forwarded 0.2.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/forwarded@0.2.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/forwarded@0.2.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:96cf3ff6d9843b15f0dffdf9fc7744f63f51ae7be9fa1ed2d790de1a4b801bcf","contract":["assert forwarded(req) returns array starting with req.socket.remoteAddress when no X-Forwarded-For header","assert forwarded(req) returns addresses in reverse order from X-Forwarded-For header appended to socket address","assert forwarded(req) falls back to req.connection.remoteAddress if req.socket is not defined","assert forwarded(req) trims whitespace around comma-separated IP entries in X-Forwarded-For header","assert forwarded(req) throws TypeError when req argument is omitted or null"],"goal":"verify pkg:npm/forwarded@0.2.0","kind":"HOW","packages":["pkg:npm/forwarded@0.2.0"],"schemaVersion":1},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/forwarded@0.2.0"],"schemaVersion":1,"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-forwarded",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-forwarded",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "forwarded": "0.2.0"
      }
    },
    "node_modules/forwarded": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    }
  }
}

{
  "name": "sample-forwarded",
  "version": "1.0.0",
  "type": "module",
  "license": "MIT-0",
  "dependencies": {
    "forwarded": "0.2.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/forwarded@0.2.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/forwarded@0.2.0"
  ]
}

import assert from 'node:assert/strict';
import { createRequire } from 'node:module';

const require = createRequire(import.meta.url);
const forwarded = require('forwarded');

// 1. Basic socket address without X-Forwarded-For header
const req1 = {
  socket: { remoteAddress: '127.0.0.1' },
  headers: {}
};
const addrs1 = forwarded(req1);
assert.deepEqual(addrs1, ['127.0.0.1']);

// 2. Single proxy in X-Forwarded-For header
const req2 = {
  socket: { remoteAddress: '10.0.0.1' },
  headers: {
    'x-forwarded-for': '192.168.1.1'
  }
};
const addrs2 = forwarded(req2);
assert.deepEqual(addrs2, ['10.0.0.1', '192.168.1.1']);

// 3. Multiple proxies in X-Forwarded-For header (parsed backwards)
const req3 = {
  socket: { remoteAddress: '10.0.0.1' },
  headers: {
    'x-forwarded-for': '203.0.113.195, 70.41.3.18, 150.172.238.178'
  }
};
const addrs3 = forwarded(req3);
assert.deepEqual(addrs3, ['10.0.0.1', '150.172.238.178', '70.41.3.18', '203.0.113.195']);

// 4. Fallback to connection.remoteAddress when socket is undefined
const req4 = {
  connection: { remoteAddress: '::1' },
  headers: {
    'x-forwarded-for': '10.0.0.2'
  }
};
const addrs4 = forwarded(req4);
assert.deepEqual(addrs4, ['::1', '10.0.0.2']);

// 5. Handling extra whitespace in header values
const req5 = {
  socket: { remoteAddress: '127.0.0.1' },
  headers: {
    'x-forwarded-for': '  10.0.0.1  ,   10.0.0.2  '
  }
};
const addrs5 = forwarded(req5);
assert.deepEqual(addrs5, ['127.0.0.1', '10.0.0.2', '10.0.0.1']);

// 6. Throw TypeError when req argument is missing or null
assert.throws(
  () => forwarded(),
  (err) => err instanceof TypeError && err.message === 'argument req is required'
);
assert.throws(
  () => forwarded(null),
  (err) => err instanceof TypeError && err.message === 'argument req is required'
);

console.log('Contract tests passed successfully.');