sneak
a280fd2c34
Assert the ClientIP middleware stores the resolved address in the request context for trusted and untrusted peers, that the request log records the forwarded client rather than the proxy peer, and that a failed-login record carries the resolved address. Model: opus-4-8
42 lines
1.1 KiB
Go
42 lines
1.1 KiB
Go
package handlers
|
|
|
|
import (
|
|
"bytes"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/pixa/internal/clientip"
|
|
"sneak.berlin/go/pixa/internal/config"
|
|
)
|
|
|
|
// TestFailedLoginLogsResolvedClientIP verifies the failed-login record
|
|
// carries the resolved client IP from the request context, not the raw
|
|
// proxy peer address.
|
|
func TestFailedLoginLogsResolvedClientIP(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var buf bytes.Buffer
|
|
|
|
h := &Handlers{
|
|
log: slog.New(slog.NewJSONHandler(&buf, nil)),
|
|
config: &config.Config{SigningKey: testSigningKey},
|
|
}
|
|
|
|
form := url.Values{loginKeyField: {"wrong-key"}}
|
|
req := httptest.NewRequestWithContext(
|
|
t.Context(), http.MethodPost, "/",
|
|
strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req = req.WithContext(clientip.WithClientIP(req.Context(), "203.0.113.7"))
|
|
|
|
h.handleLoginPost(httptest.NewRecorder(), req)
|
|
|
|
if !strings.Contains(buf.String(), `"remote_addr":"203.0.113.7"`) {
|
|
t.Errorf("failed-login log missing resolved client IP; got %q", buf.String())
|
|
}
|
|
}
|