feat: 基础层——phonenumberslite/resolve_region_code/CA字典bug/XFF服务端优先

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/api/routes/chat.py

@@ -22,9 +22,9 @@ async def ws_chat(websocket: WebSocket):
 
             # Collect client info
             client_ip = websocket.client.host if websocket.client else ""
-            forwarded = websocket.headers.get("x-forwarded-for", "")
+            forwarded = websocket.headers.get("x-forwarded-for", "").split(",")[0].strip()
             if forwarded:
-                client_ip = forwarded.split(",")[0].strip()
+                client_ip = forwarded
             user_agent = websocket.headers.get("user-agent", "")
             client_info = {"ip": client_ip, "user_agent": user_agent}
 
@@ -58,6 +58,10 @@ async def ws_chat(websocket: WebSocket):
                     init_msg.get("source", "standalone")
                 )
                 merged_info = {**client_info, **(init_msg.get("client_info") or {})}
+                # 服务端 XFF 优先于客户端自报 ip（客户端自报可伪造，可伪造面最小）；
+                # 无 XFF 时保留客户端自报，user_agent 等其他字段不受影响
+                if forwarded:
+                    merged_info["ip"] = forwarded
                 conv = await manager.create_conversation(
                     source=source,
                     client_info=merged_info,

app/api/routes/chat_rest.py

@@ -32,13 +32,19 @@ class SessionRequest(BaseModel):
 
 
 @router.post("/session")
-async def chat_session(req: SessionRequest):
+async def chat_session(req: SessionRequest, request: Request):
     """Resume an active conversation by session_id, or create a new app one.
 
     `context` flows into `create_conversation` where it is whitelisted into
     `raw_info` (only when non-None). `client_info` is stored for analytics only
     (ip/ua/device-id/lang) and never fed to the AI prompt.
     """
+    # 服务端 XFF 优先于客户端自报 ip（客户端自报可伪造，可伪造面最小）
+    xf = request.headers.get("x-forwarded-for", "").split(",")[0].strip()
+    client_info = dict(req.client_info or {})
+    if xf:
+        client_info["ip"] = xf
+
     async with async_session() as db:
         manager = ConversationManager(db)
         if req.session_id:
@@ -51,7 +57,7 @@ async def chat_session(req: SessionRequest):
                 }
         conv = await manager.create_conversation(
             source=ConversationSource.app,
-            client_info=req.client_info,
+            client_info=client_info,
             context=req.context,
         )
         return {