nordisk/holger

server/lib/src/visitors.rs

//! **The per-door, per-repository visitor tally** — the file moved AS IS into
//! edda (`edda_admit::visitors`, edda branch `admit`), where the shared
//! admission trait's lock-free `DayKey` sits beside it. Re-exported here under
//! its old path so every holger caller (`crate::visitors::Visitors`,
//! `client_of`, `client_of_ip`, `now_unix`, …) is unchanged; the tests moved
//! with the code. ONE copy of the construction in the estate.

pub use edda_admit::visitors::*;

/// **The client of a request from `ip`** (SEC-REVIEW 2026-11-01 F1): [`client_of_ip`], and from
/// a peer in the endpoint's `ron_trusted_proxies` (the estate's front dials from its WireGuard
/// address, not loopback) the right-most `X-Forwarded-For` entry that front wrote, believed as
/// from loopback. Both doors (HTTP and gRPC) and the admission layer ask this.
pub fn client_via<'a>(
    ip: Option<std::net::IpAddr>,
    forwarded_for: Option<&'a str>,
    trusted: Option<&crate::listen::AllowList>,
) -> Option<Client<'a>> {
    if let (Some(ip), Some(t)) = (ip, trusted) {
        if t.allows(ip) {
            if let Some(c) = client_of_ip(Some(std::net::Ipv4Addr::LOCALHOST.into()), forwarded_for)
            {
                return Some(c);
            }
        }
    }
    client_of_ip(ip, forwarded_for)
}

#[cfg(test)]
mod trusted_front_tests {
    use super::*;
    use std::net::IpAddr;

    /// **A trusted front's client is the client on the gRPC door too** (SEC-REVIEW 2026-11-01
    /// F1). The front dials from its WireGuard address, not loopback, so `client_of_ip`
    /// ignored `X-Forwarded-For`: every internet client shared one visitor slot and one
    /// admission share. From a peer in `ron_trusted_proxies` the right-most entry is the
    /// client; from any other non-loopback peer it is ignored.
    #[test]
    fn a_trusted_fronts_forwarded_client_is_the_client() {
        let trusted = crate::listen::AllowList::parse(&["10.44.0.1/32".into()]).unwrap();
        let front: IpAddr = "10.44.0.1".parse().unwrap();
        let stranger: IpAddr = "192.0.2.1".parse().unwrap();
        let xff = Some("198.51.100.7, 203.0.113.9");
        let direct = client_of_ip(Some("127.0.0.1".parse().unwrap()), xff);
        assert!(direct.is_some());
        assert_eq!(
            format!("{:?}", client_via(Some(front), xff, Some(&trusted))),
            format!("{direct:?}")
        );
        assert_eq!(
            format!("{:?}", client_via(Some(stranger), xff, Some(&trusted))),
            format!("{:?}", client_of_ip(Some(stranger), xff)),
            "a stranger's X-Forwarded-For is ignored"
        );
        assert_eq!(
            format!("{:?}", client_via(Some(front), xff, None)),
            format!("{:?}", client_of_ip(Some(front), xff)),
            "no trusted proxies: nothing changes"
        );
    }
}