package com.prudas.app.security;

import jakarta.servlet.http.HttpServletRequest;
import org.springframework.stereotype.Component;

/**
 * Resolves the caller's IP for rate limiting and audit logging.
 *
 * IMPORTANT: X-Forwarded-For is attacker-controlled unless you are
 * definitely behind a reverse proxy that overwrites it (nginx, an ALB,
 * Cloudflare, etc). Only trust it in that topology — see docs/SECURITY.md.
 * The default here uses getRemoteAddr() (safe) and only prefers the
 * forwarded header when TRUST_PROXY_HEADERS=true is explicitly set.
 */
@Component
public class ClientIpResolver {

    private final boolean trustProxyHeaders = Boolean.parseBoolean(System.getenv().getOrDefault("TRUST_PROXY_HEADERS", "false"));

    public String resolve(HttpServletRequest request) {
        if (trustProxyHeaders) {
            String forwarded = request.getHeader("X-Forwarded-For");
            if (forwarded != null && !forwarded.isBlank()) {
                return forwarded.split(",")[0].trim();
            }
        }
        return request.getRemoteAddr();
    }
}