Fix: configure trust proxy via CIDR list

.eslintrc.js

@@ -21,4 +21,12 @@ module.exports = {
     eqeqeq: "warn",
   },
   ignorePatterns: ["node_modules/", "dist/", "*.min.js"],
+  overrides: [
+    {
+      files: ["test/**/*.ts"],
+      env: {
+        mocha: true,
+      },
+    },
+  ],
 };

backend/app.ts

@@ -1,7 +1,7 @@
 import "dotenv/config";
 
 // Run backend with cache updates.
-import { updateLumensCache } from "./routes";
+import { app, updateLumensCache } from "./routes";
 import { updateLedgers } from "./ledgers";
 
 async function beginCacheUpdates() {
@@ -15,4 +15,15 @@ async function beginCacheUpdates() {
   }
 }
 
+function startServer() {
+  if (process.env.NODE_ENV === "test") {
+    return;
+  }
+
+  app.listen(app.get("port"), () => {
+    console.log("Listening on port", app.get("port"));
+  });
+}
+
 beginCacheUpdates();
+startServer();

backend/routes.ts

@@ -1,5 +1,6 @@
 import express from "express";
 import proxy from "express-http-proxy";
+import proxyAddr from "proxy-addr";
 import logger from "morgan";
 import path from "path";
 import rateLimit from "express-rate-limit";
@@ -13,10 +14,17 @@ app.set("port", process.env.PORT || 5000);
 app.set("json spaces", 2);
 
 // Trust proxy to get real client IPs behind proxies/load balancers.
-const defaultTrustProxy = "loopback,linklocal,uniquelocal";
-const trustProxy = process.env.TRUST_PROXY || defaultTrustProxy;
-console.log(`Setting trust proxy to: ${trustProxy}`);
-app.set("trust proxy", trustProxy);
+export function parseTrustProxy(trustProxyEnv?: string): string[] {
+  const defaultTrustProxy = "loopback,linklocal,uniquelocal";
+  return (trustProxyEnv || defaultTrustProxy)
+    .split(",")
+    .map((cidr) => cidr.trim())
+    .filter(Boolean);
+}
+
+const trustProxyCidrs = parseTrustProxy(process.env.TRUST_PROXY);
+console.log(`Setting trust proxy to TRUST_PROXY: ${trustProxyCidrs.join(",")}`);
+app.set("trust proxy", proxyAddr.compile(trustProxyCidrs));
 
 app.use(logger("combined"));
 
@@ -78,7 +86,7 @@ const externalServiceLimiter = createRateLimit(
 // Apply general rate limiting to all API routes
 app.use("/api/", generalApiLimiter);
 
-if (process.env.DEV) {
+if (process.env.DEV === "true") {
   // Development: proxy to Vite dev server
   app.use(
     "/",
@@ -225,9 +233,12 @@ app.get(
   lumensV2V3.v3CirculatingSupplyHandler,
 );
 
-app.listen(app.get("port"), () => {
-  console.log("Listening on port", app.get("port"));
-});
+// Start listening only when this file is executed directly (not when required by tests)
+if (require.main === module && process.env.NODE_ENV !== "test") {
+  app.listen(app.get("port"), () => {
+    console.log("Listening on port", app.get("port"));
+  });
+}
 
 export async function updateLumensCache() {
   await lumens.updateApiLumens();

package.json

@@ -63,8 +63,10 @@
     "@types/lodash": "^4.14.178",
     "@types/mocha": "^9.0.0",
     "@types/morgan": "^1.9.3",
+    "@types/proxy-addr": "^2.0.3",
     "@types/react": "^18.2.0",
     "@types/react-dom": "^18.2.0",
+    "@types/supertest": "^6.0.2",
     "@typescript-eslint/eslint-plugin": "^5.9.1",
     "@typescript-eslint/parser": "^5.9.1",
     "@vitejs/plugin-react": "^4.0.0",