feat: add trusted proxy identity and overload stats

middleware/middleware.go

@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"fmt"
-	"net/http"
 	"time"
 
 	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
@@ -64,19 +63,9 @@ func AccessLog() httpx.Middleware {
 				"route", httpx.RoutePattern(ctx.Context()),
 				"status", status,
 				"durationMs", time.Since(started).Seconds()*1000,
-				"clientIp", clientIP(ctx.Request()),
+				"clientIp", ctx.ClientIP(),
 			)
 			return err
 		}
 	}
 }
-
-func clientIP(request *http.Request) string {
-	if request == nil {
-		return ""
-	}
-	if value := request.Header.Get("X-Forwarded-For"); value != "" {
-		return value
-	}
-	return request.RemoteAddr
-}

middleware/middleware_test.go

@@ -55,3 +55,34 @@ func TestAccessLogReportsCommittedStatus(t *testing.T) {
 		})
 	}
 }
+
+func TestAccessLogUsesVerifiedClientIP(t *testing.T) {
+	loggerOutput := bytes.Buffer{}
+	logger, err := logx.New(logx.Config{Format: "json", Writer: &loggerOutput})
+	if err != nil {
+		t.Fatal(err)
+	}
+	logx.SetDefault(logger)
+	defer logx.SetDefault(nil)
+	resolver, err := httpx.NewClientIPResolver("127.0.0.1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest("GET", "/health", nil)
+	request.RemoteAddr = "127.0.0.1:443"
+	request.Header.Set("X-Forwarded-For", "198.51.100.7")
+	request = request.WithContext(httpx.WithClientIPResolver(request.Context(), resolver))
+	ctx := httpx.NewContext(request, httptest.NewRecorder(), nil)
+	if err := middleware.AccessLog()(func(c *httpx.Context) error { return c.OK("ok") })(ctx); err != nil {
+		t.Fatal(err)
+	}
+	var entry struct {
+		ClientIP string `json:"clientIp"`
+	}
+	if err := json.Unmarshal(loggerOutput.Bytes(), &entry); err != nil {
+		t.Fatal(err)
+	}
+	if entry.ClientIP != "198.51.100.7" {
+		t.Fatalf("expected verified client IP, got %q", entry.ClientIP)
+	}
+}