Release v2.20.2

test/better-auth-password.test.js

@@ -1,7 +1,25 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
 const { hashPassword, encodePasswordRecord, verifyEncodedPassword, hashScryptPassword, verifyCredentialPassword } = require('../src/auth');
-const { createPasswordCallbacks, createAccountLockSessionHook, createLoginRateLimitResetHook, createPasskeyAuthenticationGuard, resolvePasskeyRpID, getRoleTwoFactorAuthError } = require('../src/web/lib/auth/better-auth');
+const { createPasswordCallbacks, createAccountLockSessionHook, createLoginRateLimitResetHook, createPasskeyAuthenticationGuard, resolvePasskeyRpID, getRoleTwoFactorAuthError, ensureBetterAuthClientIp } = require('../src/web/lib/auth/better-auth');
+
+test('Better Auth client IP falls back to the socket address for direct requests', () => {
+  for (const address of ['192.0.2.1', '::1', '::ffff:192.0.2.1']) {
+    const req = { headers: {}, socket: { remoteAddress: address } };
+    ensureBetterAuthClientIp(req);
+    assert.equal(req.headers['x-forwarded-for'], address);
+  }
+});
+
+test('Better Auth client IP preserves forwarded addresses and does not invent a missing address', () => {
+  const req = { headers: { 'x-forwarded-for': '192.0.2.1, 192.0.2.2' }, socket: { remoteAddress: '192.0.2.3' } };
+  ensureBetterAuthClientIp(req);
+  assert.equal(req.headers['x-forwarded-for'], '192.0.2.1, 192.0.2.2');
+  for (const directReq of [{ headers: {} }, { headers: {}, socket: {} }]) {
+    ensureBetterAuthClientIp(directReq);
+    assert.equal(directReq.headers['x-forwarded-for'], undefined);
+  }
+});
 
 test('passkey RP ID uses localhost for local HTTP-IP configuration and the canonical hostname otherwise', () => {
   assert.equal(resolvePasskeyRpID('http://192.168.0.80:8080'), 'localhost');