fix: Client-IP haerten (CF-Connecting-IP, X-Real-IP, Admin-Session)

- CF-Connecting-IP gilt nur noch als oeffentliche Unicast-Adresse
  (nicht 0/8, 10/8, 100.64/10, 127/8, 169.254/16, 172.16/12,
  192.168/16, 240/4, Broadcast, ::, ::1, fc00::/7, fe80::/10,
  ::ffff:privat); sonst gilt die Gegenstelle.
- X-Real-IP ohne X-Forwarded-For nur noch ausserhalb von Produktion;
  in Produktion ergibt das "unknown".
- Neuer Helfer headersWithClientIp, von withClientIp und der
  Admin-Session-Pruefung genutzt: ein vom Client gesendeter
  x-artista-client-ip-Wert wird nie geglaubt.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

tests/client-ip.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, test } from "vitest";
-import { CLIENT_IP_HEADER, clientIp, rateLimitSubject, withClientIp } from "@/lib/rate-limit";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { CLIENT_IP_HEADER, clientIp, headersWithClientIp, rateLimitSubject, withClientIp } from "@/lib/rate-limit";
 
 const h = (values: Record<string, string>) => new Headers(values);
 
@@ -42,3 +42,47 @@ describe("clientIp hinter Traefik", () => {
     expect(withClientIp(request).headers.get(CLIENT_IP_HEADER)).toBe("198.51.100.9");
   });
 });
+
+describe("CF-Connecting-IP nur als öffentliche Unicast-Adresse", () => {
+  const edge = "172.70.1.2";
+  const viaEdge = (cf: string) => clientIp(h({ "x-forwarded-for": `1.2.3.4, ${edge}`, "cf-connecting-ip": cf }));
+
+  test.each([
+    "0.1.2.3", "10.0.0.5", "100.64.0.1", "100.127.255.255", "127.0.0.1", "169.254.1.1", "172.16.0.1", "172.31.255.255",
+    "192.168.1.1", "240.0.0.1", "255.255.255.255", "::", "::1", "fc00::1", "fd12::1", "fe80::1", "::ffff:10.0.0.1", "::ffff:192.168.0.1",
+  ])("%s wird verworfen, die Gegenstelle gilt", (cf) => {
+    expect(viaEdge(cf)).toBe(edge);
+  });
+
+  test.each(["203.0.113.7", "100.63.255.255", "172.32.0.1", "2001:db8::1", "::ffff:203.0.113.7"])("%s wird übernommen", (cf) => {
+    expect(viaEdge(cf)).toBe(cf);
+  });
+});
+
+describe("X-Real-IP in Produktion", () => {
+  afterEach(() => vi.unstubAllEnvs());
+
+  test("ohne X-Forwarded-For ergibt X-Real-IP in Produktion „unknown“", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    expect(clientIp(h({ "x-real-ip": "198.51.100.9" }))).toBe("unknown");
+    expect(clientIp(h({ "x-forwarded-for": "198.51.100.9" }))).toBe("198.51.100.9");
+  });
+
+  test("außerhalb von Produktion gilt X-Real-IP weiter", () => {
+    vi.stubEnv("NODE_ENV", "development");
+    expect(clientIp(h({ "x-real-ip": "198.51.100.9" }))).toBe("198.51.100.9");
+  });
+});
+
+describe("headersWithClientIp", () => {
+  test("überschreibt einen mitgeschickten Wert und lässt das Original unverändert", () => {
+    const original = h({ "x-forwarded-for": "1.2.3.4, 198.51.100.9", [CLIENT_IP_HEADER]: "1.2.3.4" });
+    const result = headersWithClientIp(original);
+    expect(result.get(CLIENT_IP_HEADER)).toBe("198.51.100.9");
+    expect(original.get(CLIENT_IP_HEADER)).toBe("1.2.3.4");
+  });
+
+  test("ohne ermittelbare IP steht „unknown“ im Header, nie der Clientwert", () => {
+    expect(headersWithClientIp(h({ [CLIENT_IP_HEADER]: "1.2.3.4" })).get(CLIENT_IP_HEADER)).toBe("unknown");
+  });
+});