"""Resolve client IP behind reverse proxy (nginx $proxy_add_x_forwarded_for)."""

from __future__ import annotations

from fastapi import Request


def client_ip_from_request(request: Request) -> str:
    """Client IP for rate limiting.

    nginx with ``proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for``
    appends the real peer address as the *last* hop. Spoofed values in the
    incoming header therefore cannot replace the actual client IP.
    """
    if request.client and request.client.host:
        direct = request.client.host.strip()
    else:
        direct = "unknown"

    forwarded = (request.headers.get("x-forwarded-for") or "").strip()
    if not forwarded:
        return direct[:64]

    parts = [part.strip() for part in forwarded.split(",") if part.strip()]
    if not parts:
        return direct[:64]
    return parts[-1][:64]