Fix review comments on cookie banner API

Parse only the first IP from X-Forwarded-For to prevent
the full chain from bypassing anonymization. Add secondary
sort key for deterministic consent selection. Reject origins
with empty port suffix in the validator.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/cookie_consent_record.go

@@ -223,7 +223,7 @@ WHERE
 	%s
 	AND cookie_banner_id = @cookie_banner_id
 	AND visitor_id = @visitor_id
-ORDER BY created_at DESC
+ORDER BY created_at DESC, id DESC
 LIMIT 1;
 `
 

pkg/server/api/cookiebanner/v1/handler.go

@@ -19,6 +19,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/httpserver"
@@ -164,6 +165,13 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
 
 func clientIP(r *http.Request) string {
 	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		// X-Forwarded-For may contain a comma-separated chain; use only the
+		// leftmost (client) entry.
+		if i := strings.IndexByte(xff, ','); i != -1 {
+			xff = xff[:i]
+		}
+		xff = strings.TrimSpace(xff)
+
 		if ip, _, err := net.SplitHostPort(xff); err == nil {
 			return ip
 		}

pkg/validator/validator_format.go

@@ -160,7 +160,7 @@ func Origin() ValidatorFunc {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}
 
-		if parsedURL.Host == "" {
+		if parsedURL.Host == "" || parsedURL.Hostname() == "" {
 			return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
 		}