sneak/neoirc
1
0 Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Compare commits

base: sneak/neoirc:next
sneak/neoirc:main sneak/neoirc:issue-271-require-json-content-type sneak/neoirc:next sneak/neoirc:prod sneak/neoirc:feat/add-csp-headers sneak/neoirc:fix/irc-numeric-replies sneak/neoirc:feature/irc-ui-overhaul sneak/neoirc:fix/29-split-dockerfile sneak/neoirc:fix/dockerfile-golangci-lint-v2-module-path sneak/neoirc:fix/golangci-lint-sha-13 sneak/neoirc:ci/make-check sneak/neoirc:fix/main-lint-issues
..
compare: sneak/neoirc:d39e0f2bb56be966c2491f71f8a887c73348aec2
sneak/neoirc:issue-271-require-json-content-type sneak/neoirc:next sneak/neoirc:prod sneak/neoirc:main sneak/neoirc:feat/add-csp-headers sneak/neoirc:fix/irc-numeric-replies sneak/neoirc:feature/irc-ui-overhaul sneak/neoirc:fix/29-split-dockerfile sneak/neoirc:fix/dockerfile-golangci-lint-v2-module-path sneak/neoirc:fix/golangci-lint-sha-13 sneak/neoirc:ci/make-check sneak/neoirc:fix/main-lint-issues
1 Commits
next .. d39e0f2bb5
Author SHA1 Message Date
sneak d39e0f2bb5 Stop the slow test packages waiting (closes #263)
check / check (push) Failing after 1m47s
Details 
- Tests hash passwords at bcrypt.MinCost, set through the
  PasswordCost field of db.Params.
- Test IRC servers check the queue only on broker notification;
  one test keeps the 100 ms fallback poll.
- The stop-timeout test shortens the timeout through a test-only
  setter.
- service and handlers tests build config.Config directly instead
  of through config.New, so they run in parallel: service had run
  serially, and handlers started its servers one at a time.
- Repeated race trials run as parallel subtests.
- Fixed sleeps become waits on the broker.
- A new test covers the relay's failed queue read, which only the
  100 ms poll had reached.

Model: opus-5-5
 2026-11-10 21:05:55 +00:00
16 changed files with 150 additions and 1206 deletions
Expand all files Collapse all files

No files matched your search

Dockerfile
+6 -7
View File
@@ -83,15 +83,14 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoir
# stage's chain and nothing else. # stage's chain and nothing else.
# alpine:3.21, 2026-02-26 # alpine:3.21, 2026-02-26
FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
# su-exec 0.2-r3, 2026-11-10 RUN apk add --no-cache ca-certificates \
RUN apk add --no-cache ca-certificates su-exec=0.2-r3 \ && addgroup -S neoirc && adduser -S neoirc -G neoirc \
&& addgroup -S neoirc && adduser -S neoirc -G neoirc && mkdir -p /var/lib/neoirc \
&& chown neoirc:neoirc /var/lib/neoirc
COPY --from=builder /neoircd /usr/local/bin/neoircd COPY --from=builder /neoircd /usr/local/bin/neoircd
COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
# No USER: the entrypoint starts as root to give /var/lib/neoirc to neoirc, USER neoirc
# then runs neoircd as neoirc.
EXPOSE 8080 6667 EXPOSE 8080 6667
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1 CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] ENTRYPOINT ["neoircd"]
README.md
+31 -92
View File
@@ -168,10 +168,8 @@ either.
- Request bodies for `POST /api/v1/session`, `POST /api/v1/login` and - Request bodies for `POST /api/v1/session`, `POST /api/v1/login` and
`POST /api/v1/messages` are limited to `MAX_MESSAGE_SIZE` bytes (default `POST /api/v1/messages` are limited to `MAX_MESSAGE_SIZE` bytes (default
`4096`). A larger body gets `400` `invalid request body`. `4096`). A larger body gets `400` `invalid request body`.
- `GET /api/v1/server` and `GET /.well-known/healthcheck.json` answer a request - The server allows cross-origin requests from any origin, with credentials. The
from any origin with `Access-Control-Allow-Origin: *`. Every other route sends cookie is `SameSite=Strict`, so a browser sends it only from the same site.
no `Access-Control-Allow-*` header, so a page on another origin cannot read
its responses.
### The auth cookie ### The auth cookie
@@ -1341,9 +1339,8 @@ Every session has a hostmask in IRC's form, `nick!username@hostname`:
from, or that IP address when the lookup gives no name. The lookup waits up to from, or that IP address when the lookup gives no name. The lookup waits up to
three seconds. three seconds.
Over the HTTP API, the client's IP address is the address of the TCP connection. Over the HTTP API, the server takes the client's IP address from the first entry
When that connection comes from a trusted proxy, the server reads the address of the `X-Forwarded-For` header, then `X-Real-IP`, then the TCP connection (see
from `X-Forwarded-For` or `X-Real-IP` instead (see
[Reverse proxy](#reverse-proxy)). [Reverse proxy](#reverse-proxy)).
Every user can see a hostmask: in `RPL_WHOISUSER` (`311`), `RPL_WHOREPLY` Every user can see a hostmask: in `RPL_WHOISUSER` (`311`), `RPL_WHOREPLY`
@@ -1453,9 +1450,10 @@ over the limit gets `429` `too many login attempts, try again later` with
attempt is more than 15 minutes old. Session creation has no rate limit; the attempt is more than 15 minutes old. Session creation has no rate limit; the
hashcash stamp is its cost. hashcash stamp is its cost.
The IP address is the client's address as described in The IP address comes from the first entry of `X-Forwarded-For`, else from
[Reverse proxy](#reverse-proxy). A client outside the trusted proxies cannot `X-Real-IP`, else from the TCP connection. Without a reverse proxy that
change it with `X-Forwarded-For` or `X-Real-IP`. overwrites those headers, a client can set them itself and so pick any address
(see [Reverse proxy](#reverse-proxy)).
### Writing a client ### Writing a client
@@ -1716,16 +1714,11 @@ Every setting is an environment variable. The server also reads a `.env` file in
its working directory, and a YAML file `neoirc.yaml` in `/etc/neoirc/` or its working directory, and a YAML file `neoirc.yaml` in `/etc/neoirc/` or
`$HOME/.config/neoirc/` with the same names as keys. A variable from the `$HOME/.config/neoirc/` with the same names as keys. A variable from the
environment wins over one in `.env`, and both win over `neoirc.yaml`. An environment wins over one in `.env`, and both win over `neoirc.yaml`. An
environment variable set to the empty string counts as unset, with two environment variable set to the empty string counts as unset, except
exceptions: `IRC_LISTEN_ADDR`, where the empty string turns the IRC listener off. A
`neoirc.yaml` that is not valid YAML stops the server at startup. A setting that
- For `IRC_LISTEN_ADDR`, the empty string turns the IRC listener off. does not parse or is out of range also stops the server at startup, and the
- For `TRUSTED_PROXIES`, the empty string trusts no proxy. error names the setting.
A `neoirc.yaml` that is not valid YAML stops the server at startup. A setting
that does not parse or is out of range also stops the server at startup, and the
error names the setting. The same holds for a setting given a list or a map in
`neoirc.yaml`.
- `PORT` (default `8080`): the HTTP port. `0` lets the system pick a free port. - `PORT` (default `8080`): the HTTP port. `0` lets the system pick a free port.
- `IRC_LISTEN_ADDR` (default `:6667`): the address of the IRC listener. The - `IRC_LISTEN_ADDR` (default `:6667`): the address of the IRC listener. The
@@ -1754,11 +1747,6 @@ error names the setting. The same holds for a setting given a list or a map in
address. A fraction such as `0.5` is allowed. It must be above `0`. address. A fraction such as `0.5` is allowed. It must be above `0`.
- `LOGIN_RATE_BURST` (default `5`): how many attempts an address may make at - `LOGIN_RATE_BURST` (default `5`): how many attempts an address may make at
once before the rate applies. It must be at least `1`. once before the rate applies. It must be at least `1`.
- `TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`): the
reverse proxies whose `X-Forwarded-For` and `X-Real-IP` headers the server
believes. It is a comma-separated list of networks, such as `10.0.0.0/8`, and
single addresses, such as `192.0.2.1`. A list replaces the default entirely.
The empty string trusts nothing. See [Reverse proxy](#reverse-proxy).
- `SESSION_IDLE_TIMEOUT` (default `720h`, 30 days): a duration with a unit, `h` - `SESSION_IDLE_TIMEOUT` (default `720h`, 30 days): a duration with a unit, `h`
for hours, `m` for minutes or `s` for seconds, such as `720h` or `36h30m`. A for hours, `m` for minutes or `s` for seconds, such as `720h` or `36h30m`. A
client with no request for this long is removed, and a session left with no client with no request for this long is removed, and a session left with no
@@ -1793,17 +1781,13 @@ NEOIRC_HASHCASH_BITS=20
the linter first and stops when either fails. The image: the linter first and stops when either fails. The image:
- is Alpine with the `neoircd` binary and CA certificates; - is Alpine with the `neoircd` binary and CA certificates;
- runs `neoircd` as the user `neoirc`; - runs as the user `neoirc`;
- exposes ports 8080 and 6667; - exposes ports 8080 and 6667;
- keeps its database in `/var/lib/neoirc`; - keeps its database in `/var/lib/neoirc`;
- has a `HEALTHCHECK` that calls `/.well-known/healthcheck.json` every 30 - has a `HEALTHCHECK` that calls `/.well-known/healthcheck.json` every 30
seconds. seconds.
The image prepares `/var/lib/neoirc` itself on every start. It creates the Run it with a volume for the database and the settings as environment variables:
directory, gives it to `neoirc` and then runs `neoircd` as `neoirc`.
Run it with a named volume for the database and the settings as environment
variables:
```bash ```bash
docker run -d --name neoirc \ docker run -d --name neoirc \
@@ -1814,51 +1798,20 @@ docker run -d --name neoirc \
neoirc neoirc
``` ```
A host directory works the same way in place of the named volume:
```bash
docker run -d --name neoirc \
-p 8080:8080 -p 6667:6667 \
-v /srv/neoirc:/var/lib/neoirc \
-e SERVER_NAME="My Server" \
-e MOTD="Welcome!" \
neoirc
```
### Reverse proxy ### Reverse proxy
Run the server behind a reverse proxy that terminates TLS. The server itself Run the server behind a reverse proxy that terminates TLS. The server itself
speaks plain HTTP, and the auth cookie is `Secure`, so browsers send it only speaks plain HTTP, and the auth cookie is `Secure`, so browsers send it only
over HTTPS. The proxy must: over HTTPS. The proxy must:
- Connect from an address in `TRUSTED_PROXIES`. The default trusts the private - Set `X-Forwarded-For` to the client's address, replacing any value the client
ranges `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16`. The setting must sent. The server reads that header first and trusts it from anyone; it reads
hold the address the server sees the proxy connect from. For a proxy on the `X-Real-IP` only when `X-Forwarded-For` is absent. Without a proxy that
same host: overwrites the header, a client can choose its own address, which sets its
- With the server outside Docker, that address is `127.0.0.1` or `::1`. The hostname and lets it dodge the login rate limit.
default does not trust them, so set `TRUSTED_PROXIES=127.0.0.1,::1`.
- Through a published Docker port, that address is the Docker bridge
gateway, such as `172.17.0.1`. The default trusts it.
- Add the client's address to `X-Forwarded-For`.
- Wait at least 60 seconds for a response. A long poll can take 30 seconds, and - Wait at least 60 seconds for a response. A long poll can take 30 seconds, and
the server's own write timeout is 60 seconds. the server's own write timeout is 60 seconds.
The server finds the client's address in these steps:
- A connection from outside `TRUSTED_PROXIES` is the client. The server ignores
its `X-Forwarded-For` and `X-Real-IP` headers.
- For a connection from a trusted proxy, the server reads `X-Forwarded-For` from
right to left. It skips trusted addresses and takes the first untrusted one.
When every entry is trusted, it takes the leftmost.
- Without `X-Forwarded-For`, the server takes `X-Real-IP`.
- When an entry it reads is not an IP address, the server uses the proxy's
address.
The client's address sets the session's hostname and counts toward the login
rate limit. Any connection from a trusted address can choose its client address
through `X-Forwarded-For`. If clients connect directly from private addresses,
set `TRUSTED_PROXIES` to the proxy's address alone.
Caddy: Caddy:
``` ```
@@ -1895,34 +1848,22 @@ The IRC listener has no TLS.
seconds. A request still running after 60 seconds is cancelled, and the seconds. A request still running after 60 seconds is cancelled, and the
connection closes without a response. Headers may be up to 1 MiB. connection closes without a response. Headers may be up to 1 MiB.
- A long poll waits at most 30 seconds. - A long poll waits at most 30 seconds.
- Every response to a well-formed request carries a `Content-Security-Policy` - Every response to a well-formed request, except to a cross-origin preflight,
header: carries a `Content-Security-Policy` header:
`default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'`. `default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'`.
The web client works within it. The web client works within it.
- `GET /api/v1/server` and `GET /.well-known/healthcheck.json` answer a request - Cross-origin requests are allowed from any origin, with credentials. The
from any origin with `Access-Control-Allow-Origin: *`. Every other route sends allowed methods are `GET`, `POST`, `PUT`, `DELETE` and `OPTIONS`. The allowed
no `Access-Control-Allow-*` header, so a page on another origin cannot read request headers are `Accept`, `Content-Type` and `X-CSRF-Token`. The cookie's
its responses. `SameSite=Strict` still keeps it to the same site.
### Logging ### Logging
The server logs with Go's `slog`, one line per event, to standard output. The The server logs with Go's `slog`, one line per event, to standard output. The
lines are JSON, or plain text when standard output is a terminal. Every HTTP lines are JSON, or plain text when standard output is a terminal. Every HTTP
request is logged with: request is logged with its method, URL, protocol, status, latency, remote
address, user agent, referrer and request ID. `DEBUG=true` adds debug-level
- start time lines.
- method
- URL
- protocol
- status
- latency
- client address
- user agent
- referrer
- request ID
The client address is the one found as described in
[Reverse proxy](#reverse-proxy). `DEBUG=true` adds debug-level lines.
### The database ### The database
@@ -2005,8 +1946,8 @@ and their sessions to end. Then it closes the database.
gets a message. gets a message.
- `internal/hashcash/`: stamp checking and minting. - `internal/hashcash/`: stamp checking and minting.
- `internal/ratelimit/`: the per-address login rate limiter. - `internal/ratelimit/`: the per-address login rate limiter.
- `internal/middleware/`: finding the client's address, request logging, - `internal/middleware/`: request logging, cross-origin requests, the
cross-origin requests, the `Content-Security-Policy` header and metrics. `Content-Security-Policy` header and metrics.
- `internal/healthcheck/` and `internal/stats/`: the health check and its - `internal/healthcheck/` and `internal/stats/`: the health check and its
counters. counters.
- `internal/logger/` and `internal/globals/`: logging setup and build - `internal/logger/` and `internal/globals/`: logging setup and build
@@ -2018,8 +1959,6 @@ and their sessions to end. Then it closes the database.
- `schema/`: JSON Schema files for the message envelope, with their own - `schema/`: JSON Schema files for the message envelope, with their own
`README.md`. `README.md`.
- `script/`: the entrypoints below. - `script/`: the entrypoints below.
- `deploy/`: `docker-entrypoint.sh`, the image's entrypoint, which prepares
`/var/lib/neoirc` and starts `neoircd` as `neoirc`.
- `CONVENTIONS.md`, `REPO_POLICIES.md` and `AGENTS.md`: the architecture - `CONVENTIONS.md`, `REPO_POLICIES.md` and `AGENTS.md`: the architecture
conventions, the repository policies and the rules for coding agents. conventions, the repository policies and the rules for coding agents.
deploy/docker-entrypoint.sh
-14
View File
@@ -1,14 +0,0 @@
#!/bin/sh
# deploy/docker-entrypoint.sh: the image's ENTRYPOINT, run as root. A host
# directory mounted at /var/lib/neoirc keeps the host's owner, so this gives
# it to neoirc before running neoircd as neoirc.
set -eu
main() {
mkdir -p /var/lib/neoirc
chown -R neoirc:neoirc /var/lib/neoirc
chmod 0700 /var/lib/neoirc
exec su-exec neoirc neoircd "$@"
}
main "$@"
go.mod
+1 -2
View File
@@ -13,10 +13,8 @@ require (
github.com/prometheus/client_golang v1.23.2 github.com/prometheus/client_golang v1.23.2
github.com/rivo/tview v0.42.0 github.com/rivo/tview v0.42.0
github.com/slok/go-http-metrics v0.13.0 github.com/slok/go-http-metrics v0.13.0
github.com/spf13/cast v1.10.0
github.com/spf13/viper v1.21.0 github.com/spf13/viper v1.21.0
go.uber.org/fx v1.24.0 go.uber.org/fx v1.24.0
go4.org/netipx v0.0.0-20260823151212-3075585bcbeb
golang.org/x/crypto v0.48.0 golang.org/x/crypto v0.48.0
golang.org/x/time v0.6.0 golang.org/x/time v0.6.0
modernc.org/sqlite v1.45.0 modernc.org/sqlite v1.45.0
@@ -42,6 +40,7 @@ require (
github.com/sagikazarmark/locafero v0.11.0 // indirect github.com/sagikazarmark/locafero v0.11.0 // indirect
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
github.com/spf13/afero v1.15.0 // indirect github.com/spf13/afero v1.15.0 // indirect
github.com/spf13/cast v1.10.0 // indirect
github.com/spf13/pflag v1.0.10 // indirect github.com/spf13/pflag v1.0.10 // indirect
github.com/subosito/gotenv v1.6.0 // indirect github.com/subosito/gotenv v1.6.0 // indirect
go.uber.org/dig v1.19.0 // indirect go.uber.org/dig v1.19.0 // indirect
go.sum
-2
View File
@@ -111,8 +111,6 @@ go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
go4.org/netipx v0.0.0-20260823151212-3075585bcbeb h1:XBM4hvfwGAttkkiTIFfeigdfcL1xIfdKXqFdgiHGtDs=
go4.org/netipx v0.0.0-20260823151212-3075585bcbeb/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
internal/config/config.go
+40 -181
View File
@@ -6,16 +6,12 @@ import (
"fmt" "fmt"
"log/slog" "log/slog"
"math" "math"
"net/netip"
"os" "os"
"strconv" "strconv"
"strings"
"time" "time"
"github.com/spf13/cast"
"github.com/spf13/viper" "github.com/spf13/viper"
"go.uber.org/fx" "go.uber.org/fx"
"go4.org/netipx"
"sneak.berlin/go/neoirc/internal/globals" "sneak.berlin/go/neoirc/internal/globals"
"sneak.berlin/go/neoirc/internal/logger" "sneak.berlin/go/neoirc/internal/logger"
@@ -36,16 +32,8 @@ Type /help for available commands.`
const DefaultDBURL = "file:///var/lib/neoirc/state.db" + const DefaultDBURL = "file:///var/lib/neoirc/state.db" +
"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)" "?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)"
// DefaultTrustedProxies is TRUSTED_PROXIES when it is not set: the
// private address ranges of RFC 1918.
const DefaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
var errOutOfRange = errors.New("setting out of range") var errOutOfRange = errors.New("setting out of range")
var errNeverMatches = errors.New("entry can never match a connection")
var errListOrMap = errors.New("a list or a map")
// Params defines the dependencies for creating a Config. // Params defines the dependencies for creating a Config.
type Params struct { type Params struct {
fx.In fx.In
@@ -76,15 +64,13 @@ type Config struct {
LoginRateLimit float64 LoginRateLimit float64
LoginRateBurst int LoginRateBurst int
IRCListenAddr string IRCListenAddr string
TrustedProxies *netipx.IPSet
params *Params params *Params
log *slog.Logger log *slog.Logger
} }
// New creates a new Config by reading from files and environment variables. // New creates a new Config by reading from files and environment variables.
// It returns an error when the config file does not parse, when the file // It returns an error when a number, true/false or duration setting does
// gives a setting a list or a map, and when a number, true/false, // not parse or is out of range.
// duration or address setting does not parse or is out of range.
func New( func New(
_ fx.Lifecycle, params Params, _ fx.Lifecycle, params Params,
) (*Config, error) { ) (*Config, error) {
@@ -117,18 +103,30 @@ func New(
viper.SetDefault("LOGIN_RATE_LIMIT", "1") viper.SetDefault("LOGIN_RATE_LIMIT", "1")
viper.SetDefault("LOGIN_RATE_BURST", "5") viper.SetDefault("LOGIN_RATE_BURST", "5")
viper.SetDefault("IRC_LISTEN_ADDR", ":6667") viper.SetDefault("IRC_LISTEN_ADDR", ":6667")
viper.SetDefault("TRUSTED_PROXIES", DefaultTrustedProxies)
err := viper.ReadInConfig() err := viper.ReadInConfig()
if err != nil { if err != nil {
var notFound viper.ConfigFileNotFoundError var notFound viper.ConfigFileNotFoundError
if !errors.As(err, &notFound) { if !errors.As(err, &notFound) {
return nil, fmt.Errorf("cannot read %s: %w", log.Error("config file malformed", "error", err)
viper.ConfigFileUsed(), err) panic(err)
} }
} }
cfg := &Config{ cfg := &Config{
DBURL: viper.GetString("DBURL"),
SentryDSN: viper.GetString("SENTRY_DSN"),
MetricsUsername: viper.GetString("METRICS_USERNAME"),
MetricsPassword: viper.GetString("METRICS_PASSWORD"),
MessageMaxAge: viper.GetString("MESSAGE_MAX_AGE"),
QueueMaxAge: viper.GetString("QUEUE_MAX_AGE"),
MOTD: viper.GetString("MOTD"),
ServerName: viper.GetString("SERVER_NAME"),
FederationKey: viper.GetString("FEDERATION_KEY"),
SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
OperName: viper.GetString("NEOIRC_OPER_NAME"),
OperPassword: viper.GetString("NEOIRC_OPER_PASSWORD"),
IRCListenAddr: viper.GetString("IRC_LISTEN_ADDR"),
log: log, log: log,
params: &params, params: &params,
} }
@@ -138,6 +136,13 @@ func New(
return nil, err return nil, err
} }
// Viper counts an empty environment variable as unset, but an
// empty IRC_LISTEN_ADDR must turn the IRC listener off.
ircListenAddr, set := os.LookupEnv("IRC_LISTEN_ADDR")
if set {
cfg.IRCListenAddr = ircListenAddr
}
if cfg.Debug { if cfg.Debug {
params.Logger.EnableDebugLogging() params.Logger.EnableDebugLogging()
cfg.log = params.Logger.Get() cfg.log = params.Logger.Get()
@@ -146,24 +151,13 @@ func New(
return cfg, nil return cfg, nil
} }
// parseSettings reads every setting into cfg. Each number and duration // parseSettings reads the number and true/false settings into cfg and
// must be above zero. PORT and NEOIRC_HASHCASH_BITS may also be zero: // checks the duration settings. Each number and duration must be above
// port 0 lets the system pick a port, and 0 bits turns proof of work off. // zero. PORT and NEOIRC_HASHCASH_BITS may also be zero: port 0 lets the
// The error names each setting that is a list or a map, does not parse or // system pick a port, and 0 bits turns proof of work off. The error
// is out of range. // names each setting that does not parse or is out of range.
func parseSettings(cfg *Config) error { func parseSettings(cfg *Config) error {
return errors.Join( return errors.Join(
parseString("DBURL", &cfg.DBURL),
parseString("SENTRY_DSN", &cfg.SentryDSN),
parseString("METRICS_USERNAME", &cfg.MetricsUsername),
parseString("METRICS_PASSWORD", &cfg.MetricsPassword),
parseString("MOTD", &cfg.MOTD),
parseString("SERVER_NAME", &cfg.ServerName),
parseString("FEDERATION_KEY", &cfg.FederationKey),
parseString("NEOIRC_OPER_NAME", &cfg.OperName),
parseString("NEOIRC_OPER_PASSWORD", &cfg.OperPassword),
// The empty string turns the IRC listener off.
parseStringAllowEmptyEnv("IRC_LISTEN_ADDR", &cfg.IRCListenAddr),
parseInt("PORT", 0, &cfg.Port), parseInt("PORT", 0, &cfg.Port),
parseInt("MAX_MESSAGE_SIZE", 1, &cfg.MaxMessageSize), parseInt("MAX_MESSAGE_SIZE", 1, &cfg.MaxMessageSize),
parseInt("NEOIRC_HASHCASH_BITS", 0, &cfg.HashcashBits), parseInt("NEOIRC_HASHCASH_BITS", 0, &cfg.HashcashBits),
@@ -171,136 +165,16 @@ func parseSettings(cfg *Config) error {
parseFloat("LOGIN_RATE_LIMIT", &cfg.LoginRateLimit), parseFloat("LOGIN_RATE_LIMIT", &cfg.LoginRateLimit),
parseBool("DEBUG", &cfg.Debug), parseBool("DEBUG", &cfg.Debug),
parseBool("MAINTENANCE_MODE", &cfg.MaintenanceMode), parseBool("MAINTENANCE_MODE", &cfg.MaintenanceMode),
parseDuration("MESSAGE_MAX_AGE", &cfg.MessageMaxAge), checkDuration("MESSAGE_MAX_AGE", cfg.MessageMaxAge),
parseDuration("QUEUE_MAX_AGE", &cfg.QueueMaxAge), checkDuration("QUEUE_MAX_AGE", cfg.QueueMaxAge),
parseDuration("SESSION_IDLE_TIMEOUT", &cfg.SessionIdleTimeout), checkDuration("SESSION_IDLE_TIMEOUT", cfg.SessionIdleTimeout),
parseTrustedProxies(&cfg.TrustedProxies),
) )
} }
// getString returns the setting key as a string. A number or a true/false
// value in the config file becomes its text, as with viper.GetString. A
// list or a map in the config file is an error, where viper.GetString
// would return the empty string. The error leaves out the value, which
// may be a password.
func getString(key string) (string, error) {
raw, err := cast.ToStringE(viper.Get(key))
if err != nil {
return "", fmt.Errorf("%s is %w", key, errListOrMap)
}
return raw, nil
}
// parseString sets *value to the setting key.
func parseString(key string, value *string) error {
raw, err := getString(key)
if err != nil {
return err
}
*value = raw
return nil
}
// parseStringAllowEmptyEnv sets *value to the setting key, as parseString
// does, but an environment variable set to the empty string counts as
// set. Viper counts such a variable as unset and uses the config file or
// the default instead.
func parseStringAllowEmptyEnv(key string, value *string) error {
fromEnv, set := os.LookupEnv(key)
if set {
*value = fromEnv
return nil
}
return parseString(key, value)
}
// parseTrustedProxies sets *value to the addresses in TRUSTED_PROXIES.
func parseTrustedProxies(value **netipx.IPSet) error {
var raw string
err := parseStringAllowEmptyEnv("TRUSTED_PROXIES", &raw)
if err != nil {
return err
}
ipSet, err := ParseTrustedProxies(raw)
if err != nil {
return fmt.Errorf("cannot parse TRUSTED_PROXIES: %w", err)
}
*value = ipSet
return nil
}
// ParseTrustedProxies returns the addresses in list, which has the form
// of TRUSTED_PROXIES: a comma-separated list of networks such as
// 10.0.0.0/8 and single addresses such as 192.0.2.1. The empty string
// trusts nothing.
func ParseTrustedProxies(list string) (*netipx.IPSet, error) {
var builder netipx.IPSetBuilder
if strings.TrimSpace(list) != "" {
for entry := range strings.SplitSeq(list, ",") {
err := addTrustedProxy(&builder, strings.TrimSpace(entry))
if err != nil {
return nil, err
}
}
}
return builder.IPSet()
}
// addTrustedProxy adds entry, a network with a slash or a single
// address, to builder. An IPv4 address written in IPv6 form, such as
// ::ffff:192.0.2.1, is added as IPv4. A network in that form and an
// address with a zone are errors, since no connection could match them.
func addTrustedProxy(builder *netipx.IPSetBuilder, entry string) error {
if strings.Contains(entry, "/") {
prefix, err := netip.ParsePrefix(entry)
if err != nil {
return err //nolint:wrapcheck // the caller names the setting
}
// A connection from an IPv4 address is checked in IPv4 form.
if prefix.Addr().Is4In6() {
return fmt.Errorf("%w: %s is an IPv4 network in IPv6 form",
errNeverMatches, entry)
}
builder.AddPrefix(prefix)
return nil
}
addr, err := netip.ParseAddr(entry)
if err != nil {
return err //nolint:wrapcheck // the caller names the setting
}
// IPSet.Contains is false for every address with a zone.
if addr.Zone() != "" {
return fmt.Errorf("%w: %s has a zone", errNeverMatches, entry)
}
builder.Add(addr.Unmap())
return nil
}
// parseInt sets *value to the setting key read as a whole number. It // parseInt sets *value to the setting key read as a whole number. It
// returns an error when the value does not parse or is below minimum. // returns an error when the value does not parse or is below minimum.
func parseInt(key string, minimum int, value *int) error { func parseInt(key string, minimum int, value *int) error {
raw, err := getString(key) raw := viper.GetString(key)
if err != nil {
return err
}
parsed, err := strconv.Atoi(raw) parsed, err := strconv.Atoi(raw)
if err != nil { if err != nil {
@@ -321,10 +195,7 @@ func parseInt(key string, minimum int, value *int) error {
// number. It returns an error when the value does not parse or is not a // number. It returns an error when the value does not parse or is not a
// finite number above zero. // finite number above zero.
func parseFloat(key string, value *float64) error { func parseFloat(key string, value *float64) error {
raw, err := getString(key) raw := viper.GetString(key)
if err != nil {
return err
}
parsed, err := strconv.ParseFloat(raw, 64) parsed, err := strconv.ParseFloat(raw, 64)
if err != nil { if err != nil {
@@ -344,12 +215,7 @@ func parseFloat(key string, value *float64) error {
// parseBool sets *value to the setting key read as true or false. // parseBool sets *value to the setting key read as true or false.
func parseBool(key string, value *bool) error { func parseBool(key string, value *bool) error {
raw, err := getString(key) parsed, err := strconv.ParseBool(viper.GetString(key))
if err != nil {
return err
}
parsed, err := strconv.ParseBool(raw)
if err != nil { if err != nil {
return fmt.Errorf("cannot parse %s: %w", key, err) return fmt.Errorf("cannot parse %s: %w", key, err)
} }
@@ -359,25 +225,18 @@ func parseBool(key string, value *bool) error {
return nil return nil
} }
// parseDuration sets *value to the setting key. It returns an error when // checkDuration returns an error naming the setting key when value is
// the value is not a Go duration above zero. // not a Go duration above zero.
func parseDuration(key string, value *string) error { func checkDuration(key, value string) error {
raw, err := getString(key) duration, err := time.ParseDuration(value)
if err != nil {
return err
}
duration, err := time.ParseDuration(raw)
if err != nil { if err != nil {
return fmt.Errorf("cannot parse %s: %w", key, err) return fmt.Errorf("cannot parse %s: %w", key, err)
} }
if duration <= 0 { if duration <= 0 {
return fmt.Errorf("%w: %s is %s, but must be above zero", return fmt.Errorf("%w: %s is %s, but must be above zero",
errOutOfRange, key, raw) errOutOfRange, key, value)
} }
*value = raw
return nil return nil
} }
internal/config/config_test.go
+2 -233
View File
@@ -1,14 +1,11 @@
package config_test package config_test
import ( import (
"net/netip"
"os" "os"
"path/filepath"
"strings" "strings"
"testing" "testing"
"time" "time"
"github.com/spf13/viper"
"sneak.berlin/go/neoirc/internal/config" "sneak.berlin/go/neoirc/internal/config"
"sneak.berlin/go/neoirc/internal/globals" "sneak.berlin/go/neoirc/internal/globals"
"sneak.berlin/go/neoirc/internal/logger" "sneak.berlin/go/neoirc/internal/logger"
@@ -143,7 +140,8 @@ func settingsOf(cfg *config.Config) settings {
} }
func TestBadSettingStopsStartup(t *testing.T) { func TestBadSettingStopsStartup(t *testing.T) {
// Each value is invalid for its setting. // For each setting, the first value does not parse and the others
// parse but are out of range.
tests := []struct { tests := []struct {
key string key string
values []string values []string
@@ -160,10 +158,6 @@ func TestBadSettingStopsStartup(t *testing.T) {
{key: "MESSAGE_MAX_AGE", values: []string{"30d", "0", "-1h"}}, {key: "MESSAGE_MAX_AGE", values: []string{"30d", "0", "-1h"}},
{key: "QUEUE_MAX_AGE", values: []string{"720", "0s", "-24h"}}, {key: "QUEUE_MAX_AGE", values: []string{"720", "0s", "-24h"}},
{key: "SESSION_IDLE_TIMEOUT", values: []string{"a month", "0", "-1m"}}, {key: "SESSION_IDLE_TIMEOUT", values: []string{"a month", "0", "-1m"}},
{key: "TRUSTED_PROXIES", values: []string{
"proxy.example.com", "10.0.0.0/33", "192.0.2.1:8080",
"::ffff:10.0.0.0/104", "fe80::1%eth0",
}},
} }
for _, test := range tests { for _, test := range tests {
@@ -212,228 +206,3 @@ func TestIRCListenAddrEmptyTurnsListenerOff(t *testing.T) {
t.Errorf("IRCListenAddr = %q, want empty", cfg.IRCListenAddr) t.Errorf("IRCListenAddr = %q, want empty", cfg.IRCListenAddr)
} }
} }
func TestTrustedProxies(t *testing.T) {
// Each case lists addresses that must be in the trusted set and
// addresses that must not.
tests := []struct {
name string
set bool
value string
trusted []string
untrusted []string
}{
{
name: "unset trusts the RFC 1918 ranges",
set: false,
value: "",
trusted: []string{
"10.1.2.3", "172.16.0.1", "172.31.255.254", "192.168.1.1",
},
untrusted: []string{
"127.0.0.1", "172.32.0.1", "192.0.2.1", "2001:db8::1",
},
},
{
name: "a value replaces the default",
set: true,
value: "198.51.100.0/24, 192.0.2.7,2001:db8::/32",
trusted: []string{"198.51.100.200", "192.0.2.7", "2001:db8::5"},
untrusted: []string{"10.4.5.6", "192.168.4.4", "192.0.2.8"},
},
{
name: "a mapped IPv6 address is trusted as IPv4",
set: true,
value: "::ffff:192.0.2.7",
trusted: []string{"192.0.2.7"},
untrusted: []string{"10.7.8.9"},
},
{
name: "the empty string trusts nothing",
set: true,
value: "",
trusted: nil,
untrusted: []string{"10.0.0.1", "192.168.0.1", "::1"},
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
// t.Setenv puts back whatever value was there after the
// test, including when Unsetenv removes it.
t.Setenv("TRUSTED_PROXIES", test.value)
if !test.set {
err := os.Unsetenv("TRUSTED_PROXIES")
if err != nil {
t.Fatal(err)
}
}
proxies := newConfig(t).TrustedProxies
for _, addr := range test.trusted {
if !proxies.Contains(netip.MustParseAddr(addr)) {
t.Errorf("%s is not trusted", addr)
}
}
for _, addr := range test.untrusted {
if proxies.Contains(netip.MustParseAddr(addr)) {
t.Errorf("%s is trusted", addr)
}
}
})
}
}
// unsetEnv removes the environment variable key for the rest of the
// test, so that config.New reads key from the config file.
func unsetEnv(t *testing.T, key string) {
t.Helper()
// t.Setenv puts back whatever value was there after the test,
// including when Unsetenv removes it.
t.Setenv(key, "")
err := os.Unsetenv(key)
if err != nil {
t.Fatal(err)
}
}
// writeConfigFile writes content to the config file config.New reads
// when HOME is home, and returns the file's path.
func writeConfigFile(t *testing.T, home, content string) string {
t.Helper()
// loadConfig names the app neoirc-test, so config.New reads
// $HOME/.config/neoirc-test/neoirc-test.yaml.
dir := filepath.Join(home, ".config", "neoirc-test")
err := os.MkdirAll(dir, 0o700)
if err != nil {
t.Fatal(err)
}
path := filepath.Join(dir, "neoirc-test.yaml")
err = os.WriteFile(path, []byte(content), 0o600)
if err != nil {
t.Fatal(err)
}
// Viper keeps the file and the values it read from it after the
// file is gone. Reset clears them for later tests.
t.Cleanup(viper.Reset)
return path
}
func TestListOrMapInConfigFileStopsStartup(t *testing.T) {
// YAML reads the first value as a list and the second as a map.
values := []string{`[":6667"]`, `{addr: ":6667"}`}
keys := []string{"IRC_LISTEN_ADDR", "MOTD", "TRUSTED_PROXIES"}
for _, key := range keys {
for _, value := range values {
t.Run(key+"="+value, func(t *testing.T) {
home := t.TempDir()
t.Setenv("HOME", home)
unsetEnv(t, key)
writeConfigFile(t, home, key+": "+value+"\n")
_, err := loadConfig(t)
if err == nil || !strings.Contains(err.Error(), key) {
t.Errorf("error = %v, want one naming %s", err, key)
}
})
}
}
}
func TestListOrMapErrorLeavesOutValue(t *testing.T) {
const key = "NEOIRC_OPER_PASSWORD"
home := t.TempDir()
t.Setenv("HOME", home)
unsetEnv(t, key)
// YAML reads an unquoted {hunter2} as a map.
writeConfigFile(t, home, key+": {hunter2}\n")
_, err := loadConfig(t)
if err == nil || !strings.Contains(err.Error(), key) {
t.Fatalf("error = %v, want one naming %s", err, key)
}
if strings.Contains(err.Error(), "hunter2") {
t.Errorf("error %q shows the password", err)
}
}
func TestEmptyEnvironmentValueWinsOverConfigFile(t *testing.T) {
const (
ircListenAddr = "IRC_LISTEN_ADDR"
trustedProxies = "TRUSTED_PROXIES"
)
// Each setting is the empty string in the environment and a list in
// the config file. The environment wins, so the list is never read.
tests := []struct {
key string
empty func(cfg *config.Config) bool
}{
{
key: ircListenAddr,
empty: func(cfg *config.Config) bool {
return cfg.IRCListenAddr == ""
},
},
{
key: trustedProxies,
empty: func(cfg *config.Config) bool {
return len(cfg.TrustedProxies.Prefixes()) == 0
},
},
}
for _, test := range tests {
t.Run(test.key, func(t *testing.T) {
home := t.TempDir()
t.Setenv("HOME", home)
t.Setenv(test.key, "")
writeConfigFile(t, home, test.key+": [\":6667\"]\n")
cfg := newConfig(t)
if !test.empty(cfg) {
t.Errorf("%s is not the empty string", test.key)
}
})
}
}
func TestSingleValuesInConfigFileAreUsed(t *testing.T) {
home := t.TempDir()
t.Setenv("HOME", home)
unsetEnv(t, "PORT")
unsetEnv(t, "DEBUG")
unsetEnv(t, "MOTD")
writeConfigFile(t, home, "PORT: 9000\nDEBUG: true\nMOTD: hello\n")
cfg := newConfig(t)
if cfg.Port != 9000 || !cfg.Debug || cfg.MOTD != "hello" {
t.Errorf("Port, Debug, MOTD = %d, %t, %q, want 9000, true, %q",
cfg.Port, cfg.Debug, cfg.MOTD, "hello")
}
}
func TestConfigFileThatDoesNotParseStopsStartup(t *testing.T) {
home := t.TempDir()
t.Setenv("HOME", home)
path := writeConfigFile(t, home, "MOTD: [unclosed\n")
_, err := loadConfig(t)
if err == nil || !strings.Contains(err.Error(), path) {
t.Errorf("error = %v, want one naming %s", err, path)
}
}
internal/db/db_test.go
+1 -85
View File
@@ -10,7 +10,6 @@ import (
"time" "time"
"go.uber.org/fx/fxtest" "go.uber.org/fx/fxtest"
"golang.org/x/crypto/bcrypt"
"sneak.berlin/go/neoirc/internal/config" "sneak.berlin/go/neoirc/internal/config"
"sneak.berlin/go/neoirc/internal/db" "sneak.berlin/go/neoirc/internal/db"
"sneak.berlin/go/neoirc/internal/dbtest" "sneak.berlin/go/neoirc/internal/dbtest"
@@ -27,11 +26,7 @@ const (
(SELECT 1 UNION ALL SELECT x + 1 FROM n) (SELECT 1 UNION ALL SELECT x + 1 FROM n)
SELECT COUNT(*) FROM n` SELECT COUNT(*) FROM n`
// endlessQueryTimeout is how long the endless query runs endlessQueryTimeout = 100 * time.Millisecond
// before its context ends. A query whose context ends before
// it starts is never run, and the pool keeps its connection,
// so the timeout leaves a loaded host time to start it.
endlessQueryTimeout = 2 * time.Second
) )
// TestDefaultDBURLSetsWALAndBusyTimeout opens a file database // TestDefaultDBURLSetsWALAndBusyTimeout opens a file database
@@ -241,85 +236,6 @@ func TestDBURLSettingForeignKeysFailsStartup(t *testing.T) {
} }
} }
// TestPasswordCost checks the bcrypt cost of the hash that SetPassword
// stores: bcrypt.DefaultCost when db.Params leaves PasswordCost unset,
// as the server does, and PasswordCost when it is set.
func TestPasswordCost(t *testing.T) {
t.Parallel()
tests := []struct {
name string
passwordCost int
wantCost int
}{
{name: "unset", wantCost: bcrypt.DefaultCost},
{
name: "bcrypt.MinCost",
passwordCost: bcrypt.MinCost,
wantCost: bcrypt.MinCost,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
t.Parallel()
lifecycle := fxtest.NewLifecycle(t)
log, err := logger.New(lifecycle, logger.Params{
Globals: &globals.Globals{},
})
if err != nil {
t.Fatal(err)
}
database, err := db.New(lifecycle, db.Params{
Logger: log,
Config: &config.Config{DBURL: dbtest.NewURL(t)},
PasswordCost: test.passwordCost,
})
if err != nil {
t.Fatal(err)
}
lifecycle.RequireStart()
t.Cleanup(lifecycle.RequireStop)
sessionID, _, _, err := database.CreateSession(
t.Context(), "costuser", "", "", "",
)
if err != nil {
t.Fatal(err)
}
err = database.SetPassword(t.Context(), sessionID, "password123")
if err != nil {
t.Fatal(err)
}
var hash string
err = database.GetDB().QueryRowContext(
t.Context(),
"SELECT password_hash FROM sessions WHERE id = ?",
sessionID,
).Scan(&hash)
if err != nil {
t.Fatal(err)
}
cost, err := bcrypt.Cost([]byte(hash))
if err != nil {
t.Fatal(err)
}
if cost != test.wantCost {
t.Errorf("cost = %d, want %d", cost, test.wantCost)
}
})
}
}
// startDatabase starts a Database for dbURL the way the server does. // startDatabase starts a Database for dbURL the way the server does.
// It returns the error that stopped it from starting, if any. // It returns the error that stopped it from starting, if any.
func startDatabase(t *testing.T, dbURL string) (*db.Database, error) { func startDatabase(t *testing.T, dbURL string) (*db.Database, error) {
internal/handlers/api.go
+18 -2
View File
@@ -42,9 +42,25 @@ func (hdlr *Handlers) maxBodySize() int64 {
return defaultMaxBodySize return defaultMaxBodySize
} }
// clientIP returns the IP address in request.RemoteAddr, which the // clientIP extracts the connecting client's IP address
// ClientIP middleware has set to the client's address. // from the request, checking X-Forwarded-For and
// X-Real-IP headers before falling back to RemoteAddr.
func clientIP(request *http.Request) string { func clientIP(request *http.Request) string {
if forwarded := request.Header.Get("X-Forwarded-For"); forwarded != "" {
// X-Forwarded-For can contain a comma-separated list;
// the first entry is the original client.
parts := strings.SplitN(forwarded, ",", 2) //nolint:mnd
ip := strings.TrimSpace(parts[0])
if ip != "" {
return ip
}
}
if realIP := request.Header.Get("X-Real-IP"); realIP != "" {
return strings.TrimSpace(realIP)
}
host, _, err := net.SplitHostPort(request.RemoteAddr) host, _, err := net.SplitHostPort(request.RemoteAddr)
if err != nil { if err != nil {
return request.RemoteAddr return request.RemoteAddr
internal/handlers/api_test.go
+28 -193
View File
@@ -145,46 +145,24 @@ type testServer struct {
handlers *handlers.Handlers handlers *handlers.Handlers
} }
const (
// maxMessageSize is MAX_MESSAGE_SIZE on every test server, the
// setting's default.
maxMessageSize = 4096
// loginRateLimit is LOGIN_RATE_LIMIT on every test server, the
// setting's default.
loginRateLimit = 1
// loginRateBurst is LOGIN_RATE_BURST on every test server, the
// setting's default.
loginRateBurst = 5
)
func newTestServer( func newTestServer(
t *testing.T, t *testing.T,
) *testServer { ) *testServer {
t.Helper() t.Helper()
return newTestServerWith(t, 0, "", "", config.DefaultTrustedProxies) return newTestServerWith(t, 0, "", "")
} }
func newTestServerWith( func newTestServerWith(
t *testing.T, t *testing.T,
hashcashBits int, hashcashBits int,
operName, operPassword, trustedProxies string, operName, operPassword string,
) *testServer { ) *testServer {
t.Helper() t.Helper()
dbURL := dbtest.NewURL(t) dbURL := dbtest.NewURL(t)
copyTemplateDB(t, dbURL) copyTemplateDB(t, dbURL)
trusted, err := config.ParseTrustedProxies(trustedProxies)
if err != nil {
t.Fatalf("parse trusted proxies: %v", err)
}
// Each duration setting defaults to 30 days.
const thirtyDays = "720h"
var ( var (
srv *server.Server srv *server.Server
brk *broker.Broker brk *broker.Broker
@@ -198,22 +176,17 @@ func newTestServerWith(
logger.New, logger.New,
// Built here rather than by config.New, which writes // Built here rather than by config.New, which writes
// the global viper instance, so servers start in // the global viper instance, so servers start in
// parallel. // parallel. Settings left out take their defaults.
func() *config.Config { func() *config.Config {
return &config.Config{ return &config.Config{
DBURL: dbURL, DBURL: dbURL,
// One line: each line is a database write per new session. // One line: each line is a database write per new session.
MOTD: "neoirc test server", MOTD: "neoirc test server",
MaxMessageSize: maxMessageSize,
HashcashBits: hashcashBits, HashcashBits: hashcashBits,
OperName: operName, OperName: operName,
OperPassword: operPassword, OperPassword: operPassword,
MessageMaxAge: thirtyDays, MessageMaxAge: "720h",
QueueMaxAge: thirtyDays, QueueMaxAge: "720h",
SessionIdleTimeout: thirtyDays,
LoginRateLimit: loginRateLimit,
LoginRateBurst: loginRateBurst,
TrustedProxies: trusted,
} }
}, },
newTestDB, newTestDB,
@@ -836,7 +809,10 @@ func (tserver *testServer) postBody(
func TestRequestBodyLimit(t *testing.T) { func TestRequestBodyLimit(t *testing.T) {
t.Parallel() t.Parallel()
const nick = "alice_bodylimit" const (
maxMessageSize = 4096 // the default MAX_MESSAGE_SIZE
nick = "alice_bodylimit"
)
endpoints := []struct { endpoints := []struct {
name, path, value string name, path, value string
@@ -3041,18 +3017,18 @@ func TestGetMessagesRemovesWaitChannel(t *testing.T) {
longTimeout = 10 longTimeout = 10
// shortTimeout, in seconds, is the timeout of the // shortTimeout, in seconds, is the timeout of the
// request that waits it out. // requests that wait it out.
shortTimeout = 1 shortTimeout = 1
) )
// queued is whether a message is queued before the request, // queued is whether a message is queued before the request,
// whose timeout is in seconds. failingRead and notified are // whose timeout is in seconds. failingRead is as for
// as for getMessagesFailingRead. wantReads is how many times // getMessagesFailingRead. wantReads is how many times the
// the handler reads the queue: once if it answers at once, // handler reads the queue: once if it answers at once,
// twice if it waits first. // twice if it waits first.
tests := []struct { tests := []struct {
name string name string
queued, notified bool queued bool
timeout, failingRead int timeout, failingRead int
wantReads, wantStatus int wantReads, wantStatus int
}{ }{
@@ -3073,9 +3049,9 @@ func TestGetMessagesRemovesWaitChannel(t *testing.T) {
wantReads: 1, wantStatus: http.StatusInternalServerError, wantReads: 1, wantStatus: http.StatusInternalServerError,
}, },
{ {
name: "read after the wait failed", notified: true, name: "read after the wait failed", timeout: shortTimeout,
timeout: handlers.MaxLongPollTimeout, failingRead: 2, failingRead: 2, wantReads: 2,
wantReads: 2, wantStatus: http.StatusInternalServerError, wantStatus: http.StatusInternalServerError,
}, },
} }
@@ -3107,7 +3083,7 @@ func TestGetMessagesRemovesWaitChannel(t *testing.T) {
} }
status, reads := tserver.getMessagesFailingRead( status, reads := tserver.getMessagesFailingRead(
token, sessionID, lastID, tc.timeout, tc.failingRead, tc.notified, token, lastID, tc.timeout, tc.failingRead,
) )
if status != tc.wantStatus { if status != tc.wantStatus {
t.Errorf("status %d, want %d", status, tc.wantStatus) t.Errorf("status %d, want %d", status, tc.wantStatus)
@@ -3124,17 +3100,14 @@ func TestGetMessagesRemovesWaitChannel(t *testing.T) {
} }
// getMessagesFailingRead sends GET /api/v1/messages for the // getMessagesFailingRead sends GET /api/v1/messages for the
// client token of the session sessionID, with timeout and // client token with timeout and after afterID. The handler's
// after afterID. The handler's read of the queue numbered // read of the queue numbered failingRead, counting from 1,
// failingRead, counting from 1, fails; with 0, none does. // fails; with 0, none does. It returns the response status
// With notified, it notifies the broker once the request // and how many times the handler read the queue.
// waits. It returns the response status and how many times
// the handler read the queue.
func (tserver *testServer) getMessagesFailingRead( func (tserver *testServer) getMessagesFailingRead(
token string, token string,
sessionID, afterID int64, afterID int64,
timeout, failingRead int, timeout, failingRead int,
notified bool,
) (int, int) { ) (int, int) {
tserver.t.Helper() tserver.t.Helper()
@@ -3156,45 +3129,20 @@ func (tserver *testServer) getMessagesFailingRead(
) )
}) })
var ( resp, err := doRequestAuth(
status int
err error
)
answered := make(chan struct{})
go func() {
defer close(answered)
var resp *http.Response
resp, err = doRequestAuth(
tserver.t, http.MethodGet, tserver.t, http.MethodGet,
tserver.url(fmt.Sprintf( tserver.url(fmt.Sprintf(
"%s?timeout=%d&after=%d", apiMessages, timeout, afterID, "%s?timeout=%d&after=%d", apiMessages, timeout, afterID,
)), )),
token, nil, token, nil,
) )
if err != nil {
return
}
status = resp.StatusCode
_ = resp.Body.Close()
}()
if notified {
tserver.waitForLongPoll(sessionID)
tserver.broker.Notify(sessionID)
}
<-answered
if err != nil { if err != nil {
tserver.t.Fatalf("get messages: %v", err) tserver.t.Fatalf("get messages: %v", err)
} }
return status, reads _ = resp.Body.Close()
return resp.StatusCode, reads
} }
// TestLongPollRemovesWaitChannelWhenClientGivesUp checks that // TestLongPollRemovesWaitChannelWhenClientGivesUp checks that
@@ -4341,116 +4289,6 @@ func TestLoginRateLimitExceeded(t *testing.T) {
} }
} }
func TestLoginRateLimitIgnoresForwardedHeaders(t *testing.T) {
t.Parallel()
// The test client connects from 127.0.0.1, which is outside the
// default trusted proxies, so the server must ignore these headers.
tests := []struct {
name string
header string
}{
{name: "X-Forwarded-For", header: "X-Forwarded-For"},
{name: "X-Real-IP", header: "X-Real-IP"},
}
loginBody, err := json.Marshal(map[string]string{
nickKey: "unknownnick", passwordKey: "wrongpassword",
})
if err != nil {
t.Fatal(err)
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
t.Parallel()
tserver := newTestServer(t)
// The default burst is 5 attempts, so the sixth gets 429
// although each claims a new address.
var status int
for attempt := range 6 {
request, rErr := http.NewRequestWithContext(
t.Context(), http.MethodPost,
tserver.url("/api/v1/login"),
bytes.NewReader(loginBody),
)
if rErr != nil {
t.Fatal(rErr)
}
request.Header.Set("Content-Type", "application/json")
request.Header.Set(
test.header, fmt.Sprintf("203.0.113.%d", attempt+1),
)
resp, dErr := http.DefaultClient.Do(request)
if dErr != nil {
t.Fatal(dErr)
}
status = resp.StatusCode
_ = resp.Body.Close()
}
if status != http.StatusTooManyRequests {
t.Fatalf("sixth attempt got %d, want 429", status)
}
})
}
}
func TestLoginRateLimitPerClientBehindTrustedProxy(t *testing.T) {
t.Parallel()
// The test client connects from 127.0.0.1. Trusted as a proxy, it
// passes each client's address in X-Forwarded-For.
tserver := newTestServerWith(t, 0, "", "", "127.0.0.1")
// An empty JSON object is refused after the rate limit counts the
// attempt, so no attempt checks a password or looks up a hostname.
loginFrom := func(forwardedFor string) int {
t.Helper()
request, err := http.NewRequestWithContext(
t.Context(), http.MethodPost,
tserver.url("/api/v1/login"), strings.NewReader("{}"),
)
if err != nil {
t.Fatal(err)
}
request.Header.Set("Content-Type", "application/json")
request.Header.Set("X-Forwarded-For", forwardedFor)
resp, err := http.DefaultClient.Do(request)
if err != nil {
t.Fatal(err)
}
_ = resp.Body.Close()
return resp.StatusCode
}
// The default burst is 5 attempts per address.
for range 5 {
loginFrom("203.0.113.1")
}
status := loginFrom("203.0.113.1")
if status != http.StatusTooManyRequests {
t.Errorf("sixth attempt from 203.0.113.1 got %d, want 429", status)
}
status = loginFrom("203.0.113.2")
if status == http.StatusTooManyRequests {
t.Error("first attempt from 203.0.113.2 got 429")
}
}
func TestLoginRateLimitAllowsNormalUse(t *testing.T) { func TestLoginRateLimitAllowsNormalUse(t *testing.T) {
t.Parallel() t.Parallel()
@@ -5138,9 +4976,7 @@ func TestRefusedSessionLeavesStampUnspent(t *testing.T) {
badNick = "bad nick" badNick = "bad nick"
) )
tserver := newTestServerWith( tserver := newTestServerWith(t, bits, "", "")
t, bits, "", "", config.DefaultTrustedProxies,
)
// A server with no SERVER_NAME takes stamps for "neoirc". // A server with no SERVER_NAME takes stamps for "neoirc".
status := postSessionWithStamp( status := postSessionWithStamp(
@@ -5346,7 +5182,6 @@ func newTestServerWithOper(
return newTestServerWith( return newTestServerWith(
t, 0, testOperName, testOperPassword, t, 0, testOperName, testOperPassword,
config.DefaultTrustedProxies,
) )
} }
internal/handlers/export_test.go
-4
View File
@@ -6,10 +6,6 @@ import (
"sneak.berlin/go/neoirc/internal/db" "sneak.berlin/go/neoirc/internal/db"
) )
// MaxLongPollTimeout is the longest HandleGetMessages waits, in
// seconds.
const MaxLongPollTimeout = maxLongPollTimeout
// SetPollMessages makes HandleGetMessages read the client // SetPollMessages makes HandleGetMessages read the client
// output queue with poll in place of Database.PollMessages. // output queue with poll in place of Database.PollMessages.
func (hdlr *Handlers) SetPollMessages( func (hdlr *Handlers) SetPollMessages(
internal/ircserver/server_test.go
+10 -35
View File
@@ -31,10 +31,7 @@ import (
_ "modernc.org/sqlite" _ "modernc.org/sqlite"
) )
// testTimeout is how long a test waits for something before it const testTimeout = 5 * time.Second
// fails. A passing test never waits this long, so it is generous
// enough for a heavily loaded host.
const testTimeout = 30 * time.Second
// testPollInterval is how often the relay of a test server // testPollInterval is how often the relay of a test server
// checks the client output queue without a broker // checks the client output queue without a broker
@@ -568,49 +565,27 @@ func TestQuietClientAnsweringPingStaysConnected(t *testing.T) {
func TestQuietClientNotAnsweringPingIsClosed(t *testing.T) { func TestQuietClientNotAnsweringPingIsClosed(t *testing.T) {
t.Parallel() t.Parallel()
// A read deadline of two ping intervals would close the // latest leaves room for a loaded host, but is sooner than
// connection a second after latest. The ping interval is // a read deadline of two ping intervals would close it.
// longer than testPingInterval, so that the time between
// the expected close and latest leaves room for a loaded
// host.
const ( const (
interval = 4 * time.Second earliest = testPingInterval + testPongDeadline
earliest = interval + testPongDeadline latest = 2 * testPingInterval
latest = 2*interval - time.Second
) )
env := newTestEnvWithPingTimes( env := newTestEnvWithShortPings(t)
t,
&config.Config{ServerName: testServerName},
interval, testPongDeadline,
)
client := env.dial(t) client := env.dial(t)
lastSent := time.Now() lastSent := time.Now()
client.register("silent") client.register("silent")
client.readServerPing(lastSent)
// The server starts both waits once it has handled the
// registration, so the time registration took does not
// count against latest.
registered := time.Now()
client.readUntil(isServerPing)
client.readUntilClosed() client.readUntilClosed()
waited := time.Since(lastSent) waited := time.Since(lastSent)
if waited < earliest { if waited < earliest || waited >= latest {
t.Errorf( t.Errorf(
"closed %v after the client's last line, want at least %v", "closed %v after the client's last line, want %v to %v",
waited, earliest, waited, earliest, latest,
)
}
sinceRegistered := time.Since(registered)
if sinceRegistered >= latest {
t.Errorf(
"closed %v after registration, want less than %v",
sinceRegistered, latest,
) )
} }
} }
internal/middleware/middleware.go
+10 -80
View File
@@ -5,9 +5,6 @@ import (
"log/slog" "log/slog"
"net" "net"
"net/http" "net/http"
"net/netip"
"slices"
"strings"
"time" "time"
basicauth "github.com/99designs/basicauth-go" basicauth "github.com/99designs/basicauth-go"
@@ -18,7 +15,6 @@ import (
"github.com/slok/go-http-metrics/middleware/std" "github.com/slok/go-http-metrics/middleware/std"
"github.com/spf13/viper" "github.com/spf13/viper"
"go.uber.org/fx" "go.uber.org/fx"
"go4.org/netipx"
"sneak.berlin/go/neoirc/internal/config" "sneak.berlin/go/neoirc/internal/config"
"sneak.berlin/go/neoirc/internal/globals" "sneak.berlin/go/neoirc/internal/globals"
"sneak.berlin/go/neoirc/internal/logger" "sneak.berlin/go/neoirc/internal/logger"
@@ -66,77 +62,6 @@ func ipFromHostPort(hostPort string) string {
return host return host
} }
// ClientIP returns middleware that replaces request.RemoteAddr with the
// client's address and keeps the port of the TCP connection. The
// X-Forwarded-For and X-Real-IP headers count only when the connection
// comes from an address in TRUSTED_PROXIES.
func (mware *Middleware) ClientIP() func(http.Handler) http.Handler {
trusted := mware.params.Config.TrustedProxies
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(
writer http.ResponseWriter,
request *http.Request,
) {
peer, err := netip.ParseAddrPort(request.RemoteAddr)
if err == nil {
client := clientAddr(
peer.Addr().Unmap(), request.Header, trusted,
)
request.RemoteAddr = netip.AddrPortFrom(
client, peer.Port(),
).String()
}
next.ServeHTTP(writer, request)
})
}
}
// clientAddr returns the client's address for a request from peer. A
// peer outside trusted is the client, whatever its headers say. A
// trusted peer is a proxy. Its X-Forwarded-For list is read from the
// right, past the trusted addresses, to the first untrusted one; when
// all are trusted, the client is the leftmost. Without X-Forwarded-For,
// the client is X-Real-IP. An entry that is not an IP address gives
// peer.
func clientAddr(
peer netip.Addr, header http.Header, trusted *netipx.IPSet,
) netip.Addr {
if !trusted.Contains(peer) {
return peer
}
forwarded := strings.Join(header.Values("X-Forwarded-For"), ",")
if forwarded == "" {
realIP, err := netip.ParseAddr(
strings.TrimSpace(header.Get("X-Real-IP")),
)
if err != nil {
return peer
}
return realIP.Unmap()
}
client := peer
for _, entry := range slices.Backward(strings.Split(forwarded, ",")) {
addr, err := netip.ParseAddr(strings.TrimSpace(entry))
if err != nil {
return peer
}
client = addr.Unmap()
if !trusted.Contains(client) {
break
}
}
return client
}
type loggingResponseWriter struct { type loggingResponseWriter struct {
http.ResponseWriter http.ResponseWriter
@@ -200,19 +125,24 @@ func (mware *Middleware) Logging() func(http.Handler) http.Handler {
} }
} }
// CORS returns middleware that lets a page on any origin read the // CORS returns middleware that handles Cross-Origin Resource Sharing.
// response. Use it only on public, read-only routes. // AllowCredentials is true so browsers include cookies in
// cross-origin API requests.
func (mware *Middleware) CORS() func(http.Handler) http.Handler { func (mware *Middleware) CORS() func(http.Handler) http.Handler {
return cors.Handler(cors.Options{ //nolint:exhaustruct // optional fields return cors.Handler(cors.Options{ //nolint:exhaustruct // optional fields
AllowedOrigins: []string{"*"}, AllowOriginFunc: func(
_ *http.Request, _ string,
) bool {
return true
},
AllowedMethods: []string{ AllowedMethods: []string{
"GET", "POST", "PUT", "DELETE", "OPTIONS", "GET", "POST", "PUT", "DELETE", "OPTIONS",
}, },
AllowedHeaders: []string{ AllowedHeaders: []string{
"Accept", "Authorization", "Content-Type", "X-CSRF-Token", "Accept", "Content-Type", "X-CSRF-Token",
}, },
ExposedHeaders: []string{"Link"}, ExposedHeaders: []string{"Link"},
AllowCredentials: false, AllowCredentials: true,
MaxAge: corsMaxAge, MaxAge: corsMaxAge,
}) })
} }
internal/middleware/middleware_test.go
-189
View File
@@ -1,189 +0,0 @@
package middleware_test
import (
"net/http"
"net/http/httptest"
"net/netip"
"testing"
"time"
"go4.org/netipx"
"sneak.berlin/go/neoirc/internal/config"
"sneak.berlin/go/neoirc/internal/globals"
"sneak.berlin/go/neoirc/internal/logger"
"sneak.berlin/go/neoirc/internal/middleware"
)
// The tests trust 10.0.0.0/8. Clients use the documentation ranges
// 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24.
const (
trustedNetwork = "10.0.0.0/8"
proxyPeer = "10.0.0.1:4000"
directPeer = "192.0.2.1:4000"
client = "203.0.113.7"
clientWithPort = "203.0.113.7:4000"
realIPClient = "203.0.113.8"
)
type clientIPTest struct {
name string
remoteAddr string
forwarded []string
realIP string
want string
}
func clientIPTests() []clientIPTest {
return []clientIPTest{
{
name: "untrusted peer ignores forged headers",
remoteAddr: directPeer,
forwarded: []string{client},
realIP: realIPClient,
want: directPeer,
},
{name: "trusted peer without headers", remoteAddr: proxyPeer, want: proxyPeer},
{
name: "trusted peer gives rightmost untrusted entry",
remoteAddr: proxyPeer,
forwarded: []string{"198.51.100.9, 203.0.113.7, 10.0.0.2"},
want: clientWithPort,
},
{
name: "entries split over several headers",
remoteAddr: proxyPeer,
forwarded: []string{"198.51.100.9", client, "10.0.0.2"},
want: clientWithPort,
},
{
name: "all-trusted chain gives leftmost entry",
remoteAddr: proxyPeer,
forwarded: []string{"10.0.0.3, 10.0.0.2"},
want: "10.0.0.3:4000",
},
{
name: "X-Real-IP without X-Forwarded-For",
remoteAddr: proxyPeer,
realIP: realIPClient,
want: "203.0.113.8:4000",
},
{
name: "X-Forwarded-For wins over X-Real-IP",
remoteAddr: proxyPeer,
forwarded: []string{client},
realIP: realIPClient,
want: clientWithPort,
},
{
name: "unparseable X-Forwarded-For entry gives peer",
remoteAddr: proxyPeer,
forwarded: []string{"203.0.113.7, not-an-ip, 10.0.0.2"},
want: proxyPeer,
},
{
name: "unparseable entry past the client is not read",
remoteAddr: proxyPeer,
forwarded: []string{"not-an-ip, 203.0.113.7"},
want: clientWithPort,
},
{
name: "unparseable X-Real-IP gives peer",
remoteAddr: proxyPeer,
realIP: "not-an-ip",
want: proxyPeer,
},
{
name: "mapped IPv6 peer is unmapped and trusted",
remoteAddr: "[::ffff:10.0.0.1]:4000",
forwarded: []string{client},
want: clientWithPort,
},
{
name: "mapped IPv6 peer outside the set",
remoteAddr: "[::ffff:192.0.2.1]:4000",
forwarded: []string{client},
want: directPeer,
},
{
name: "IPv6 client",
remoteAddr: proxyPeer,
forwarded: []string{"2001:db8::1"},
want: "[2001:db8::1]:4000",
},
}
}
func TestClientIP(t *testing.T) {
t.Parallel()
mware := newMiddleware(t, trustedNetwork)
for _, test := range clientIPTests() {
t.Run(test.name, func(t *testing.T) {
t.Parallel()
var got string
handler := mware.ClientIP()(http.HandlerFunc(func(
_ http.ResponseWriter, request *http.Request,
) {
got = request.RemoteAddr
}))
request := httptest.NewRequestWithContext(
t.Context(), http.MethodGet, "/", nil,
)
request.RemoteAddr = test.remoteAddr
for _, value := range test.forwarded {
request.Header.Add("X-Forwarded-For", value)
}
if test.realIP != "" {
request.Header.Set("X-Real-IP", test.realIP)
}
handler.ServeHTTP(httptest.NewRecorder(), request)
if got != test.want {
t.Errorf("RemoteAddr = %q, want %q", got, test.want)
}
})
}
}
// newMiddleware returns a Middleware that trusts the network trusted.
func newMiddleware(t *testing.T, trusted string) *middleware.Middleware {
t.Helper()
var builder netipx.IPSetBuilder
builder.AddPrefix(netip.MustParsePrefix(trusted))
trustedSet, err := builder.IPSet()
if err != nil {
t.Fatal(err)
}
globs := &globals.Globals{
Appname: "neoirc-test",
Version: "test",
StartTime: time.Now(),
}
log, err := logger.New(nil, logger.Params{Globals: globs})
if err != nil {
t.Fatal(err)
}
mware, err := middleware.New(nil, middleware.Params{
Logger: log,
Globals: globs,
Config: &config.Config{TrustedProxies: trustedSet},
})
if err != nil {
t.Fatal(err)
}
return mware
}
internal/server/routes.go
+3 -3
View File
@@ -23,13 +23,13 @@ func (srv *Server) SetupRoutes() {
srv.router.Use(middleware.Recoverer) srv.router.Use(middleware.Recoverer)
srv.router.Use(middleware.RequestID) srv.router.Use(middleware.RequestID)
srv.router.Use(srv.mw.ClientIP())
srv.router.Use(srv.mw.Logging()) srv.router.Use(srv.mw.Logging())
if viper.GetString("METRICS_USERNAME") != "" { if viper.GetString("METRICS_USERNAME") != "" {
srv.router.Use(srv.mw.Metrics()) srv.router.Use(srv.mw.Metrics())
} }
srv.router.Use(srv.mw.CORS())
srv.router.Use(srv.mw.CSP()) srv.router.Use(srv.mw.CSP())
srv.router.Use(middleware.Timeout(routeTimeout)) srv.router.Use(middleware.Timeout(routeTimeout))
@@ -44,7 +44,7 @@ func (srv *Server) SetupRoutes() {
} }
// Health check. // Health check.
srv.router.With(srv.mw.CORS()).Get( srv.router.Get(
"/.well-known/healthcheck.json", "/.well-known/healthcheck.json",
srv.handlers.HandleHealthCheck(), srv.handlers.HandleHealthCheck(),
) )
@@ -68,7 +68,7 @@ func (srv *Server) SetupRoutes() {
} }
func (srv *Server) setupAPIv1(router chi.Router) { func (srv *Server) setupAPIv1(router chi.Router) {
router.With(srv.mw.CORS()).Get( router.Get(
"/server", "/server",
srv.handlers.HandleServerInfo(), srv.handlers.HandleServerInfo(),
) )
internal/server/server_test.go
-84
View File
@@ -6,10 +6,8 @@ package server_test
import ( import (
"fmt" "fmt"
"maps"
"net" "net"
"net/http" "net/http"
"net/http/httptest"
"strconv" "strconv"
"strings" "strings"
"testing" "testing"
@@ -190,88 +188,6 @@ func TestServeAfterStopDoesNotStopApp(t *testing.T) {
} }
} }
// TestCORSHeaders checks the Access-Control-Allow-* headers on the
// answers to requests from another origin. The public, read-only
// routes answer with Access-Control-Allow-Origin: * alone. Routes
// that need the cookie, and a preflight to one, answer with none.
func TestCORSHeaders(t *testing.T) {
var srv *server.Server
startApp(t, fx.Populate(&srv))
tests := []struct {
name string
method string
path string
requestMethod string
wantHeaders map[string]string
}{
{
name: "server information",
method: http.MethodGet,
path: "/api/v1/server",
wantHeaders: map[string]string{"Access-Control-Allow-Origin": "*"},
},
{
name: "health check",
method: http.MethodGet,
path: "/.well-known/healthcheck.json",
wantHeaders: map[string]string{"Access-Control-Allow-Origin": "*"},
},
{
name: "send",
method: http.MethodPost,
path: "/api/v1/messages",
},
{
name: "state",
method: http.MethodGet,
path: "/api/v1/state",
},
{
name: "preflight for send",
method: http.MethodOptions,
path: "/api/v1/messages",
requestMethod: http.MethodPost,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
request := httptest.NewRequestWithContext(
t.Context(), test.method,
"http://chat.example.com"+test.path, nil,
)
request.Header.Set("Origin", "http://blog.example.com")
if test.requestMethod != "" {
request.Header.Set(
"Access-Control-Request-Method", test.requestMethod,
)
}
recorder := httptest.NewRecorder()
srv.ServeHTTP(recorder, request)
gotHeaders := map[string]string{}
for name := range recorder.Header() {
if strings.HasPrefix(name, "Access-Control-Allow-") {
gotHeaders[name] = recorder.Header().Get(name)
}
}
if !maps.Equal(gotHeaders, test.wantHeaders) {
t.Errorf(
"Access-Control-Allow-* headers are %v, want %v",
gotHeaders, test.wantHeaders,
)
}
})
}
}
// startApp starts the app newApp builds, with the HTTP port // startApp starts the app newApp builds, with the HTTP port
// set to 0, so the system gives the server a free port. // set to 0, so the system gives the server a free port.
func startApp( func startApp(