVrZpfxaFy4pykuyeI,22
-python_ipware/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-python_ipware/python_ipware.py,sha256=IotMZQIGSOu2XCbmdYH4WuhBvXm-lJVJHe3FXylSMvc,12725
-python_ipware-3.0.0.dist-info/LICENSE,sha256=MLpNxpqfTc4TLdcDk3x6k7Vz4lJGBNLV-SxQZlFMDU8,1103
-python_ipware-3.0.0.dist-info/METADATA,sha256=FMUPREojTP2twlxzbgzD7toAgvmKkbcxuzemFjpFUMY,15420
-python_ipware-3.0.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-python_ipware-3.0.0.dist-info/top_level.txt,sha256=URE4dvjpReJtRHyQpJqoBow5EWt_RqVXFn85B9Tq5Xw,14
-python_ipware-3.0.0.dist-info/RECORD,,

python_ipware-3.0.0.dist-info/top_level.txt

@@ -1 +0,0 @@
-python_ipware