userfront&backend test coverage 추가

backend/internal/utils/client_ip_test.go

@@ -22,3 +22,48 @@ func TestResolveClientIP_PrefersPublicRealIPOverPrivateForwarded(t *testing.T) {
 		t.Fatalf("expected public real IP, got %q", got)
 	}
 }
+
+func TestResolveClientIP_PrefersPublicRemoteIPWhenHeadersArePrivate(t *testing.T) {
+	got := ResolveClientIP("10.0.0.2", "192.168.0.10", "203.0.113.8:12345")
+	if got != "203.0.113.8" {
+		t.Fatalf("expected public remote IP, got %q", got)
+	}
+}
+
+func TestResolveClientIP_FallsBackToRealIPWhenNoForwardedCandidates(t *testing.T) {
+	got := ResolveClientIP("invalid", "192.168.0.10", "bad-remote")
+	if got != "192.168.0.10" {
+		t.Fatalf("expected normalized real IP, got %q", got)
+	}
+}
+
+func TestResolveClientIP_ReturnsEmptyForInvalidInputs(t *testing.T) {
+	got := ResolveClientIP("", "bad-real", "bad-remote")
+	if got != "" {
+		t.Fatalf("expected empty IP, got %q", got)
+	}
+}
+
+func TestIsPrivateOrReservedIP(t *testing.T) {
+	tests := []struct {
+		name     string
+		ip       string
+		expected bool
+	}{
+		{name: "invalid", ip: "not-an-ip", expected: false},
+		{name: "public", ip: "203.0.113.8", expected: false},
+		{name: "private ipv4", ip: "10.0.0.1", expected: true},
+		{name: "loopback", ip: "127.0.0.1", expected: true},
+		{name: "link local", ip: "169.254.1.1", expected: true},
+		{name: "carrier grade nat", ip: "100.64.0.1", expected: true},
+		{name: "unique local ipv6", ip: "fc00::1", expected: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsPrivateOrReservedIP(tc.ip); got != tc.expected {
+				t.Fatalf("unexpected private state for %s: got=%v expected=%v", tc.ip, got, tc.expected)
+			}
+		})
+	}
+}