/**
 * Extracts the client IP from the X-Forwarded-For header.
 *
 * Our edge proxy (Traefik) APPENDS the real peer IP to any client-supplied
 * chain, so the LAST hop is the only trustworthy entry. The first hop is
 * attacker-controlled: reading it lets bots rotate fake IPs per request and
 * defeat IP-based rate limiting entirely.
 */
export function parseClientIp(xForwardedFor: string | null | undefined): string | null {
  if (!xForwardedFor) {
    return null;
  }
  const hops = xForwardedFor
    .split(',')
    .map((hop) => hop.trim())
    .filter(Boolean);
  return hops.length > 0 ? hops[hops.length - 1] : null;
}