import { isLoopbackHost } from "../host.js";
//#region src/gateway/security/loopback.ts
/**
* Loopback / browser-origin classification helpers used by rate-limit policy
* and other security middleware. Pure functions, no I/O.
*/
function isLoopbackClientIp(clientIp) {
	if (!clientIp || clientIp === "unknown") return false;
	const trimmed = clientIp.trim();
	if (trimmed.includes(":") && !trimmed.includes(".")) return isLoopbackHost(trimmed.replace(/^\[/, "").replace(/\]$/, ""));
	return isLoopbackHost(trimmed.split(":")[0]);
}
/** Browser Origin header points at the local gateway console. */
function isLoopbackBrowserOrigin(origin) {
	const trimmed = origin?.trim();
	if (!trimmed || trimmed === "null") return false;
	try {
		return isLoopbackHost(new URL(trimmed).hostname);
	} catch {
		return false;
	}
}
/** Same-machine browser hitting the local gateway (Electron / local dev). */
function isLoopbackEmbeddedBrowserClient(origin, clientIp) {
	if (!isLoopbackBrowserOrigin(origin)) return false;
	if (clientIp === "unknown") return true;
	return isLoopbackClientIp(clientIp);
}
/** Read X-Forwarded-For / X-Real-IP / CF-Connecting-IP. */
function getClientIpFromHeaders(headers) {
	const xff = headers.get("x-forwarded-for");
	if (xff) {
		const first = xff.split(",")[0]?.trim();
		if (first) return first;
	}
	const real = headers.get("x-real-ip")?.trim();
	if (real) return real;
	const cf = headers.get("cf-connecting-ip")?.trim();
	if (cf) return cf;
	return "unknown";
}
//#endregion
export { getClientIpFromHeaders, isLoopbackBrowserOrigin, isLoopbackClientIp, isLoopbackEmbeddedBrowserClient };

//# sourceMappingURL=loopback.js.map