fix: secure authentication request identity

Replace Better Auth's default trust of a caller-controlled X-Forwarded-For
with a platform-owned client-address resolution boundary: direct mode (the
safe default) trusts only the real socket peer, and an explicit trusted-proxy
mode requires a header name, a concrete trusted-proxy list, and only honors a
forwarded chain from an actual trusted peer. This closes a rate-limit bypass
where rotating a spoofed header let a caller choose a fresh bucket on every
request. Public sign-up is also disabled by default and requires an explicit
typed opt-in, using Better Auth's own disableSignUp gate so no email-existence
leak or second signup path is introduced.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/identity/config.ts

@@ -5,6 +5,7 @@ export type IdentityConfigErrorCode =
   | "BASE_URL_INVALID"
   | "BASE_URL_LOOPBACK_IN_PRODUCTION"
   | "BASE_URL_MISSING"
+  | "PUBLIC_SIGNUP_ENABLED_INVALID"
   | "SECRET_LOW_ENTROPY"
   | "SECRET_MISSING"
   | "SECRET_TOO_SHORT"
@@ -29,6 +30,8 @@ const errorMessages: Readonly<Record<IdentityConfigErrorCode, string>> = Object.
   BASE_URL_LOOPBACK_IN_PRODUCTION:
     "The identity base URL must not resolve to a loopback host in production.",
   BASE_URL_MISSING: "The identity base URL is required.",
+  PUBLIC_SIGNUP_ENABLED_INVALID:
+    'Public signup enablement must be an explicit boolean or the exact string "true"/"false".',
   SECRET_LOW_ENTROPY: "The identity secret does not have sufficient entropy.",
   SECRET_MISSING: "The identity secret is required.",
   SECRET_TOO_SHORT: `The identity secret must be at least ${MIN_SECRET_LENGTH} characters.`,
@@ -61,12 +64,18 @@ export class IdentityConfigError extends Error {
 
 export interface IdentityConfig {
   readonly baseUrl: string;
+  /** Whether `POST /api/auth/sign-up/email` accepts new accounts. Defaults to `false` (disabled) —
+   * public signup never becomes reachable merely because this input was omitted, misspelled, or
+   * loosely parsed. Development and test composition may set this explicitly; production
+   * composition must set it explicitly too, since there is no environment-sensitive default. */
+  readonly publicSignupEnabled: boolean;
   readonly secret: string;
   readonly trustedOrigins: readonly string[];
 }
 
 export interface IdentityConfigInput {
   readonly baseUrl?: unknown;
+  readonly publicSignupEnabled?: unknown;
   readonly secret?: unknown;
   readonly trustedOrigins?: unknown;
 }
@@ -153,6 +162,29 @@ function validateTrustedOrigin(origin: unknown, environment: IdentityEnvironment
   return origin;
 }
 
+/**
+ * Strict, explicit-only parsing: `undefined` is the one safe default (disabled), a genuine boolean
+ * passes straight through for programmatic callers, and the exact lowercase strings `"true"`/
+ * `"false"` are accepted so an environment variable (always a string) can opt in — anything else
+ * (a misspelling, `"1"`, `"yes"`, mixed case, an empty string) is rejected outright rather than
+ * silently coerced to `false` or `true`. There is deliberately no "loosely truthy" branch.
+ */
+function validatePublicSignupEnabled(value: unknown): boolean {
+  if (value === undefined) {
+    return false;
+  }
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (value === "true") {
+    return true;
+  }
+  if (value === "false") {
+    return false;
+  }
+  throw new IdentityConfigError("PUBLIC_SIGNUP_ENABLED_INVALID");
+}
+
 function validateTrustedOrigins(
   trustedOrigins: unknown,
   environment: IdentityEnvironment,
@@ -179,6 +211,7 @@ export function createIdentityConfig(
   const secret = validateSecret(input.secret);
   const baseUrl = validateBaseUrl(input.baseUrl, environment);
   const trustedOrigins = validateTrustedOrigins(input.trustedOrigins, environment);
+  const publicSignupEnabled = validatePublicSignupEnabled(input.publicSignupEnabled);
 
-  return Object.freeze({ baseUrl, secret, trustedOrigins });
+  return Object.freeze({ baseUrl, publicSignupEnabled, secret, trustedOrigins });
 }