fix: record the address the connection came from, not the one it claims

RequestIpProvider reads X-Forwarded-For and friends, which any client can set.
That was harmless while it only fed Sentry and Plausible, but this changeset
promoted it to user_session.ip, to the GeoIP lookup behind the location shown to
the user, and to auth_audit_event.ip on every login and failed login. An
attacker signing in with stolen credentials could send the victim's usual home
address and appear in the session list as indistinguishable from them - the one
signal the screen exists to give, under the attacker's control.

The codebase already draws this line: RateLimitInterceptor buckets on
request.remoteAddr because it needs a value the client cannot choose. The
session and audit paths now read the same value, through a separate accessor;
the analytics callers keep the old one.

Behind a proxy remoteAddr is the proxy unless the container is told which
forwarded headers to trust, so the deployment sets forward-headers-strategy.
That also fixes rate limiting, which until now bucketed every request behind the
ingress together.

Deleting a user now removes their sessions. They carry the person's IP, user
agent and city, there is nothing left to revoke, and the foreign key that used
to cascade is gone - which is what the lifecycle test was still asserting.

Author: JanCizmar

backend/app/src/test/kotlin/io/tolgee/security/session/LoginFailureAuditTest.kt

@@ -137,9 +137,11 @@ class LoginFailureAuditTest : AuthorizedControllerTest() {
       MockMvcRequestBuilders
         .post("/api/public/generatetoken")
         .contentType(MediaType.APPLICATION_JSON)
-        .header("X-Forwarded-For", TEST_IP)
         .header("User-Agent", TEST_USER_AGENT)
-        .content(mapper.writeValueAsString(body)),
+        .with {
+          it.remoteAddr = TEST_IP
+          it
+        }.content(mapper.writeValueAsString(body)),
     )
   }
 

backend/app/src/test/kotlin/io/tolgee/security/session/UserSessionLifecycleTest.kt

@@ -231,18 +231,15 @@ class UserSessionLifecycleTest : AuthorizedControllerTest() {
   }
 
   @Test
-  fun `sessions cascade away with the user while audit events survive`() {
+  fun `deleting the user drops their sessions while audit events survive`() {
     val user = dbPopulator.createUserIfNotExists("audit-survivor@tolgee.io")
     withRequestContext {
       jwtService.emitToken(user.id, type = UserSessionType.LOGIN_NATIVE)
     }
     eventsOf(user.id, AuthAuditEventType.LOGIN).assert.hasSize(1)
 
     executeInNewTransaction {
-      entityManager
-        .createNativeQuery("delete from user_account where id = :id")
-        .setParameter("id", user.id)
-        .executeUpdate()
+      userAccountService.delete(userAccountService.get(user.id))
     }
 
     userSessionRepository
@@ -328,9 +325,11 @@ class UserSessionLifecycleTest : AuthorizedControllerTest() {
       org.springframework.test.web.servlet.request.MockMvcRequestBuilders
         .post("/api/public/generatetoken")
         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
-        .header("X-Forwarded-For", ip)
         .header("User-Agent", userAgent)
-        .content(
+        .with {
+          it.remoteAddr = ip
+          it
+        }.content(
           mapper.writeValueAsString(
             mapOf("username" to testData.user.username, "password" to "admin"),
           ),
@@ -344,7 +343,7 @@ class UserSessionLifecycleTest : AuthorizedControllerTest() {
     fn: () -> T,
   ): T {
     val request = MockHttpServletRequest()
-    ip?.let { request.addHeader("X-Forwarded-For", it) }
+    ip?.let { request.remoteAddr = it }
     userAgent?.let { request.addHeader("User-Agent", it) }
     RequestContextHolder.setRequestAttributes(ServletRequestAttributes(request))
     try {

backend/data/src/main/kotlin/io/tolgee/repository/UserSessionRepository.kt

@@ -163,4 +163,6 @@ interface UserSessionRepository : JpaRepository<UserSession, Long> {
   ): List<Long>
 
   fun deleteAllByIdIn(ids: Collection<Long>)
+
+  fun deleteAllByUserAccountId(userAccountId: Long)
 }

backend/data/src/main/kotlin/io/tolgee/security/authentication/UserSessionAccessManager.kt

@@ -85,7 +85,7 @@ class UserSessionAccessManager(
       userAccountId = userAccountId,
       expiresAt = expiresAt,
       actingUserAccountId = actingUserAccountId,
-      ip = requestIpProvider.getClientIp(),
+      ip = requestIpProvider.getTrustedClientIp(),
       userAgent = requestUserAgentProvider.getUserAgent(),
     )
   }

backend/data/src/main/kotlin/io/tolgee/service/security/AuthAuditService.kt

@@ -62,7 +62,7 @@ class AuthAuditService(
         this.actingUserAccountId = actingUserAccountId ?: currentActingUserId()
         this.deviceId = deviceId ?: currentDeviceId()
         this.targetId = targetId
-        this.ip = requestIpProvider.getClientIp()
+        this.ip = requestIpProvider.getTrustedClientIp()
         this.userAgent = requestUserAgentProvider.getUserAgent()
         this.data = data
       }

backend/data/src/main/kotlin/io/tolgee/service/security/UserAccountService.kt

@@ -30,6 +30,7 @@ import io.tolgee.model.views.ExtendedUserAccountInProject
 import io.tolgee.model.views.UserAccountInProjectView
 import io.tolgee.model.views.UserAccountWithOrganizationRoleView
 import io.tolgee.repository.UserAccountRepository
+import io.tolgee.repository.UserSessionRepository
 import io.tolgee.service.AiPlaygroundResultService
 import io.tolgee.service.AvatarService
 import io.tolgee.service.EmailVerificationService
@@ -78,6 +79,8 @@ class UserAccountService(
   private val mfaService: MfaService,
   @Lazy
   private val authAuditService: AuthAuditService,
+  @Lazy
+  private val userSessionRepository: UserSessionRepository,
 ) : Logging {
   @Autowired
   @Lazy
@@ -226,6 +229,9 @@ class UserAccountService(
   }
 
   private fun deleteWithFetchedData(toDelete: UserAccount) {
+    // The audit trail deliberately outlives the account, but a session row is not audit - it
+    // carries the person's IP, user agent and city, and there is nothing left to revoke.
+    userSessionRepository.deleteAllByUserAccountId(toDelete.id)
     toDelete.emailVerification?.let {
       entityManager.remove(it)
     }

backend/data/src/main/kotlin/io/tolgee/service/security/UserSessionService.kt

@@ -48,7 +48,7 @@ class UserSessionService(
     isRefresh: Boolean,
   ) {
     val now = currentDateProvider.date
-    val ip = requestIpProvider.getClientIp()
+    val ip = requestIpProvider.getTrustedClientIp()
     val location = geoIpResolver.resolve(ip)
     userSessionRepository.upsert(
       id = sequenceIdProvider.next(),

backend/data/src/main/kotlin/io/tolgee/util/RequestIpProvider.kt

@@ -6,6 +6,21 @@ import org.springframework.web.context.request.ServletRequestAttributes
 
 @Component
 class RequestIpProvider {
+  /**
+   * The address the connection actually came from, which a client cannot choose - unlike the
+   * forwarding headers [getClientIp] reads. Anything that ends up in the audit trail or in front of
+   * a user as evidence uses this, the same value the rate limiter buckets on. Behind a proxy it is
+   * the proxy's address unless the deployment sets `server.forward-headers-strategy`, which makes
+   * the container resolve it from the forwarded headers it is willing to trust.
+   */
+  fun getTrustedClientIp(): String? {
+    if (RequestContextHolder.getRequestAttributes() == null) {
+      return null
+    }
+    val request = (RequestContextHolder.getRequestAttributes() as ServletRequestAttributes).request
+    return request.remoteAddr?.take(MAX_IP_LENGTH)
+  }
+
   fun getClientIp(): String? {
     if (RequestContextHolder.getRequestAttributes() == null) {
       return null