"""Network helpers shared by the auth middleware and rate limiter."""

from __future__ import annotations

import os

from fastapi import Request

__all__ = ["get_client_ip", "is_trusted_proxy"]


def is_trusted_proxy() -> bool:
    """Whether ``X-Forwarded-For`` should be trusted (reverse proxy in front)."""
    return os.environ.get("OBSIGATE_TRUST_PROXY", "false").lower() == "true"


def get_client_ip(request: Request) -> str:
    """Return the best-known client IP for *request*.

    When ``OBSIGATE_TRUST_PROXY=true`` the left-most ``X-Forwarded-For`` entry
    is used (the original client behind the proxy).  Otherwise the socket peer
    address is returned.  BUG-030: this value feeds the audit log so attacks
    remain traceable.
    """
    if is_trusted_proxy():
        forwarded = request.headers.get("x-forwarded-for")
        if forwarded:
            first = forwarded.split(",")[0].strip()
            if first:
                return first
        real_ip = request.headers.get("x-real-ip")
        if real_ip:
            return real_ip.strip()
    return request.client.host if request.client else "unknown"