fix

apps/api/internal/httpapi/health_test.go

@@ -413,6 +413,35 @@ func TestRouterMetricsHiddenInProductionForRemote(t *testing.T) {
 	}
 }
 
+func TestRouterMetricsHiddenInProductionForSpoofedLoopbackXFF(t *testing.T) {
+	t.Parallel()
+	s := testAPIServer()
+	s.Config.AppEnv = "production"
+	s.Config.MetricsPublic = false
+	s.Config.TrustedProxies = []string{"10.0.0.0/8"}
+	h := s.Router()
+
+	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	req.RemoteAddr = "10.0.0.5:443"
+	req.Header.Set("X-Forwarded-For", "127.0.0.1")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("trusted proxy spoofed loopback XFF status=%d want 404", rec.Code)
+	}
+
+	s.Config.MetricsPublic = true
+	hPub := s.Router()
+	reqPub := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	reqPub.RemoteAddr = "10.0.0.5:443"
+	reqPub.Header.Set("X-Forwarded-For", "127.0.0.1")
+	recPub := httptest.NewRecorder()
+	hPub.ServeHTTP(recPub, reqPub)
+	if recPub.Code != http.StatusOK {
+		t.Fatalf("METRICS_PUBLIC trusted proxy XFF status=%d", recPub.Code)
+	}
+}
+
 func assertGateBody(t *testing.T, rec *httptest.ResponseRecorder, errorCode string, maintenance, readOnly bool) {
 	t.Helper()
 	var body map[string]any