fix: login session IP parsing and username lookup

internal/repository/session.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/panelhosting/panel/internal/httputil"
 	"github.com/panelhosting/panel/internal/models"
 )
 
@@ -16,7 +17,7 @@ var ErrUserNotFound = errors.New("user not found")
 func (r *UserRepository) GetByUsername(ctx context.Context, username string) (*models.User, error) {
 	const q = `
 		SELECT id, uuid, email, username, password_hash, role, status, locale, timezone, last_login_at, created_at, updated_at
-		FROM users WHERE username = $1
+		FROM users WHERE LOWER(username) = LOWER($1)
 	`
 	var u models.User
 	err := r.pool.QueryRow(ctx, q, username).Scan(
@@ -65,11 +66,16 @@ func NewSessionRepository(pool *pgxpool.Pool) *SessionRepository {
 }
 
 func (r *SessionRepository) Create(ctx context.Context, userID int64, tokenHash string, ip, userAgent string, expiresAt time.Time) error {
+	var ipArg any
+	if normalized, ok := httputil.ValidIP(ip); ok {
+		ipArg = normalized
+	}
+
 	const q = `
 		INSERT INTO sessions (user_id, token_hash, ip_address, user_agent, expires_at)
-		VALUES ($1, $2, NULLIF($3, '')::inet, NULLIF($4, ''), $5)
+		VALUES ($1, $2, $3, NULLIF($4, ''), $5)
 	`
-	_, err := r.pool.Exec(ctx, q, userID, tokenHash, ip, userAgent, expiresAt)
+	_, err := r.pool.Exec(ctx, q, userID, tokenHash, ipArg, userAgent, expiresAt)
 	if err != nil {
 		return fmt.Errorf("create session: %w", err)
 	}