// Review H-1: the proxy-attested client IP is what gives every browser its
// own login/signup/public-endpoint rate-limit bucket. It only works when the
// Next server trusts the proxy that pins X-Real-IP. A TLS deployment without
// that switch silently puts every client in the web container's bucket, so
// warn loudly at startup instead of waiting for an outage caused by one
// caller exhausting the instance limit.
export async function register() {
  // Runs for both the Node and Edge runtimes; env diagnostics only apply to
  // the server process.
  if (process.env.NEXT_RUNTIME !== 'nodejs') return
  const url = process.env.NEXTAUTH_URL || ''
  const trusted = process.env.TRUSTED_PROXY === '1'
  if (url.startsWith('https://') && !trusted) {
    console.warn(
      '[config] NEXTAUTH_URL is HTTPS but TRUSTED_PROXY is not 1. All clients ' +
        'share the web container rate-limit bucket; set TRUSTED_PROXY=1 when a ' +
        'proxy in front of web overwrites X-Real-IP (see RUNNING.md).',
    )
  }
  if (trusted && !url.startsWith('https://')) {
    console.warn(
      '[config] TRUSTED_PROXY=1 is set for a non-HTTPS NEXTAUTH_URL. Only do ' +
        'this when the proxy is the sole route to this server; otherwise ' +
        'clients can spoof X-Real-IP and choose their rate-limit identity.',
    )
  }
}