proxy-addr 2.0.7

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/proxy-addr@2.0.7
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/proxy-addr@2.0.7

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:5027a0a75c542a3db2bd8cb50b949dee841272dc247643e2b75ac487a033169b","contract":["assert proxyaddr returns socket remoteAddress when direct connection has no proxy headers","assert proxyaddr returns socket remoteAddress when proxy is untrusted","assert proxyaddr returns leftmost client address when trusting all proxies","assert proxyaddr filters local reverse proxy address when using loopback trust range","assert proxyaddr filters private network proxy addresses when using uniquelocal trust range","assert proxyaddr filters multiple trusted hops when configured with array of subnets","assert proxyaddr evaluates addresses with custom predicate trust function","assert proxyaddr supports netmask string notation in subnet trust list","assert proxyaddr.all returns all parsed addresses in chain when trust argument is omitted","assert proxyaddr.all stops at first untrusted address when trust argument is provided","assert proxyaddr.compile creates reusable trust filter function for IP ranges","assert proxyaddr throws TypeError when required request or trust argument is missing"],"goal":"verify pkg:npm/proxy-addr@2.0.7","kind":"HOW","packages":["pkg:npm/proxy-addr@2.0.7"],"schemaVersion":1},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/proxy-addr@2.0.7"],"schemaVersion":1,"verifierAdapter":"node-typescript@1"}

import proxyaddr from 'proxy-addr';

/**
 * Resolves the client IP address from a request using trusted proxy settings.
 *
 * @param {Object} req - The HTTP request object.
 * @param {Function|Array|String} trust - The trust configuration (e.g. 'loopback', CIDR, or predicate function).
 * @returns {string} The determined client IP address.
 */
export function getClientIp(req, trust = 'loopback') {
  return proxyaddr(req, trust);
}

/**
 * Returns all parsed addresses from the request chain.
 *
 * @param {Object} req - The HTTP request object.
 * @param {Function|Array|String} [trust] - Optional trust configuration.
 * @returns {string[]} Array of addresses.
 */
export function getAllIps(req, trust) {
  return proxyaddr.all(req, trust);
}

export default proxyaddr;

{
  "name": "sample-proxy-addr",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-proxy-addr",
      "version": "1.0.0",
      "dependencies": {
        "proxy-addr": "2.0.7"
      }
    },
    "node_modules/forwarded": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/ipaddr.js": {
      "version": "1.9.1",
      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.10"
      }
    },
    "node_modules/proxy-addr": {
      "version": "2.0.7",
      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
      "license": "MIT",
      "dependencies": {
        "forwarded": "0.2.0",
        "ipaddr.js": "1.9.1"
      },
      "engines": {
        "node": ">= 0.10"
      }
    }
  }
}

{
  "name": "sample-proxy-addr",
  "version": "1.0.0",
  "type": "module",
  "dependencies": {
    "proxy-addr": "2.0.7"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/proxy-addr@2.0.7",
  "kind": "HOW",
  "packages": [
    "pkg:npm/proxy-addr@2.0.7"
  ]
}

import assert from 'node:assert/strict';
import proxyaddr from 'proxy-addr';
import { getClientIp, getAllIps } from '../index.mjs';

function createReq(socketIp, forwardedFor) {
  const headers = {};
  if (forwardedFor !== undefined) {
    headers['x-forwarded-for'] = forwardedFor;
  }
  return {
    socket: { remoteAddress: socketIp },
    headers
  };
}

// 1. Direct connection without proxy headers returns socket address
{
  const req = createReq('203.0.113.195');
  assert.equal(getClientIp(req, () => false), '203.0.113.195');
}

// 2. Untrusted proxy returns direct socket address when trust function returns false
{
  const req = createReq('198.51.100.1', '203.0.113.195');
  assert.equal(getClientIp(req, () => false), '198.51.100.1');
}

// 3. Trust all returns the leftmost original client address
{
  const req = createReq('10.0.0.1', '203.0.113.195, 10.0.0.2');
  assert.equal(getClientIp(req, () => true), '203.0.113.195');
}

// 4. Predefined loopback range filters local reverse proxy address
{
  const req = createReq('127.0.0.1', '203.0.113.195');
  assert.equal(getClientIp(req, 'loopback'), '203.0.113.195');
}

// 5. Predefined uniquelocal range filters private network proxy addresses
{
  const req = createReq('10.0.0.1', '203.0.113.195, 192.168.1.1');
  assert.equal(getClientIp(req, 'uniquelocal'), '203.0.113.195');
}

// 6. Array of subnets filters multiple trusted hops
{
  const req = createReq('127.0.0.1', '203.0.113.195, 10.0.0.1');
  assert.equal(getClientIp(req, ['loopback', '10.0.0.0/8']), '203.0.113.195');
}

// 7. Custom predicate function evaluates addresses and indices
{
  const req = createReq('192.168.1.1', '203.0.113.195, 192.168.1.2');
  const isInternal = (addr) => addr.startsWith('192.168.');
  assert.equal(getClientIp(req, isInternal), '203.0.113.195');
}

// 8. Netmask string notation in trust list
{
  const req = createReq('10.0.0.1', '203.0.113.195, 192.168.1.5');
  assert.equal(getClientIp(req, ['10.0.0.0/255.0.0.0', '192.168.0.0/255.255.0.0']), '203.0.113.195');
}

// 9. getAllIps returns all parsed addresses when trust is omitted
{
  const req = createReq('127.0.0.1', '203.0.113.195, 10.0.0.1');
  assert.deepEqual(getAllIps(req), ['127.0.0.1', '10.0.0.1', '203.0.113.195']);
}

// 10. getAllIps stops at the first untrusted address when trust is provided
{
  const req = createReq('127.0.0.1', '203.0.113.195, 10.0.0.1');
  assert.deepEqual(getAllIps(req, 'loopback'), ['127.0.0.1', '10.0.0.1']);
}

// 11. proxyaddr.compile creates reusable trust filter function
{
  const trustLoopback = proxyaddr.compile('loopback');
  assert.equal(typeof trustLoopback, 'function');
  assert.equal(trustLoopback('127.0.0.1', 0), true);
  assert.equal(trustLoopback('::1', 0), true);
  assert.equal(trustLoopback('203.0.113.195', 0), false);
}

// 12. Throws TypeError when required arguments are missing
{
  assert.throws(() => proxyaddr(null, 'loopback'), /^TypeError: req argument is required$/);
  assert.throws(() => proxyaddr(createReq('127.0.0.1')), /^TypeError: trust argument is required$/);
}