fix(api): exempt internal rpc from the client ip check (#2910)

fluxer_api/src/api/middleware/RequireClientIpMiddleware.ts

@@ -15,6 +15,7 @@ interface RequireClientIpOptions {
 
 const defaultExemptPaths: Array<string> = [
 	'/_health',
+	'/internal',
 	'/webhooks/livekit',
 	'/test',
 	'/connections/bluesky/client-metadata.json',

fluxer_api/src/api/middleware/tests/RequireClientIpMiddleware.test.ts

@@ -22,6 +22,7 @@ function createHarness(path = 'http://localhost/v1/messages'): Harness {
 		return ctx.text('ok');
 	});
 	app.get('/_health', (ctx) => ctx.text('OK'));
+	app.get('/internal/rpc', (ctx) => ctx.text('OK'));
 	app.onError(AppErrorHandler);
 	return {
 		request: async (headers) => app.request(path, {headers}),
@@ -80,6 +81,12 @@ describe('RequireClientIpMiddleware', () => {
 		expect(response.status).toBe(200);
 	});
 
+	it('leaves internal service to service calls alone', async () => {
+		const harness = createHarness('http://localhost/internal/rpc');
+		const response = await harness.request({});
+		expect(response.status).toBe(200);
+	});
+
 	it('passes every request through in test mode', async () => {
 		Config.dev.testModeEnabled = true;
 		const harness = createHarness();