fix: secure authentication request identity

Replace Better Auth's default trust of a caller-controlled X-Forwarded-For
with a platform-owned client-address resolution boundary: direct mode (the
safe default) trusts only the real socket peer, and an explicit trusted-proxy
mode requires a header name, a concrete trusted-proxy list, and only honors a
forwarded chain from an actual trusted peer. This closes a rate-limit bypass
where rotating a spoofed header let a caller choose a fresh bucket on every
request. Public sign-up is also disabled by default and requires an explicit
typed opt-in, using Better Auth's own disableSignUp gate so no email-existence
leak or second signup path is introduced.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/tests/identity-runtime.test.ts

@@ -9,14 +9,20 @@ vi.mock("better-auth", () => ({ betterAuth: betterAuthMock }));
 vi.mock("better-auth/adapters/drizzle", () => ({ drizzleAdapter: drizzleAdapterMock }));
 
 import type { IdentityConfig } from "../src/identity/config.js";
-import { createIdentityRuntime, IdentityRuntimeError } from "../src/identity/runtime.js";
+import {
+  createIdentityRuntime,
+  IdentityRuntimeError,
+  TRUSTED_CLIENT_ADDRESS_HEADER,
+} from "../src/identity/runtime.js";
 import { identityAdapterSchema } from "../src/identity/schema.js";
 
-function validConfig(): IdentityConfig {
+function validConfig(overrides: Partial<IdentityConfig> = {}): IdentityConfig {
   return Object.freeze({
     baseUrl: "https://identity.example.test",
+    publicSignupEnabled: false,
     secret: "correct-horse-battery-staple-0123456789",
     trustedOrigins: Object.freeze(["https://identity.example.test"]),
+    ...overrides,
   });
 }
 
@@ -87,7 +93,7 @@ describe("Core identity runtime construction boundary", () => {
     ]);
     expect(options.emailAndPassword).toEqual({
       autoSignIn: false,
-      disableSignUp: false,
+      disableSignUp: true,
       enabled: true,
       maxPasswordLength: 128,
       minPasswordLength: 8,
@@ -98,13 +104,37 @@ describe("Core identity runtime construction boundary", () => {
     expect(options.trustedOrigins).toEqual([...validConfig().trustedOrigins]);
   });
 
+  it("enables sign-up (disableSignUp: false) only when publicSignupEnabled is explicitly true", () => {
+    betterAuthMock.mockReturnValue({ api: { getSession: vi.fn() }, handler: vi.fn() });
+
+    createIdentityRuntime({ config: validConfig({ publicSignupEnabled: true }), db: fakeDb() });
+
+    const [options] = betterAuthMock.mock.calls[0] as [Record<string, unknown>];
+    expect(options.emailAndPassword).toMatchObject({ disableSignUp: false });
+  });
+
   it("explicitly disables Better Auth's default test-environment origin/CSRF skip", () => {
     betterAuthMock.mockReturnValue({ api: { getSession: vi.fn() }, handler: vi.fn() });
 
     createIdentityRuntime({ config: validConfig(), db: fakeDb() });
 
     const [options] = betterAuthMock.mock.calls[0] as [Record<string, unknown>];
-    expect(options.advanced).toEqual({ disableCSRFCheck: false, disableOriginCheck: false });
+    expect(options.advanced).toEqual({
+      disableCSRFCheck: false,
+      disableOriginCheck: false,
+      ipAddress: { ipAddressHeaders: [TRUSTED_CLIENT_ADDRESS_HEADER] },
+    });
+  });
+
+  it("trusts exactly the one platform-owned client-address header, never Better Auth's own default", () => {
+    betterAuthMock.mockReturnValue({ api: { getSession: vi.fn() }, handler: vi.fn() });
+
+    createIdentityRuntime({ config: validConfig(), db: fakeDb() });
+
+    const [options] = betterAuthMock.mock.calls[0] as [Record<string, unknown>];
+    const advanced = options.advanced as { ipAddress?: { ipAddressHeaders?: string[] } };
+    expect(advanced.ipAddress?.ipAddressHeaders).toEqual([TRUSTED_CLIENT_ADDRESS_HEADER]);
+    expect(advanced.ipAddress?.ipAddressHeaders).not.toContain("x-forwarded-for");
   });
 
   it("configures onAPIError.throw so an unexpected failure escapes Better Auth's own unsanitized fallback logger instead of being swallowed internally", () => {