refactor(BA-5733): pull client_ip from context in authenticated auth flows

Drop the ``client_ip`` field from Actions whose handlers are already
authenticated (``signout``, ``my_revoke_login_session``,
``admin_revoke_login_session``) and have the service resolve it via
``current_client_ip()``, mirroring how ``current_user()`` is consumed in
service logic. The auth middleware already populates the contextvar for
authenticated routes, so handlers no longer have to thread the value
through the Action.

Unauthenticated entry points (``authorize``, ``logout``) keep the
explicit ``client_ip`` Action field — the middleware does not set the
contextvar before authentication, so the REST handler still extracts it
from the request directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jopemachine

src/ai/backend/manager/api/adapters/login_session/adapter.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-from ai.backend.common.contexts.client_ip import current_client_ip
 from ai.backend.common.contexts.user import current_user
 from ai.backend.common.dto.manager.v2.login_session.request import (
     AdminRevokeLoginSessionInput,
@@ -129,7 +128,6 @@ async def my_revoke(self, input: MyRevokeLoginSessionInput) -> RevokeLoginSessio
             MyRevokeLoginSessionAction(
                 session_id=input.session_id,
                 user_id=me.user_id,
-                client_ip=current_client_ip(),
             )
         )
         return RevokeLoginSessionPayload(success=action_result.success)
@@ -139,7 +137,6 @@ async def admin_revoke(self, input: AdminRevokeLoginSessionInput) -> RevokeLogin
         action_result = await self._processors.auth.admin_revoke_login_session.wait_for_complete(
             AdminRevokeLoginSessionAction(
                 session_id=input.session_id,
-                client_ip=current_client_ip(),
             )
         )
         return RevokeLoginSessionPayload(success=action_result.success)

src/ai/backend/manager/api/rest/auth/handler.py

@@ -15,7 +15,6 @@
 from aiohttp import web
 
 from ai.backend.common.api_handlers import APIResponse, BodyParam, QueryParam
-from ai.backend.common.contexts.client_ip import current_client_ip
 from ai.backend.common.dto.manager.auth.request import (
     AuthorizeRequest,
     GetRoleRequest,
@@ -225,7 +224,6 @@ async def signout(self, body: BodyParam[SignoutRequest], ctx: UserContext) -> AP
                 requester_email=ctx.user_email,
                 email=params.email,
                 password=params.password,
-                client_ip=current_client_ip(),
             )
         )
         return APIResponse.build(HTTPStatus.OK, SignoutResponse())

src/ai/backend/manager/services/auth/actions/revoke_login_session.py

@@ -10,7 +10,6 @@
 @dataclass
 class AdminRevokeLoginSessionAction(AuthAction):
     session_id: UUID
-    client_ip: str | None = None
 
     @override
     def entity_id(self) -> str | None:
@@ -26,7 +25,6 @@ def operation_type(cls) -> ActionOperationType:
 class MyRevokeLoginSessionAction(AuthAction):
     session_id: UUID
     user_id: UUID
-    client_ip: str | None = None
 
     @override
     def entity_id(self) -> str | None:

src/ai/backend/manager/services/auth/actions/signout.py

@@ -14,7 +14,6 @@ class SignoutAction(AuthAction):
     requester_email: str
     email: str
     password: str
-    client_ip: str | None = None
 
     @override
     def entity_id(self) -> str | None:

src/ai/backend/manager/services/auth/service.py

@@ -15,6 +15,7 @@
     LoginSessionInner,
     LoginSessionTokenData,
 )
+from ai.backend.common.contexts.client_ip import current_client_ip
 from ai.backend.common.dto.manager.auth.types import AuthTokenType
 from ai.backend.common.exception import InvalidAPIParameters, UserResourcePolicyNotFound
 from ai.backend.common.plugin.hook import ALL_COMPLETED, FIRST_COMPLETED, PASSED, HookPluginContext
@@ -555,7 +556,7 @@ async def admin_revoke_login_session(
         self, action: AdminRevokeLoginSessionAction
     ) -> RevokeLoginSessionActionResult:
         session_token = await self._auth_repository.delete_login_session_by_id(
-            action.session_id, LoginAttemptResult.REVOKED_BY_ADMIN, action.client_ip
+            action.session_id, LoginAttemptResult.REVOKED_BY_ADMIN, current_client_ip()
         )
         await self._valkey_session_client.delete_login_session(session_token)
         return RevokeLoginSessionActionResult(success=True)
@@ -567,7 +568,7 @@ async def my_revoke_login_session(
         if session_data.user_id != action.user_id:
             raise GenericForbidden("You can only revoke your own login sessions.")
         session_token = await self._auth_repository.delete_login_session_by_id(
-            action.session_id, LoginAttemptResult.REVOKED_BY_USER, action.client_ip
+            action.session_id, LoginAttemptResult.REVOKED_BY_USER, current_client_ip()
         )
         await self._valkey_session_client.delete_login_session(session_token)
         return RevokeLoginSessionActionResult(success=True)
@@ -588,7 +589,7 @@ async def signout(self, action: SignoutAction) -> SignoutActionResult:
             action.password,
         )
         deleted_tokens = await self._auth_repository.delete_user_login_sessions(
-            action.user_id, action.domain_name, LoginAttemptResult.LOGOUT, action.client_ip
+            action.user_id, action.domain_name, LoginAttemptResult.LOGOUT, current_client_ip()
         )
         for token in deleted_tokens:
             await self._valkey_session_client.delete_login_session(token)