# IP restriction utilities

`backend/common/ip_restrictions.py` provides `get_client_ip`, `is_local_ip`,
`is_ip_allowed`, `local_ip_required` and `local_ip_required_api`.

Important: these decorators are not currently attached to the registration views
and there is no registration restriction middleware in `MIDDLEWARE`. The presence
of `REGISTRATION_ALLOWED_IPS` in settings therefore does not by itself restrict
registration.

The default setting contains loopback and private network ranges plus the
project's configured corporate range. An empty list denies all addresses and
`["*"]` permits all.

`get_client_ip` trusts the first `X-Forwarded-For` value. This is safe only when
the application is reachable exclusively through a trusted reverse proxy that
overwrites incoming forwarding headers. Otherwise clients can spoof the value.

Before enabling IP enforcement:

1. attach the API decorator or implement reviewed middleware for the exact route;
2. configure trusted proxy behavior;
3. move environment-specific networks out of source defaults;
4. test IPv4, IPv6, direct access and forwarded requests;
5. retain rate limiting and normal authentication—an IP allowlist is only an additional control.

Tests should target `common.ip_restrictions` and the decorated registration view,
not only the helper in isolation.