import { Injectable, NestMiddleware } from '@nestjs/common';
import { requestContext } from './request-context';

type RequestLike = { headers: Record<string, string | string[] | undefined>; socket?: { remoteAddress?: string } };

@Injectable()
export class RequestContextMiddleware implements NestMiddleware {
  use(request: RequestLike, _response: unknown, next: () => void) {
    const forwarded = request.headers['x-forwarded-for'];
    const firstForwarded = Array.isArray(forwarded) ? forwarded[0] : forwarded?.split(',')[0];
    const remoteAddress = request.socket?.remoteAddress?.trim().replace(/^::ffff:/, '');
    const trustedProxies = new Set((process.env.TRUSTED_PROXY_IPS ?? '127.0.0.1,::1').split(',').map((item) => item.trim()).filter(Boolean));
    // 仅可信反向代理可以声明客户端地址，防止攻击者伪造 X-Forwarded-For 绕过保护名单或嫁祸他人。
    const ipAddress = (remoteAddress && trustedProxies.has(remoteAddress) ? firstForwarded : remoteAddress)?.trim().replace(/^::ffff:/, '');
    requestContext.run({ ipAddress }, next);
  }
}