ip geolocation + ping analysis

src/lib/auth/client-ip.ts

@@ -0,0 +1,16 @@
+/**
+ * Best-effort client IP for rate limiting behind a reverse proxy.
+ * Falls back to a sentinel when unknown so attempts are still counted.
+ */
+export function getClientIp(request: Request): string {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+
+  const realIp = request.headers.get("x-real-ip")?.trim();
+  if (realIp) return realIp;
+
+  return "unknown";
+}