import type { Context } from 'hono';

// Best-effort client IP for audit logging. Behind a reverse proxy the real address is in
// x-forwarded-for (first hop); fall back to x-real-ip, then "unknown".
export const clientIp = (ctx: Context): string => {
  const xff = ctx.req.header('x-forwarded-for');
  if (xff) return xff.split(',')[0]?.trim() || 'unknown';
  return ctx.req.header('x-real-ip') || 'unknown';
};