fix(http)!: key on the hop the proxy wrote, not the one the client sent

[catomean]

clientIp returned the first x-forwarded-for hop, with a comment asserting that was "what the proxy saw" and a test pinning it. Both were wrong in the same direction.

A reverse proxy appends to X-Forwarded-For — Caddy and nginx both do. So for a request through one proxy the header reads <whatever the client sent>, <what the proxy actually saw>, and the only entry a client cannot forge is the last.

The effect, in every adopter at once

Send a random X-Forwarded-For with each request and every request lands in a fresh bucket, so no bucket ever fills. Not "weakened" — bypassed completely. A limiter that can't be tripped is worse than none, because the route reads as protected.

// before: three requests from one client, three different keys
clientIp(h({ 'x-forwarded-for': '1.1.1.1, 203.0.113.7' }))  // '1.1.1.1'  ← attacker's value
clientIp(h({ 'x-forwarded-for': '2.2.2.2, 203.0.113.7' }))  // '2.2.2.2'
// after: one key, every time
                                                            // '203.0.113.7'

Found in orangecat's payments audit (bitbaum/orangecat#563, finding 2), where the same mistake is copied across three payment routes that each mint a real Lightning invoice per request.

The fix

Counts from the right. trustedProxies (default 1) says how many proxies of your own sit in front; a CDN in front of Caddy is 2 and moves the answer one further left. trustedProxies: 0 means the server is exposed directly, so every forwarded header is client-written and none is evidence — the result is "unknown" rather than a number that looks like proof.

Verified against the real topology, not assumed

DNS for orangecat.ch resolves straight to the box, no CDN in front (via: 1.1 Caddy), one Caddy 2.11.4 with no trusted_proxies configured — so exactly one hop is appended, and the default of 1 is correct for this fleet.

Breaking

The returned identity changes behind a proxy — which is the point. v0.2.0. Adopters pinning #v0.1.0 keep the bypass until they move; fleetcrown is the one current adopter and needs its pin bumped.

npm run verify green — lint, typecheck, build, 16 tests (7 new, covering the spoofed-prefix bypass, trustedProxies 0/2/over-length, and separators-only input).