From c621685aaec78aaa9dc86f70c07e629101a42ee4 Mon Sep 17 00:00:00 2001
From: Koala <6156589+Shik3i@users.noreply.github.com>
Date: Mon, 25 May 2026 12:24:14 +0200
Subject: [PATCH] fix: use real client IP for auth rate limiting; preserve
 lobby across socket disconnect

- Store real client IP from x-forwarded-for on socket for use in JOIN_ROOM
  auth rate limiting (was using proxy IP, breaking brute-force protection)
- Remove clearEpisodeLobbyState() from socket.onclose to preserve lobby
  across brief disconnects; ensureState() recovers lobby + timeout on reconnect
- Lobby is still properly cleared on intentional LEAVE_ROOM and room switch
---
 extension/background.js | 1 -
 server/index.js         | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/extension/background.js b/extension/background.js
index 7dd01f7..d448bd7 100644
--- a/extension/background.js
+++ b/extension/background.js
@@ -366,7 +366,6 @@ async function connect() {
                 forceSyncDeadline: null 
             });
 
-            clearEpisodeLobbyState();
             
             if (currentRoom) {
                 currentRoom.peers = [];
diff --git a/server/index.js b/server/index.js
index af3e82c..f7e8ab5 100644
--- a/server/index.js
+++ b/server/index.js
@@ -206,6 +206,7 @@ io.on('connection', (socket) => {
     // Get real client IP behind proxy/CDN
     const forwardedFor = socket.handshake.headers['x-forwarded-for'];
     const clientIp = forwardedFor ? forwardedFor.split(',')[0].trim() : socket.handshake.address;
+    socket._clientIp = clientIp;
     
     // 1. Connection Rate Limit
     if (!checkConnectionRate(clientIp)) {
@@ -283,7 +284,7 @@ io.on('connection', (socket) => {
                 removePeerFromRoom(socket.id, oldMapping.roomId, 'room-switch');
             }
 
-            const ip = socket.handshake.address;
+            const ip = socket._clientIp || socket.handshake.address;
             if (!checkAuthRate(ip, roomId)) {
                 socket.emit(EVENTS.ERROR, { message: "Too many failed attempts. Try again later." });
                 return;