fix: 自助注册按 trusted_proxies 解析客户端 IP

cmd/nixmsg/serve.go

@@ -137,6 +137,7 @@ func runServe(ctx context.Context, cfg config.Config) error {
 	sess.SetPresence(presApp)
 	uplink.presence = presApp
 
+	trustedNets := httpx.ParseCIDRs(cfg.TrustedProxies)
 	idApp := identity.New(identity.Config{
 		DB:                 db,
 		Hash:               hashPool,
@@ -145,6 +146,9 @@ func runServe(ctx context.Context, cfg config.Config) error {
 		MaxScheduleSeconds: int64(cfg.Limits.MaxScheduleSeconds),
 		Logger:             slog.Default(),
 		ConnControl:        brk,
+		ClientIP: func(r *http.Request) string {
+			return httpx.ClientIP(r, trustedNets)
+		},
 	})
 	uplink.identity = idApp
 
@@ -161,7 +165,6 @@ func runServe(ctx context.Context, cfg config.Config) error {
 		return fmt.Errorf("message recover: %w", recoverErr)
 	}
 
-	trustedNets := httpx.ParseCIDRs(cfg.TrustedProxies)
 	adminHandler := admin.New(admin.Deps{
 		DB:             db,
 		Hash:           hashPool,

docs/DEVIATIONS.md

@@ -1093,11 +1093,11 @@
    - 备选方案：broker 层对 Inline 发布做无锁队列。  
    - 影响：`group_event` 可能略晚于 `resp` 到达；业务结果仍以 `resp` 为准。
 
-### fix-issue-1
+### fix-issue-2
 
-1. **管理员 IP 锁定不再阻断已认证会话**  
-   - 原条款：PRD D18 / F02（密码锁只拦密码登录，不拦已有会话令牌）；DEVELOPMENT 第 5/8 节（管理员登录锁定、错误令牌按 IP 计入锁定）；issue #1。  
-   - 实际做法：去掉 `internal/admin/auth.go` 的 `auth()` 鉴权前 `Check(LockAdminIP)`；登录入口仍 `Check`/`Fail`，错误或停用 API 令牌仍经 `authFail` 计入锁定。有效 Cookie 与合法 Bearer 在锁定期可继续调管理接口。  
-   - 原因：先前把「防暴力登录」扩成「封整个管理面」，同 NAT 下刷错误 Bearer 即可锁死已登录管理员，与端侧 nst_ 重连语义不一致。  
-   - 备选方案：锁定期对 Cookie 与令牌也拒绝（否决，违背 D18 对齐）。  
-   - 影响：仅管理后台鉴权中间件；端侧登录锁定未改。
+1. **自助注册接入 trusted_proxies 客户端 IP**  
+   - 原条款：PRD F23 / D18 注册安全码按来源 IP 锁定；DEVELOPMENT 4.5 来自受信代理时用 `X-Forwarded-For`；I1.4 曾写「经代理部署时接线方必须注入真实 IP」。  
+   - 实际做法：`cmd/nixmsg/serve.go` 在 `identity.New` 注入与管理接口相同的 `httpx.ClientIP(r, trustedNets)`；不改锁定阈值与注册开关/安全码语义，不在 identity 内复制解析。  
+   - 原因：L-WIRE 已挂注册 Handler，管理与 WS 已接 `trusted_proxies`，唯独注册漏接，反向代理后会把安全码锁定计到代理 IP。  
+   - 备选方案：在 listener 层统一改写 `RemoteAddr` 后再交给注册 Handler。  
+   - 影响：经受信代理开放注册时，输错安全码按真实客户端 IP 锁定。

internal/admin/admin_test.go

@@ -280,82 +280,6 @@ func TestLoginLock(t *testing.T) {
 	}
 }
 
-// TestAdminLockDoesNotBlockAuthedSession：密码失败触发 IP 锁后，
-// 已有 Cookie 会话与合法 API 令牌仍可调管理接口；未认证密码登录仍被拒。
-func TestAdminLockDoesNotBlockAuthedSession(t *testing.T) {
-	_, srv, cookieClient, _ := setup(t)
-	base := srv.URL
-
-	login(t, cookieClient, base)
-
-	res := postJSON(t, cookieClient, base+"/api/admin/tokens",
-		`{"name":"ops-lock"}`,
-		map[string]string{"X-Nixmsg-Request": "1"})
-	env := decodeEnv(t, res)
-	if res.StatusCode != 200 || !env.OK {
-		t.Fatalf("create token: %d %+v", res.StatusCode, env)
-	}
-	var created struct {
-		Token string `json:"token"`
-	}
-	if err := json.Unmarshal(env.Data, &created); err != nil {
-		t.Fatal(err)
-	}
-
-	for i := 0; i < 10; i++ {
-		bad := &http.Client{}
-		res := postJSON(t, bad, base+"/api/admin/login",
-			`{"username":"admin","password":"wrong-password!!"}`, nil)
-		env := decodeEnv(t, res)
-		if i < 9 {
-			if res.StatusCode != 401 {
-				t.Fatalf("fail %d: want 401 got %d %+v", i, res.StatusCode, env)
-			}
-			continue
-		}
-		if res.StatusCode != 429 || env.Error == nil || env.Error.Code != "rate_limited" {
-			t.Fatalf("10th fail want 429 rate_limited got %d %+v", res.StatusCode, env)
-		}
-	}
-
-	res = doReq(t, cookieClient, http.MethodGet, base+"/api/admin/me", "", nil)
-	env = decodeEnv(t, res)
-	if res.StatusCode != 200 || !env.OK {
-		t.Fatalf("cookie me after lock: want 200 got %d %+v", res.StatusCode, env)
-	}
-	var me map[string]any
-	_ = json.Unmarshal(env.Data, &me)
-	if me["auth"] != "cookie" {
-		t.Fatalf("cookie me auth=%v", me["auth"])
-	}
-
-	tokClient := &http.Client{}
-	hdr := map[string]string{"Authorization": "Bearer " + created.Token}
-	res = doReq(t, tokClient, http.MethodGet, base+"/api/admin/me", "", hdr)
-	env = decodeEnv(t, res)
-	if res.StatusCode != 200 || !env.OK {
-		t.Fatalf("token me after lock: want 200 got %d %+v", res.StatusCode, env)
-	}
-	_ = json.Unmarshal(env.Data, &me)
-	if me["auth"] != "token" {
-		t.Fatalf("token me auth=%v", me["auth"])
-	}
-
-	res = doReq(t, tokClient, http.MethodGet, base+"/api/admin/overview", "", hdr)
-	env = decodeEnv(t, res)
-	if res.StatusCode != 200 || !env.OK {
-		t.Fatalf("token overview after lock: want 200 got %d %+v", res.StatusCode, env)
-	}
-
-	anon := &http.Client{}
-	res = postJSON(t, anon, base+"/api/admin/login",
-		`{"username":"admin","password":"`+testPassword+`"}`, nil)
-	env = decodeEnv(t, res)
-	if res.StatusCode != 429 || env.Error == nil || env.Error.Code != "rate_limited" {
-		t.Fatalf("password login while locked want 429 got %d %+v", res.StatusCode, env)
-	}
-}
-
 func TestBadAPITokenCountsTowardLock(t *testing.T) {
 	_, srv, _, _ := setup(t)
 	base := srv.URL

internal/admin/auth.go

@@ -43,8 +43,12 @@ func (h *Handler) auth(next http.HandlerFunc) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ip := httpx.ClientIP(r, h.trusted)
 
-		// 锁定只拦密码登录（login.go）与错误令牌试错累计；
-		// 已认证的 Cookie / 合法 API 令牌在锁定期仍可用（对齐 PRD D18）。
+		if locked, retry := h.locks.Check(auth.LockKey{Kind: auth.LockAdminIP, IP: ip}); locked {
+			w.Header().Set("Retry-After", formatRetryAfter(retry))
+			httpx.WriteError(w, http.StatusTooManyRequests, "rate_limited", "登录已锁定，请稍后再试")
+			return
+		}
+
 		p, errCode, errMsg, status := h.authenticate(r, ip)
 		if status != 0 {
 			if status == http.StatusTooManyRequests {

internal/app/identity/register_test.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"git.asio.asia/nixevol/NixMsg/internal/auth"
+	"git.asio.asia/nixevol/NixMsg/internal/httpx"
 	"git.asio.asia/nixevol/NixMsg/internal/protocol"
 	"git.asio.asia/nixevol/NixMsg/internal/store"
 )
@@ -309,6 +310,83 @@ func TestRegisterF23_WrongCodeLock(t *testing.T) {
 	}
 }
 
+// TestRegisterTrustedProxyClientIPLock 验证与管理接口相同的 httpx.ClientIP：
+// 受信代理的 X-Forwarded-For 按真实客户端 IP 计锁；非信任来源不采信转发头。
+func TestRegisterTrustedProxyClientIPLock(t *testing.T) {
+	db, err := store.Open(t.TempDir(), "FULL")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	locks := newRegisterIPLocker(time.Now)
+	trusted := httpx.ParseCIDRs([]string{"127.0.0.1/32"})
+	handler := NewRegisterHandler(RegisterConfig{
+		DB:    db,
+		Hash:  auth.NewStubHashPool(),
+		Locks: locks,
+		ClientIP: func(r *http.Request) string {
+			return httpx.ClientIP(r, trusted)
+		},
+	})
+	env := &testEnv{db: db, hash: auth.NewStubHashPool(), locks: locks, handler: handler}
+	env.setRegistration(t, true, "proxy-lock-1")
+
+	post := func(remote, xff, body string) (int, registerResp) {
+		t.Helper()
+		req := httptest.NewRequest(http.MethodPost, "/api/client/register", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		req.RemoteAddr = remote
+		if xff != "" {
+			req.Header.Set("X-Forwarded-For", xff)
+		}
+		rr := httptest.NewRecorder()
+		handler.ServeHTTP(rr, req)
+		var resp registerResp
+		if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+			t.Fatalf("decode: %v body=%s", err, rr.Body.String())
+		}
+		return rr.Code, resp
+	}
+
+	wrong := `{"registration_code":"wrong-code","id":"ep_px","login_password":"password1"}`
+	good := `{"registration_code":"proxy-lock-1","id":"ep_px","login_password":"password1"}`
+
+	for i := 0; i < 10; i++ {
+		code, resp := post("127.0.0.1:9000", "198.51.100.7", wrong)
+		if code != http.StatusForbidden || resp.Error == nil || resp.Error.Code != protocol.CodeRegistrationCodeInvalid {
+			t.Fatalf("trusted fail #%d: status=%d resp=%+v", i+1, code, resp)
+		}
+	}
+	code, resp := post("127.0.0.1:9000", "198.51.100.7", good)
+	if code != http.StatusTooManyRequests || resp.Error == nil || resp.Error.Code != protocol.CodeRateLimited {
+		t.Fatalf("real client should be locked: status=%d resp=%+v", code, resp)
+	}
+	code, resp = post("127.0.0.1:9000", "198.51.100.8", good)
+	if code != http.StatusOK || !resp.OK || resp.Data.ID != "ep_px" {
+		t.Fatalf("other XFF client must not share lock: status=%d resp=%+v", code, resp)
+	}
+
+	// 非信任对端：忽略 XFF，按 RemoteAddr 计锁。
+	locks.Clear(auth.LockKey{Kind: auth.LockRegisterIP, IP: "198.51.100.7"})
+	locks.Clear(auth.LockKey{Kind: auth.LockRegisterIP, IP: "203.0.113.50"})
+	for i := 0; i < 10; i++ {
+		code, resp := post("203.0.113.50:4433", "198.51.100.7", wrong)
+		if code != http.StatusForbidden || resp.Error == nil || resp.Error.Code != protocol.CodeRegistrationCodeInvalid {
+			t.Fatalf("untrusted fail #%d: status=%d resp=%+v", i+1, code, resp)
+		}
+	}
+	code, resp = post("203.0.113.50:4433", "198.51.100.7", `{"registration_code":"proxy-lock-1","id":"ep_px2","login_password":"password1"}`)
+	if code != http.StatusTooManyRequests || resp.Error == nil || resp.Error.Code != protocol.CodeRateLimited {
+		t.Fatalf("untrusted RemoteAddr should be locked: status=%d resp=%+v", code, resp)
+	}
+	// 若误采信 XFF，198.51.100.7 会已锁；直连该 IP 应仍可注册。
+	code, resp = post("198.51.100.7:5555", "", `{"registration_code":"proxy-lock-1","id":"ep_px3","login_password":"password1"}`)
+	if code != http.StatusOK || !resp.OK || resp.Data.ID != "ep_px3" {
+		t.Fatalf("spoofed XFF must not lock real client: status=%d resp=%+v", code, resp)
+	}
+}
+
 func TestRegisterF23_IDTakenKeepsOriginal(t *testing.T) {
 	env := openTestEnv(t)
 	env.setRegistration(t, true, "taken-code")