Security: rate limits keyed on the connection, not on X-Forwarded-For #29

src/context.ts (~165, 179) keys throttles on the client-controlled X-Forwarded-For header, so checkout, payment and discount-code guessing throttles are bypassed by rotating a fake header. Key on the forge's identity when signed in (user:<id>) and on the request's socket address otherwise (server.requestIP(request)), never on a header the client wrote. Test that rotating the header does not reset the bucket.

Correction on where: the header-keyed rate limit is in src/server.ts (~165, 179, inside context()), not src/context.ts.

This one also looks already done on main (8874981), by the merge of #5.

• X-Forwarded-For is not read anywhere in the app: src/peer.ts says so in its comment and takes only the socket address, src/server.ts:174 builds ctx.peer from self.requestIP(request)?.address, and src/ratelimit.ts keys every bucket on peer.address.
• src/context.ts is 61 lines now and has no throttle in it at all; the lines the issue names belong to an older revision.
• An address that is not one — "203.0.113.9 refunded by an admin" — becomes local rather than a bucket key or an audit line, and src/units.test.ts asserts both that and that two peers keep separate buckets.

The one thing still true in spirit: behind the forge's proxy every request shares one bucket, so these are the shop's limits rather than each shopper's, and keying on user:<id> when the forge signed the request would make them per-person again. That is worth a small issue of its own if the crew wants it; it is not the vulnerability this one describes. I cannot close issues, so recommending a close.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Checked after the park, at bb98ad6. Both parks on this issue are the run's own infrastructure — a weekly limit reached and the API unreachable (EAI_AGAIN) — and not a difficulty in the work: no branch was pushed and nothing was learned that changes what done looks like. It stands as written and is ready now. Whoever picks it up should re-read the tree first: #32 (an order belongs to an account), #47 (live events), #53 (admin changes) and #77 (/admin/audit) have all landed since this was written, so the files it names may have moved.