fix(auth) : bind Sudloh sessions and stop OAuth redirect loops

lib/auth/server.test.ts

@@ -13,7 +13,7 @@ vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options, ca
   emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
 vi.mock("./sudloh", () => ({ bindSudlohSession: sudloh.bind, validateSudlohSession: sudloh.validate }));
 
-const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY"] as const;
+const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY", "TRUSTED_CLIENT_IP_HEADER"] as const;
 const testEnv = process.env as Record<string, string | undefined>;
 const originalEnv = envNames.map((name) => testEnv[name]);
 
@@ -32,6 +32,7 @@ beforeEach(() => {
   delete testEnv.SUDLOH_OIDC_REDIRECT_URI;
   delete testEnv.SUDLOH_OIDC_ISSUER;
   delete testEnv.SUDLOH_OIDC_ONLY;
+  delete testEnv.TRUSTED_CLIENT_IP_HEADER;
 });
 afterEach(() => {
   envNames.forEach((name, index) => {
@@ -91,13 +92,19 @@ describe("actual administrator session boundary", () => {
     testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
     testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
     testEnv.SUDLOH_OIDC_ONLY = "true";
+    testEnv.TRUSTED_CLIENT_IP_HEADER = "x-forwarded-for";
     (await import("./server")).getAuth();
     const options = mocks.auth.mock.calls.at(-1)![0];
+    expect(options.advanced.ipAddress.ipAddressHeaders).toEqual(["x-forwarded-for"]);
     expect(options.emailAndPassword).toMatchObject({ enabled: false, disableSignUp: true });
     expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(false);
     await options.databaseHooks.session.create.after({ id: "guide-session", userId: "user-1" },
-      { path: "/callback/sudloh" });
+      { path: "/callback/:id", params: { id: "sudloh" } });
     expect(sudloh.bind).toHaveBeenCalledWith("user-1", "guide-session");
+    sudloh.bind.mockClear();
+    await options.databaseHooks.session.create.after({ id: "other-session", userId: "user-1" },
+      { path: "/callback/:id", params: { id: "other" } });
+    expect(sudloh.bind).not.toHaveBeenCalled();
   });
   it("denies a revoked Sudloh session", async () => {
     testEnv.SUDLOH_OIDC_CLIENT_ID = "client";