Gate forwarded-header trust behind trusted-proxy config (closes #88)

All three rate limiters (receiver, login, password change) now key on the connection's own address unless the direct peer is inside the new TRUSTED_PROXIES CIDR list, in which case X-Forwarded-For is walked right to left for the first non-proxy hop. Default is the empty list, which trusts nothing. A set-but-unparseable value aborts startup.

internal/config/config.go

@@ -5,8 +5,10 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net/netip"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	"go.uber.org/fx"
@@ -45,6 +47,11 @@ const (
 	// maxPort is the highest valid TCP port number. The lower
 	// bound (at least 1) is enforced by envPositiveInt.
 	maxPort = 65535
+
+	// mappedV4Offset is the number of leading bits an IPv4-mapped
+	// IPv6 prefix spends on the ::ffff:0:0/96 wrapper, so a /104
+	// covers the same addresses as an IPv4 /8.
+	mappedV4Offset = 96
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
@@ -59,6 +66,11 @@ var ErrNonPositiveValue = errors.New("value must be positive")
 // TCP port number is set above the valid port range.
 var ErrInvalidPort = errors.New("invalid port")
 
+// ErrInvalidCIDR is returned when an environment variable holding a
+// list of CIDR blocks contains an entry that is neither a CIDR block
+// nor a bare IP address.
+var ErrInvalidCIDR = errors.New("invalid CIDR")
+
 //nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
@@ -90,6 +102,17 @@ type Config struct {
 	// client IP may send to a single webhook receiver entrypoint.
 	ReceiverRateLimit int
 
+	// TrustedProxies is the set of networks whose members are
+	// allowed to speak for the client with X-Forwarded-For, the
+	// only forwarded header read. It is empty unless
+	// TRUSTED_PROXIES is set, and empty means no peer is
+	// trusted: forwarded headers are then ignored entirely and
+	// clients are identified by the connection's own address.
+	// Members can choose their own rate-limit key, so this must
+	// name proxy hosts only, never a block that also covers
+	// clients.
+	TrustedProxies []netip.Prefix
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -212,6 +235,71 @@ func envDuration(
 	return d, nil
 }
 
+// parseCIDR parses one trusted-proxy list entry, which may be a
+// CIDR block ("10.0.0.0/8") or a bare address ("10.0.0.1", treated
+// as a single-host block).
+//
+// Both forms are unmapped, because peer addresses are unmapped
+// before they are matched against the list: an IPv4-mapped prefix
+// left in that form would silently never match.
+func parseCIDR(entry string) (netip.Prefix, error) {
+	if strings.Contains(entry, "/") {
+		prefix, err := netip.ParsePrefix(entry)
+		if err != nil {
+			return netip.Prefix{}, err //nolint:wrapcheck // wrapped by caller
+		}
+
+		if addr := prefix.Addr(); addr.Is4In6() &&
+			prefix.Bits() >= mappedV4Offset {
+			prefix = netip.PrefixFrom(
+				addr.Unmap(), prefix.Bits()-mappedV4Offset,
+			)
+		}
+
+		return prefix.Masked(), nil
+	}
+
+	addr, err := netip.ParseAddr(entry)
+	if err != nil {
+		return netip.Prefix{}, err //nolint:wrapcheck // wrapped by caller
+	}
+
+	return netip.PrefixFrom(addr.Unmap(), addr.Unmap().BitLen()), nil
+}
+
+// envPrefixList returns the value of the named environment variable
+// parsed as a comma-separated list of CIDR blocks (bare addresses
+// allowed). An unset, empty, or blank value yields an empty list. A
+// set value containing an unparseable entry is a hard error naming
+// the key and the bad entry, so startup fails loudly rather than
+// silently running with a list the operator did not intend.
+func envPrefixList(key string) ([]netip.Prefix, error) {
+	v := strings.TrimSpace(os.Getenv(key))
+	if v == "" {
+		return nil, nil
+	}
+
+	var prefixes []netip.Prefix
+
+	for entry := range strings.SplitSeq(v, ",") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+
+		prefix, err := parseCIDR(entry)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"%w: %s: %q: %w", ErrInvalidCIDR, key, entry, err,
+			)
+		}
+
+		prefixes = append(prefixes, prefix)
+	}
+
+	return prefixes, nil
+}
+
 // resolveEnvironment reads WEBHOOKER_ENVIRONMENT, defaulting to
 // dev, and rejects unrecognised values.
 func resolveEnvironment() (string, error) {
@@ -282,6 +370,11 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
+	trustedProxies, err := envPrefixList("TRUSTED_PROXIES")
+	if err != nil {
+		return nil, err
+	}
+
 	return &Config{
 		DataDir:                envString("DATA_DIR"),
 		Debug:                  debug,
@@ -294,6 +387,7 @@ func loadFromEnv() (*Config, error) {
 		RetentionSweepInterval: retentionSweepInterval,
 		SessionIdleTimeout:     sessionIdleTimeout,
 		ReceiverRateLimit:      receiverRateLimit,
+		TrustedProxies:         trustedProxies,
 	}, nil
 }
 
@@ -335,6 +429,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"dataDir", s.DataDir,
 		"retentionSweepInterval", s.RetentionSweepInterval.String(),
 		"receiverRateLimit", s.ReceiverRateLimit,
+		"trustedProxies", len(s.TrustedProxies),
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth",
 		s.MetricsUsername != "" && s.MetricsPassword != "",