ilbinek
56d9e10621
Cross Compile Go / build (push) Canceled after 0s
- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts - admin API: overview stats, indexing queue, addon management (priority, reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes, traffic, metrics explorer, services, events/audit log, system info - built-in metrics: request latency per route, visitors, top addons and searches, indexer/scraper counters; minute buckets in the DB with hourly rollups and retention; optional Prometheus /metrics (METRICS_TOKEN) - POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat) and a stdlib-only Go client in telemetry/ - auth hardening: empty secrets no longer allow access, constant-time compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting - Dockerfile builds the UI and no longer bakes config.yaml into the image; CI builds the UI, runs tests and builds arm64 with CGO
81 lines
1.8 KiB
Go
81 lines
1.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.tbdevent.eu/TBD/reforger_crawler_main/initializers"
|
|
)
|
|
|
|
func TestSecretEqual(t *testing.T) {
|
|
if SecretEqual("", "") {
|
|
t.Fatal("empty configured secret must never match")
|
|
}
|
|
if SecretEqual("anything", "") {
|
|
t.Fatal("empty configured secret must never match")
|
|
}
|
|
if !SecretEqual("abc", "abc") {
|
|
t.Fatal("equal secrets must match")
|
|
}
|
|
if SecretEqual("abd", "abc") || SecretEqual("ab", "abc") {
|
|
t.Fatal("different secrets must not match")
|
|
}
|
|
}
|
|
|
|
func TestSessionToken(t *testing.T) {
|
|
initializers.AdminSecret = "first-secret-value"
|
|
initializers.AdminSessionTTL = time.Hour
|
|
now := time.Now()
|
|
|
|
tok, exp := IssueToken(now)
|
|
got, ok := VerifyToken(tok, now)
|
|
if !ok || got.Unix() != exp.Unix() {
|
|
t.Fatalf("fresh token should verify, ok=%v", ok)
|
|
}
|
|
|
|
if _, ok := VerifyToken(tok, now.Add(2*time.Hour)); ok {
|
|
t.Fatal("expired token must not verify")
|
|
}
|
|
|
|
parts := strings.Split(tok, ".")
|
|
parts[1] = "9999999999"
|
|
if _, ok := VerifyToken(strings.Join(parts, "."), now); ok {
|
|
t.Fatal("tampered token must not verify")
|
|
}
|
|
|
|
if _, ok := VerifyToken("garbage", now); ok {
|
|
t.Fatal("garbage must not verify")
|
|
}
|
|
|
|
initializers.AdminSecret = "rotated-secret-value"
|
|
if _, ok := VerifyToken(tok, now); ok {
|
|
t.Fatal("rotating the secret must invalidate sessions")
|
|
}
|
|
|
|
initializers.AdminSecret = ""
|
|
if _, ok := VerifyToken(tok, now); ok {
|
|
t.Fatal("no secret configured must reject all sessions")
|
|
}
|
|
}
|
|
|
|
func TestLoginLimiter(t *testing.T) {
|
|
l := NewLoginLimiter(3, time.Minute)
|
|
for range 3 {
|
|
if l.Blocked("1.2.3.4") {
|
|
t.Fatal("blocked too early")
|
|
}
|
|
l.Fail("1.2.3.4")
|
|
}
|
|
if !l.Blocked("1.2.3.4") {
|
|
t.Fatal("should be blocked after max failures")
|
|
}
|
|
if l.Blocked("5.6.7.8") {
|
|
t.Fatal("other IPs must not be affected")
|
|
}
|
|
l.Reset("1.2.3.4")
|
|
if l.Blocked("1.2.3.4") {
|
|
t.Fatal("reset should unblock")
|
|
}
|
|
}
|