feat: harden prepaid billing and commercial operations

1 files changed, 44 insertions, 0 deletions

diff --git a/internal/httpapi/proxy.go b/internal/httpapi/proxy.go
new file mode 100644
index 0000000..3cd2797
--- /dev/null
+++ b/internal/httpapi/proxy.go
@@ -0,0 +1,44 @@
+package httpapi
+
+import (
+	"net"
+	"net/http"
+	"strings"
+)
+
+// TrustProxyHeaders accepts forwarding metadata only from explicitly trusted
+// CIDRs. This prevents a direct client from forging HTTPS or audit IP state.
+func TrustProxyHeaders(next http.Handler, trustedCIDRs []string, requireHTTPS bool) (http.Handler, error) {
+	trusted := make([]*net.IPNet, 0, len(trustedCIDRs))
+	for _, value := range trustedCIDRs {
+		_, network, err := net.ParseCIDR(value)
+		if err != nil {
+			return nil, err
+		}
+		trusted = append(trusted, network)
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		host, _, _ := net.SplitHostPort(r.RemoteAddr)
+		remote := net.ParseIP(host)
+		trustedPeer := false
+		for _, network := range trusted {
+			if remote != nil && network.Contains(remote) {
+				trustedPeer = true
+				break
+			}
+		}
+		if !trustedPeer {
+			for _, header := range []string{"Forwarded", "X-Forwarded-For", "X-Forwarded-Host", "X-Forwarded-Port", "X-Forwarded-Proto", "X-Real-IP"} {
+				r.Header.Del(header)
+			}
+		} else if forwarded := strings.TrimSpace(strings.Split(r.Header.Get("X-Forwarded-For"), ",")[0]); net.ParseIP(forwarded) != nil {
+			r.RemoteAddr = net.JoinHostPort(forwarded, "0")
+		}
+		secure := r.TLS != nil || (trustedPeer && strings.EqualFold(strings.TrimSpace(r.Header.Get("X-Forwarded-Proto")), "https"))
+		if requireHTTPS && !secure {
+			http.Error(w, "HTTPS is required", http.StatusUpgradeRequired)
+			return
+		}
+		next.ServeHTTP(w, r)
+	}), nil
+}