62 lines
2.3 KiB
Python
62 lines
2.3 KiB
Python
"""test_auth.py — server/auth.py unit tests (no server, no network).
|
|
|
|
Bucket logic in isolation: per-username lockout, per-source-IP budget,
|
|
sliding-window expiry, and the spoof-gating of X-Forwarded-For. The
|
|
module reads its env knobs at import; inside the pytest process they stay
|
|
at defaults (5 / 20 / 900s) — the tests read auth.FAILS_USER/IP_FAILS/
|
|
WINDOW rather than hardcoding, so they hold either way.
|
|
"""
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT))
|
|
|
|
from server import auth # noqa: E402
|
|
|
|
|
|
class _Peer:
|
|
host = "203.0.113.9"
|
|
|
|
|
|
class _Req:
|
|
def __init__(self, headers=None):
|
|
self.headers = headers or {}
|
|
self.client = _Peer()
|
|
|
|
|
|
def test_username_lockout_and_sliding_expiry():
|
|
auth.reset()
|
|
t = 1_000_000.0
|
|
for _ in range(auth.FAILS_USER):
|
|
auth.record("locked-guy", "198.51.100.7", now=t)
|
|
assert auth.locked("locked-guy", "198.51.100.7", now=t)
|
|
# window is sliding: once every fail ages out, the name is free again
|
|
assert not auth.locked("locked-guy", "198.51.100.7", now=t + auth.WINDOW + 1)
|
|
# a locked username does not gate other usernames from another ip
|
|
assert not auth.locked("fresh-guy", "198.51.100.8", now=t)
|
|
# a correct password clears only that username's bucket
|
|
auth.clear("locked-guy")
|
|
assert not auth.locked("locked-guy", "198.51.100.9", now=t)
|
|
auth.reset()
|
|
|
|
|
|
def test_ip_budget_survives_username_rotation():
|
|
auth.reset()
|
|
t = 2_000_000.0
|
|
for i in range(auth.IP_FAILS): # one fresh username per fail...
|
|
auth.record(f"sweep-{i}", "198.51.100.9", now=t)
|
|
assert auth.locked("brand-new-user", "198.51.100.9", now=t) # ...still blocked
|
|
assert not auth.locked("brand-new-user", "198.51.100.10", now=t) # other ip fine
|
|
assert not auth.locked("brand-new-user", "198.51.100.9", now=t + auth.WINDOW + 1)
|
|
auth.reset()
|
|
|
|
|
|
def test_client_ip_trust_gating():
|
|
# XFF is only consulted when the trust flag is on (it is off here — the
|
|
# flag is for the prod proxy path, not the test process)
|
|
r = _Req({"x-forwarded-for": "5.6.7.8, 10.0.0.1"})
|
|
assert auth.TRUST_XFF is False
|
|
assert auth.client_ip(r) == "203.0.113.9" # spoofed header ignored
|
|
assert auth.client_ip(_Req()) == "203.0.113.9"
|