2 Commits

Include renames

Author	SHA1	Message	Date
ekklesiaandClaude Sonnet 5	cafd513019	fix: secure authentication request identity ... Replace Better Auth's default trust of a caller-controlled X-Forwarded-For with a platform-owned client-address resolution boundary: direct mode (the safe default) trusts only the real socket peer, and an explicit trusted-proxy mode requires a header name, a concrete trusted-proxy list, and only honors a forwarded chain from an actual trusted peer. This closes a rate-limit bypass where rotating a spoofed header let a caller choose a fresh bucket on every request. Public sign-up is also disabled by default and requires an explicit typed opt-in, using Better Auth's own disableSignUp gate so no email-existence leak or second signup path is introduced. Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-07-26 12:20:51 -05:00
ekklesia	91d8f5946f	feat: expose core identity transport	2026-07-21 19:15:14 -05:00