Refactor forwarded header handling into opt-in kaya-forwarded package with trusted CIDRs

README.md

@@ -14,6 +14,7 @@ This repository is a monorepo for the Kaya framework. The code is split into ind
 - **kaya-oidc** — OpenID Connect authentication (`packages/kaya-oidc/`)
 - **kaya-openapi** — automatic OpenAPI specification generation (`packages/kaya-openapi/`)
 - **kaya-cors** — CORS (Cross-Origin Resource Sharing) support (`packages/kaya-cors/`)
+- **kaya-forwarded** — trusted-proxy `Forwarded`/`X-Forwarded-*` client address resolution (`packages/kaya-forwarded/`)
 
 Additional `kaya-*` packages can be added as new directories under `packages/`.
 
@@ -28,7 +29,7 @@ pip install --index-url https://gitea.woggioni.net/api/packages/woggioni/pypi/si
 Install the packages in development mode:
 
 ```bash
-pip install -e packages/kaya-core -e packages/kaya-rsgi -e packages/kaya-session -e packages/kaya-session-redis -e packages/kaya-session-memcache -e packages/kaya-oidc -e packages/kaya-openapi -e packages/kaya-cors
+pip install -e packages/kaya-core -e packages/kaya-rsgi -e packages/kaya-session -e packages/kaya-session-redis -e packages/kaya-session-memcache -e packages/kaya-oidc -e packages/kaya-openapi -e packages/kaya-cors -e packages/kaya-forwarded
 ```
 
 Run the example:
@@ -48,6 +49,7 @@ python -m unittest discover -s packages/kaya-session-memcache/tests
 python -m unittest discover -s packages/kaya-oidc/tests
 python -m unittest discover -s packages/kaya-openapi/tests
 python -m unittest discover -s packages/kaya-cors/tests
+python -m unittest discover -s packages/kaya-forwarded/tests
 ```
 
 ## Static analysis
@@ -61,6 +63,7 @@ mypy -p kaya.session.memcache
 mypy -p kaya.oidc
 mypy -p kaya.openapi
 mypy -p kaya.cors
+mypy -p kaya.forwarded
 ```
 
 ## Building packages
@@ -74,4 +77,5 @@ python -m build packages/kaya-session-memcache
 python -m build packages/kaya-oidc
 python -m build packages/kaya-openapi
 python -m build packages/kaya-cors
+python -m build packages/kaya-forwarded
 ```