mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
90b4f268e2
Client: - Add TOTP enrollment/disable UI in Settings > Account (AccountTab.ts) - Fix api.ts enableTotp/confirmTotp/disableTotp to require password param - Add totp_enabled field to UserWithRole type - Wire SettingsOverlay TOTP callbacks through MainPage and ConnectPage - 27 new tests: totp-settings (18), api TOTP methods (6), auth store (3) Server: - Fix targetBoolSetting to default false on ErrNotFound (fresh DB compat) - Fix admin settings test: boolean keys use valid values, not "testvalue" - Add require_2fa validation to settings handler (normalizeSettingUpdates) - Remove unused authenticateAdmin from logstream.go Docs: - Mark DOCUMENTATION_AUDIT Critical Finding #1 as RESOLVED - Update CLAUDE.md Key Features with 2FA/TOTP bullet - Update CLIENT-ARCHITECTURE.md with TOTP components - Update CHATSERVER.md login flow and rate limiting table - Create session log, update task tracking (T-192–T-201)
59 lines
2.2 KiB
Go
59 lines
2.2 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/owncord/server/auth"
|
|
)
|
|
|
|
func okHandler(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
|
|
func TestRateLimitMiddlewareWithPrefix_SeparatesLiveKitBucket(t *testing.T) {
|
|
limiter := auth.NewRateLimiter()
|
|
trustedProxies := []string{"127.0.0.0/8"}
|
|
|
|
livekit := rateLimitMiddlewareWithPrefix(limiter, "livekit_proxy:", 1, time.Minute, trustedProxies)(http.HandlerFunc(okHandler))
|
|
defaultRoute := RateLimitMiddleware(limiter, 1, time.Minute, trustedProxies)(http.HandlerFunc(okHandler))
|
|
|
|
firstLiveKit := httptest.NewRequest(http.MethodGet, "/livekit/rtc", nil)
|
|
firstLiveKit.RemoteAddr = "127.0.0.1:9999"
|
|
firstLiveKit.Header.Set("X-Forwarded-For", "198.51.100.10")
|
|
firstLiveKitRec := httptest.NewRecorder()
|
|
livekit.ServeHTTP(firstLiveKitRec, firstLiveKit)
|
|
if firstLiveKitRec.Code != http.StatusOK {
|
|
t.Fatalf("first livekit request status = %d, want 200", firstLiveKitRec.Code)
|
|
}
|
|
|
|
defaultReq := httptest.NewRequest(http.MethodGet, "/api/v1/auth/login", nil)
|
|
defaultReq.RemoteAddr = "127.0.0.1:9999"
|
|
defaultReq.Header.Set("X-Forwarded-For", "198.51.100.10")
|
|
defaultRec := httptest.NewRecorder()
|
|
defaultRoute.ServeHTTP(defaultRec, defaultReq)
|
|
if defaultRec.Code != http.StatusOK {
|
|
t.Fatalf("default route should not share the livekit bucket, got %d", defaultRec.Code)
|
|
}
|
|
|
|
secondLiveKit := httptest.NewRequest(http.MethodGet, "/livekit/rtc", nil)
|
|
secondLiveKit.RemoteAddr = "127.0.0.1:9999"
|
|
secondLiveKit.Header.Set("X-Forwarded-For", "198.51.100.10")
|
|
secondLiveKitRec := httptest.NewRecorder()
|
|
livekit.ServeHTTP(secondLiveKitRec, secondLiveKit)
|
|
if secondLiveKitRec.Code != http.StatusTooManyRequests {
|
|
t.Fatalf("second livekit request status = %d, want 429", secondLiveKitRec.Code)
|
|
}
|
|
|
|
differentClient := httptest.NewRequest(http.MethodGet, "/livekit/rtc", nil)
|
|
differentClient.RemoteAddr = "127.0.0.1:9999"
|
|
differentClient.Header.Set("X-Forwarded-For", "198.51.100.11")
|
|
differentClientRec := httptest.NewRecorder()
|
|
livekit.ServeHTTP(differentClientRec, differentClient)
|
|
if differentClientRec.Code != http.StatusOK {
|
|
t.Fatalf("different forwarded client should have a separate livekit bucket, got %d", differentClientRec.Code)
|
|
}
|
|
}
|