geenforce: harden allowlist + fix share-less kiosk client and display scope

tests/test_plugins/test_geenforce_manifest.py

@@ -147,6 +147,17 @@ def test_empty_allowlist_keeps_token_required(client, db, app):
     assert resp.status_code == 401
 
 
+def test_spoofed_forwarded_for_does_not_bypass_allowlist(client, db, app):
+    # SECURITY: the allowlist uses remote_addr, not X-Forwarded-For. A caller
+    # whose real IP (127.0.0.1) is NOT allowlisted must NOT gain token-less access
+    # by forging X-Forwarded-For to an allowlisted address.
+    _seed_and_publish(app)
+    _set_allowlist(app, '10.134.48.0/23')  # test client 127.0.0.1 is NOT in it
+    resp = client.get('/api/geenforce/manifest?pctype=gea-shopfloor-cmm',
+                      headers={'X-Forwarded-For': '10.134.48.10'})
+    assert resp.status_code == 401, 'spoofed X-Forwarded-For bypassed the allowlist'
+
+
 def test_wrong_scope_rejected(client, db, app, auth_headers):
     _seed_and_publish(app)
     resp = client.post('/api/apitokens',