ident

16.3 KB

1. // tests/iplimit.mjs — THE PER-IP LIMIT GATE (mission 010). Starts its OWN servers (never
2. // the dev server on :8351, mail only into sink files):
3. // ident :8400 HL_HOST=127.0.0.1 (loopback only, as on Byrodin), IP limit 3 / 10 min,
4. // day limit 1000; storage .scratch/iplimit-gate/main
5. // ident :8401 short clocks: IP window 2 s, IP limit 3, day limit 5 (the long window)
6. // and TWO real headless Chromes (debug ports 8720-8729 / 8730-8739, --disable-gpu, killed
7. // by PID) that carry an X-Client-IP header each (CDP Network.setExtraHTTPHeaders) — what
8. // nginx adds on Byrodin.
9. //
10. // node tests/iplimit.mjs
11. //
12. // Covers: POST /api/code per IP (two IPs via the header: the limit hits one, not the
13. // other), X-Forwarded-For / CF-Connecting-IP / X-Real-IP never change the bucket, no
14. // header = ONE shared bucket, IPv6 by /64, IPv4-mapped IPv6 = IPv4, the per-address limit
15. // still applies across IPs, refused codes are not mailed, the old face `requestCode` is
16. // gone, strict body / 405, the long (day) window and the short window's expiry, the
17. // loopback bind (not reachable on the LAN address), and in real browsers: the refusal is
18. // visible on the page, the other browser (other IP) still signs in.
19. // Screenshots: .scratch/iplimit-*.png — look. Server logs: .scratch/iplimit-gate/*.log
20. import { spawn } from 'node:child_process';
21. import { rmSync, mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
22. import { dirname, join, resolve } from 'node:path';
23. import { fileURLToPath } from 'node:url';
24. import { networkInterfaces } from 'node:os';
25. import { launchBrowser } from './cdp.mjs';
27. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
28. const HERE = dirname(fileURLToPath(import.meta.url));
29. const APP = resolve(HERE, '..');
30. const BIN = join(APP, 'bin/hybriel');
31. const SCRATCH = join(APP, '.scratch');
32. const G = join(SCRATCH, 'iplimit-gate');
33. rmSync(G, { recursive: true, force: true });
34. mkdirSync(G, { recursive: true });
36. const P_MAIN = 8400, P_SHORT = 8401;
37. const ID = `http://127.0.0.1:${P_MAIN}`;
38. const IDS = `http://127.0.0.1:${P_SHORT}`;
39. const SINK = join(G, 'main-mail.txt'), SINK_S = join(G, 'short-mail.txt');
41. let failures = 0, passes = 0;
42. function check(label, ok, detail = '') {
43. console.log(`${ok ? 'ok ' : 'FAIL'} ${label}${ok ? '' : ' — ' + detail}`);
44. if (ok) passes++; else failures++;
45. }
46. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
47. const J = JSON.stringify;
49. const procs = [];
50. function start(name, env) {
51. let log = '';
52. const p = spawn(BIN, ['project.hl'], { cwd: APP, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env }, stdio: ['ignore', 'pipe', 'pipe'] });
53. p.stdout.on('data', d => log += d); p.stderr.on('data', d => log += d);
54. p.on('exit', () => writeFileSync(join(G, `${name}.log`), log));
55. procs.push({ name, p, log: () => log });
56. return p;
57. }
58. start('main', { IDENT_PORT: String(P_MAIN), HL_HOST: '127.0.0.1', IDENT_STORAGE: join(G, 'main'), IDENT_SESSIONS: join(G, 'main-sess') + '/', IDENT_MAIL_SINK: SINK, IDENT_IP_LIMIT: '3', IDENT_IP_DAY_LIMIT: '1000' });
59. start('short', { IDENT_PORT: String(P_SHORT), IDENT_STORAGE: join(G, 'short'), IDENT_SESSIONS: join(G, 'short-sess') + '/', IDENT_MAIL_SINK: SINK_S, IDENT_IP_LIMIT: '3', IDENT_IP_WINDOW_MS: '2000', IDENT_IP_DAY_LIMIT: '5' });
61. function mails(sink, email) {
62. if (!existsSync(sink)) return [];
63. return readFileSync(sink, 'utf8').split('\n').filter(l => l.startsWith(email + ' ')).map(l => l.split(' ')[1]);
64. }
65. const mailCount = (sink) => existsSync(sink) ? readFileSync(sink, 'utf8').split('\n').filter(Boolean).length : 0;
67. // POST /api/code as a client behind nginx would arrive: `headers` are the extra ones
68. async function code(base, email, headers = {}, raw = null) {
69. const r = await fetch(base + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body: raw !== null ? raw : J({ email }) });
70. const t = await r.text();
71. let j = null; try { j = JSON.parse(t); } catch {}
72. return { status: r.status, j, t };
73. }
74. const IPMSG = 'too many codes were requested from your network — wait a while and try again';
75. const limited = (r) => r.status === 429 && r.j && r.j.error === IPMSG;
77. const connected = (page, label) => page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label });
78. async function viewport(page, width, height) {
79. await page.send('Emulation.setDeviceMetricsOverride', { width, height, deviceScaleFactor: 1, mobile: width < 600 });
80. await sleep(250);
81. }
82. async function shot(page, name) {
83. const { data } = await page.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
84. writeFileSync(join(SCRATCH, `iplimit-${name}.png`), Buffer.from(data, 'base64'));
85. }
86. const noOverflow = (page) => page.evaluate('document.documentElement.scrollWidth <= window.innerWidth');
87. async function askCode(page, email) {
88. await page.waitForSelector('#email');
89. await connected(page, 'socket before asking');
90. await page.type('#email', email, { clear: true });
91. await page.evaluate('document.querySelector("#message").textContent = ""');
92. await page.click('#sendcode');
93. // ident#20: a sent code navigates to the code page (/code) — wait for it to hydrate
94. await page.waitFor('(/\\/code$/.test(location.pathname) && !!document.querySelector("#code")) || /\\S/.test(document.querySelector("#message").textContent)', { label: 'code page or message after ' + email });
95. if (await page.evaluate('/\\/code$/.test(location.pathname)')) await connected(page, 'code page hydrated');
96. }
98. let A, B, a, b;
99. try {
100. for (const [name, url] of [['main', ID + '/'], ['short', IDS + '/']]) {
101. let up = false;
102. for (let i = 0; i < 80; i++) { try { const r = await fetch(url); if (r.ok) { up = true; break; } } catch {} await sleep(250); }
103. if (!up) throw new Error(`${name} server did not come up\n` + procs.find(p => p.name === name).log());
104. }
106. // ---- the loopback bind (HL_HOST=127.0.0.1, as on Byrodin) ------------------------------
107. const lan = Object.values(networkInterfaces()).flat().find(i => i && i.family === 'IPv4' && !i.internal);
108. let lanReach = 'no LAN address';
109. if (lan) { try { const r = await fetch(`http://${lan.address}:${P_MAIN}/`, { signal: AbortSignal.timeout(2000) }); lanReach = 'answered ' + r.status; } catch (e) { lanReach = 'refused'; } }
110. check(`bind: HL_HOST=127.0.0.1 → not reachable on the LAN address (${lan && lan.address})`, lanReach === 'refused', lanReach);
111. let lanShort = 'no LAN address';
112. if (lan) { try { const r = await fetch(`http://${lan.address}:${P_SHORT}/`, { signal: AbortSignal.timeout(2000) }); lanShort = 'answered ' + r.status; } catch (e) { lanShort = 'refused'; } }
113. check('bind: without HL_HOST → 0.0.0.0 as before (the LAN address answers 200)', lanShort === 'answered 200', lanShort);
115. // ---- two IPs via the header: the limit hits one, not the other --------------------------
116. let r;
117. for (const n of [1, 2, 3]) {
118. r = await code(ID, `x${n}@example.org`, { 'X-Client-IP': '203.0.113.7' });
119. check(`ip 203.0.113.7: code ${n} of 3 → 200, mailed`, r.status === 200 && r.j.email === `x${n}@example.org` && mails(SINK, `x${n}@example.org`).length === 1, r.t);
120. }
121. r = await code(ID, '[email protected]', { 'X-Client-IP': '203.0.113.7' });
122. check('ip 203.0.113.7: the 4th code (another address) → 429 with the reason, NOT mailed', limited(r) && mails(SINK, '[email protected]').length === 0, r.t);
123. r = await code(ID, '[email protected]', { 'X-Client-IP': '198.51.100.9' });
124. check('ip 198.51.100.9: the same address from another IP → 200, mailed', r.status === 200 && mails(SINK, '[email protected]').length === 1, r.t);
126. // ---- the header cannot be bypassed with another IP header -------------------------------
127. const before = mailCount(SINK);
128. r = await code(ID, '[email protected]', { 'X-Client-IP': '203.0.113.7', 'X-Forwarded-For': '192.0.2.1', 'CF-Connecting-IP': '192.0.2.2', 'X-Real-IP': '192.0.2.3', 'Forwarded': 'for=192.0.2.4' });
129. check('bypass: X-Forwarded-For / CF-Connecting-IP / X-Real-IP / Forwarded beside X-Client-IP → still 429', limited(r), r.t);
130. r = await code(ID, '[email protected]', { 'x-client-ip': '203.0.113.7' });
131. check('bypass: the header in lower case is the same header → 429', limited(r), r.t);
132. r = await code(ID, '[email protected]', { 'X-Client-IP': ' 203.0.113.7 ' });
133. check('bypass: surrounding blanks are trimmed → 429', limited(r), r.t);
134. check('bypass: nothing was mailed by the refused requests', mailCount(SINK) === before, String(mailCount(SINK) - before));
136. // ---- no X-Client-IP (dev, no nginx): ONE shared bucket, other headers ignored ----------
137. const direct = [];
138. for (const [n, fwd] of [[1, '192.0.2.11'], [2, '192.0.2.12'], [3, '192.0.2.13'], [4, '192.0.2.14']]) {
139. direct.push(await code(ID, `d${n}@example.org`, { 'X-Forwarded-For': fwd, 'CF-Connecting-IP': fwd }));
140. }
141. check('no header: 3 codes pass, each with a different X-Forwarded-For / CF-Connecting-IP', direct.slice(0, 3).every(x => x.status === 200), J(direct.slice(0, 3).map(x => x.status)));
142. check('no header: the 4th → 429 (one shared bucket; the forwarded headers do not split it)', limited(direct[3]) && mails(SINK, '[email protected]').length === 0, direct[3].t);
143. r = await code(ID, '[email protected]', { 'X-Client-IP': '' });
144. check('an EMPTY X-Client-IP counts as no header (shared bucket) → 429', limited(r), r.t);
146. // ---- IPv6: one bucket per /64; IPv4-mapped = the IPv4 address ------------------------
147. const v6 = [];
148. for (const [n, ip] of [[1, '2001:db8:aa:1::1'], [2, '2001:0DB8:00AA:0001:ffff::2'], [3, '2001:db8:aa:1:1:2:3:4'], [4, '2001:db8:aa:1::99']]) {
149. v6.push(await code(ID, `v${n}@example.org`, { 'X-Client-IP': ip }));
150. }
151. check('ipv6: 3 addresses of one /64 (written differently) pass', v6.slice(0, 3).every(x => x.status === 200), J(v6.map(x => x.status)));
152. check('ipv6: a 4th address of the same /64 → 429', limited(v6[3]), v6[3].t);
153. r = await code(ID, '[email protected]', { 'X-Client-IP': '2001:db8:aa:2::1' });
154. check('ipv6: the next /64 is another bucket → 200', r.status === 200, r.t);
155. r = await code(ID, '[email protected]', { 'X-Client-IP': '::ffff:203.0.113.7' });
156. check('ipv4-mapped ipv6 ::ffff:203.0.113.7 = 203.0.113.7 → 429', limited(r), r.t);
158. // ---- the per-address limit still applies (3 per address, across IPs) --------------------
159. const per = [];
160. for (const n of [1, 2, 3, 4]) per.push(await code(ID, '[email protected]', { 'X-Client-IP': `198.18.0.${n}` }));
161. check('per address: 3 codes to one address from 3 IPs pass', per.slice(0, 3).every(x => x.status === 200), J(per.map(x => x.status)));
162. check('per address: the 4th from a 4th IP → 429 "sent to this address", mailed 3 times', per[3].status === 429 && /too many codes were sent to this address/.test(per[3].j.error) && mails(SINK, '[email protected]').length === 3, per[3].t);
164. // ---- the route itself ---------------------------------------------------------------
165. r = await fetch(ID + '/api/code');
166. check('GET /api/code → 405', r.status === 405, String(r.status));
167. r = await code(ID, null, { 'X-Client-IP': '198.19.0.1' }, '{"email":"[email protected]","ip":"1.2.3.4"}');
168. check('strict body: an unknown field (ip) → 400 naming it', r.status === 400 && r.j.error === 'unknown field: ip', r.t);
169. r = await code(ID, null, { 'X-Client-IP': '198.19.0.1' }, '{bad');
170. check('invalid JSON → 400, no source path', r.status === 400 && /not valid JSON/.test(r.j.error) && !/\.hl/.test(r.t), r.t);
171. r = await code(ID, 'not-an-address', { 'X-Client-IP': '198.19.0.1' });
172. check('not an address → 400', r.status === 400 && r.j.error === 'that is not an email address', r.t);
173. const fr = await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: 1, event: 'requestCode', payload: ['[email protected]'] }) });
174. const fj = await fr.json();
175. check('the old face requestCode is gone (no handler), nothing mailed', fj.ok === false && /no class/.test(fj.error || '') && mails(SINK, '[email protected]').length === 0, J(fj));
177. // ---- the long window (day limit 5) and the short window's expiry (2 s) ------------------
178. const s = [];
179. for (const n of [1, 2, 3, 4]) s.push(await code(IDS, `s${n}@example.org`, { 'X-Client-IP': '192.0.2.50' }));
180. check('short server: 3 pass, the 4th in the window → 429', s.slice(0, 3).every(x => x.status === 200) && limited(s[3]), J(s.map(x => x.status)));
181. await sleep(2200);
182. const s2 = [await code(IDS, '[email protected]', { 'X-Client-IP': '192.0.2.50' }), await code(IDS, '[email protected]', { 'X-Client-IP': '192.0.2.50' })];
183. check('short server: after the 2 s window 2 more pass (5 in the long window)', s2.every(x => x.status === 200), J(s2.map(x => x.status)));
184. await sleep(2200);
185. r = await code(IDS, '[email protected]', { 'X-Client-IP': '192.0.2.50' });
186. check('short server: the short window is free again, but the day limit (5) → 429, not mailed', limited(r) && mails(SINK_S, '[email protected]').length === 0, r.t);
187. r = await code(IDS, '[email protected]', { 'X-Client-IP': '192.0.2.51' });
188. check('short server: another IP is unaffected → 200', r.status === 200, r.t);
190. // ---- real browsers: one IP each (nginx's header, set per browser) ----------------------
191. A = await launchBrowser({ debugPortRange: [8720, 8729] });
192. B = await launchBrowser({ debugPortRange: [8730, 8739] });
193. a = await A.newPage();
194. b = await B.newPage();
195. for (const [pg, ip] of [[a, '100.64.0.1'], [b, '100.64.0.2']]) {
196. await pg.send('Network.enable');
197. await pg.send('Network.setExtraHTTPHeaders', { headers: { 'X-Client-IP': ip } });
198. }
199. await a.goto(ID + '/');
200. for (const n of [1, 2, 3]) {
201. await askCode(a, `ba${n}@example.org`);
202. const ok = await a.evaluate('!!document.querySelector("#code")');
203. check(`browser A (100.64.0.1): code ${n} → the code form, mailed`, ok && mails(SINK, `ba${n}@example.org`).length === 1, await a.text('#message'));
204. await a.click('#back');
205. await a.waitForSelector('#email');
206. }
207. await askCode(a, '[email protected]');
208. const shown = await a.text('#message');
209. check('browser A: the 4th → the refusal is VISIBLE on the page, still on the email form, not mailed', shown === IPMSG && await a.evaluate('!!document.querySelector("#emailform") && !document.querySelector("#code")') && mails(SINK, '[email protected]').length === 0, shown);
210. await viewport(a, 390, 844); await shot(a, 'refused-390');
211. check('layout: 390px refusal has no horizontal overflow', await noOverflow(a));
212. await viewport(a, 1280, 900); await shot(a, 'refused-1280');
213. check('layout: 1280px refusal has no horizontal overflow', await noOverflow(a));
215. await b.goto(ID + '/');
216. await askCode(b, '[email protected]');
217. check('browser B (100.64.0.2): the same moment, another IP → the code form', await b.evaluate('!!document.querySelector("#code")'), await b.text('#message'));
218. const bc = mails(SINK, '[email protected]').at(-1);
219. await b.type('#code', bc, { clear: true });
220. await b.click('#verify');
221. await b.waitFor('!!document.querySelector("#identityform") || !!document.querySelector("#identities")', { label: 'B signed in' });
222. check('browser B: the code signs in (first login: the welcome form)', await b.evaluate('!!document.querySelector("#welcome")') && (await b.text('#meemail')) === '[email protected]', await b.text('#message'));
223. await b.goto(ID + '/');
224. await b.waitForSelector('#identities');
225. check('browser B: reload keeps the session (identsid cookie over the pinned listener)', (await b.text('#meemail')) === '[email protected]');
227. // the refused fetch is a 429: Chrome logs "Failed to load resource … 429" — expected
228. const expected = /favicon|status of 429 .*\/api\/code$/;
229. const problems = [...a.problems(), ...b.problems()].filter(m => !expected.test(m.text));
230. check('browsers: no console errors or warnings (besides the expected 429 line)', problems.length === 0, J(problems.slice(0, 5)));
231. } catch (e) {
232. failures++;
233. console.log('FAIL (aborted) ' + (e && e.stack || e));
234. for (const [n, pg] of [['A', a], ['B', b]]) if (pg) console.log(`console ${n}: ` + J(pg.messages.slice(-8)));
235. } finally {
236. for (const br of [A, B]) { if (br) { try { await br.close(); } catch {} } }
237. for (const { p } of procs) { try { p.kill('SIGTERM'); } catch {} }
238. await sleep(500);
239. for (const { p } of procs) { if (p.exitCode === null && p.signalCode === null) { try { p.kill('SIGKILL'); } catch {} } }
240. await sleep(200);
241. console.log(`\n${passes} passed, ${failures} failed`);
242. process.exit(failures ? 1 : 0);
243. }