Lockout -> server/auth.py + per-IP failure budget (XFF trusted only behind the proxy); unit tests

tests/test_auth.py

@@ -0,0 +1,52 @@
+"""test_auth.py — pure unit tests for server/auth.py (no server, no HTTP).
+
+The per-IP budget and the XFF trust rule live here; the per-username
+lockout's HTTP behaviour stays covered in test_api.py.
+"""
+import time
+from types import SimpleNamespace
+
+
+def _req(headers=None, host="203.0.113.7"):
+    return SimpleNamespace(headers=dict(headers or {}),
+                           client=SimpleNamespace(host=host))
+
+
+def test_ip_budget_counts_prunes_isolates(monkeypatch):
+    from server import auth
+    monkeypatch.setattr(auth, "IP_FAILS", 3)
+    monkeypatch.setattr(auth, "IP_WINDOW", 60.0)
+    auth._ip_fails.clear()
+    assert not auth.ip_locked("203.0.113.1")
+    for _ in range(3):
+        auth.ip_fail("203.0.113.1")
+    assert auth.ip_locked("203.0.113.1")
+    assert not auth.ip_locked("203.0.113.2")  # per-IP isolation
+    auth._ip_fails["203.0.113.1"] = [time.time() - 10_000]  # stale -> pruned
+    assert not auth.ip_locked("203.0.113.1")
+
+
+def test_client_ip_xff_trust_rule(monkeypatch):
+    from server import auth
+    r = _req({"x-forwarded-for": "9.9.9.9"})
+    monkeypatch.delenv("ANIWEB_TRUST_XFF", raising=False)
+    assert auth.client_ip(r) == "203.0.113.7"  # header NOT trusted by default
+    monkeypatch.setenv("ANIWEB_TRUST_XFF", "1")
+    assert auth.client_ip(r) == "9.9.9.9"       # honored only when explicitly on
+    assert auth.client_ip(_req()) == "203.0.113.7"  # no header -> socket peer
+
+
+def test_lock_locked_user_never_reaches_verify(monkeypatch):
+    from server import auth
+    monkeypatch.setattr(auth, "IP_FAILS", 1000)
+    auth._lockout["ghost"] = {"fails": 0, "until": time.time() + 900}
+    assert auth.lock("ghost", "x", "203.0.113.3") == "locked"
+
+
+def test_lock_wrong_password_is_bad_and_records_ip_failure(monkeypatch):
+    from server import auth
+    monkeypatch.setattr(auth, "IP_FAILS", 1000)  # keep the IP gate out of the way
+    auth._ip_fails.clear()
+    auth._lockout.clear()  # module state is shared across tests
+    assert auth.lock("ghost", "wrong123456", "203.0.113.4") == "bad"  # ghost: no user
+    assert len(auth._ip_fails.get("203.0.113.4", [])) == 1