0.34.13_cleaup_code
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
ec46a96a29
commit
5c2e50ec06
87 files changed
+4890
-1338
No files matched your search
+180
-67
@@ -654,11 +654,29 @@ mod tests {
|
||||
#[test]
|
||||
fn config_section_registry_read_and_replace_are_symmetric() {
|
||||
let names = [
|
||||
"listeners", "docker-agents", "http2", "pages", "cache", "transform",
|
||||
"forwarding", "headers", "prometheus", "geoip", "administration",
|
||||
"tls", "vhosts", "web-services", "php-fpm-profiles", "redirects",
|
||||
"not-found-hosts", "streams", "acl-profiles", "host-policies",
|
||||
"response", "logging", "global-security",
|
||||
"listeners",
|
||||
"docker-agents",
|
||||
"http2",
|
||||
"pages",
|
||||
"cache",
|
||||
"transform",
|
||||
"forwarding",
|
||||
"headers",
|
||||
"prometheus",
|
||||
"geoip",
|
||||
"administration",
|
||||
"tls",
|
||||
"vhosts",
|
||||
"web-services",
|
||||
"php-fpm-profiles",
|
||||
"redirects",
|
||||
"not-found-hosts",
|
||||
"streams",
|
||||
"acl-profiles",
|
||||
"host-policies",
|
||||
"response",
|
||||
"logging",
|
||||
"global-security",
|
||||
];
|
||||
let mut original = Config::default();
|
||||
original.global_security.compile().unwrap();
|
||||
@@ -671,7 +689,14 @@ mod tests {
|
||||
assert_eq!(serde_json::to_value(&updated).unwrap(), expected, "{name}");
|
||||
assert_eq!(section.read(&updated), value, "{name}");
|
||||
}
|
||||
for name in ["user-agent-blocking", "error_log", "history", "storage", "unknown", "tls/nested"] {
|
||||
for name in [
|
||||
"user-agent-blocking",
|
||||
"error_log",
|
||||
"history",
|
||||
"storage",
|
||||
"unknown",
|
||||
"tls/nested",
|
||||
] {
|
||||
assert!(ConfigSection::from_name(name).is_none(), "{name}");
|
||||
}
|
||||
}
|
||||
@@ -681,17 +706,40 @@ mod tests {
|
||||
let (router, store, _dir, secret, _csrf) = fixture().await;
|
||||
let cookie = format!("{}={secret}", auth::COOKIE_NAME);
|
||||
for name in [
|
||||
"listeners", "docker-agents", "http2", "pages", "cache", "transform",
|
||||
"forwarding", "headers", "prometheus", "geoip", "administration", "tls",
|
||||
"vhosts", "web-services", "php-fpm-profiles", "redirects", "not-found-hosts",
|
||||
"streams", "acl-profiles", "host-policies", "response", "logging",
|
||||
"listeners",
|
||||
"docker-agents",
|
||||
"http2",
|
||||
"pages",
|
||||
"cache",
|
||||
"transform",
|
||||
"forwarding",
|
||||
"headers",
|
||||
"prometheus",
|
||||
"geoip",
|
||||
"administration",
|
||||
"tls",
|
||||
"vhosts",
|
||||
"web-services",
|
||||
"php-fpm-profiles",
|
||||
"redirects",
|
||||
"not-found-hosts",
|
||||
"streams",
|
||||
"acl-profiles",
|
||||
"host-policies",
|
||||
"response",
|
||||
"logging",
|
||||
"global-security",
|
||||
] {
|
||||
let response = router.clone().oneshot(
|
||||
request(&format!("/api/config/{name}"))
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty()).unwrap(),
|
||||
).await.unwrap();
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request(&format!("/api/config/{name}"))
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK, "{name}");
|
||||
let data = json_body(response).await;
|
||||
assert_eq!(data["section"], name);
|
||||
@@ -708,24 +756,57 @@ mod tests {
|
||||
assert!(data["value"]["user_agent_blocking"].is_object());
|
||||
}
|
||||
}
|
||||
let unknown = router.clone().oneshot(
|
||||
request("/api/config/user-agent-blocking")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty()).unwrap(),
|
||||
).await.unwrap();
|
||||
let unknown = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/api/config/user-agent-blocking")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(unknown.status(), StatusCode::NOT_FOUND);
|
||||
store.close().await;
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn geoip_update_is_scoped_to_settings_for_general_api_tokens() {
|
||||
assert!(general_api_token_allowed(&Method::GET, "/api/config/geoip", "ro"));
|
||||
assert!(general_api_token_allowed(&Method::PUT, "/api/config/geoip", "rw"));
|
||||
assert!(!general_api_token_allowed(&Method::PUT, "/api/config/geoip", "ro"));
|
||||
assert!(general_api_token_allowed(&Method::POST, "/api/config/geoip/update", "rw"));
|
||||
assert!(!general_api_token_allowed(&Method::POST, "/api/config/geoip/update", "ro"));
|
||||
assert!(!general_api_token_allowed(&Method::POST, "/api/geoip/update", "rw"));
|
||||
assert!(!general_api_token_allowed(&Method::GET, "/api/config/geoip/update", "rw"));
|
||||
assert!(general_api_token_allowed(
|
||||
&Method::GET,
|
||||
"/api/config/geoip",
|
||||
"ro"
|
||||
));
|
||||
assert!(general_api_token_allowed(
|
||||
&Method::PUT,
|
||||
"/api/config/geoip",
|
||||
"rw"
|
||||
));
|
||||
assert!(!general_api_token_allowed(
|
||||
&Method::PUT,
|
||||
"/api/config/geoip",
|
||||
"ro"
|
||||
));
|
||||
assert!(general_api_token_allowed(
|
||||
&Method::POST,
|
||||
"/api/config/geoip/update",
|
||||
"rw"
|
||||
));
|
||||
assert!(!general_api_token_allowed(
|
||||
&Method::POST,
|
||||
"/api/config/geoip/update",
|
||||
"ro"
|
||||
));
|
||||
assert!(!general_api_token_allowed(
|
||||
&Method::POST,
|
||||
"/api/geoip/update",
|
||||
"rw"
|
||||
));
|
||||
assert!(!general_api_token_allowed(
|
||||
&Method::GET,
|
||||
"/api/config/geoip/update",
|
||||
"rw"
|
||||
));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -736,9 +817,16 @@ mod tests {
|
||||
("/api/config/geoip/update", StatusCode::METHOD_NOT_ALLOWED),
|
||||
("/api/geoip/update", StatusCode::NOT_FOUND),
|
||||
] {
|
||||
let response = router.clone().oneshot(
|
||||
request(path).header("cookie", &cookie).body(Body::empty()).unwrap(),
|
||||
).await.unwrap();
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request(path)
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), expected, "{path}");
|
||||
}
|
||||
store.close().await;
|
||||
@@ -813,12 +901,10 @@ mod tests {
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.body(Body::from(
|
||||
serde_json::to_vec(
|
||||
&json!({"expected_revision":0,"value":{
|
||||
"logging":Config::default().logging,
|
||||
"error_log":Config::default().error_log
|
||||
}}),
|
||||
)
|
||||
serde_json::to_vec(&json!({"expected_revision":0,"value":{
|
||||
"logging":Config::default().logging,
|
||||
"error_log":Config::default().error_log
|
||||
}}))
|
||||
.unwrap(),
|
||||
))
|
||||
.unwrap(),
|
||||
@@ -846,7 +932,6 @@ mod tests {
|
||||
store.close().await;
|
||||
}
|
||||
|
||||
|
||||
#[tokio::test]
|
||||
async fn global_security_section_saves_rules_and_existing_ua_atomically() {
|
||||
let (router, _store, _dir, secret, csrf) = fixture().await;
|
||||
@@ -858,53 +943,81 @@ mod tests {
|
||||
"user_agent_blocking": {"enabled":true, "patterns":["bad-bot"]}
|
||||
});
|
||||
let body = serde_json::to_vec(&json!({"expected_revision":0, "value":value})).unwrap();
|
||||
let response = router.clone().oneshot(
|
||||
request("/api/config/global-security")
|
||||
.method("PUT")
|
||||
.header("content-type", "application/json")
|
||||
.header("cookie", &cookie)
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.body(Body::from(body)).unwrap(),
|
||||
).await.unwrap();
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/api/config/global-security")
|
||||
.method("PUT")
|
||||
.header("content-type", "application/json")
|
||||
.header("cookie", &cookie)
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.body(Body::from(body))
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let json = json_body(response).await;
|
||||
assert_eq!(json["revision"], 1);
|
||||
assert_eq!(json["config"]["global_security"]["country_access"]["countries"][0], "RU");
|
||||
assert_eq!(json["config"]["global_security"]["security_headers"]["nosniff"], true);
|
||||
assert_eq!(json["config"]["global_security"]["user_agent_blocking"]["patterns"][0], "bad-bot");
|
||||
assert_eq!(
|
||||
json["config"]["global_security"]["country_access"]["countries"][0],
|
||||
"RU"
|
||||
);
|
||||
assert_eq!(
|
||||
json["config"]["global_security"]["security_headers"]["nosniff"],
|
||||
true
|
||||
);
|
||||
assert_eq!(
|
||||
json["config"]["global_security"]["user_agent_blocking"]["patterns"][0],
|
||||
"bad-bot"
|
||||
);
|
||||
assert!(json["config"].get("user_agent_blocking").is_none());
|
||||
|
||||
// A partial section update must not silently reset the existing UA policy.
|
||||
let body = serde_json::to_vec(&json!({
|
||||
"expected_revision":1,
|
||||
"value": {"method_policy":{"mode":"off","methods":[]}}
|
||||
})).unwrap();
|
||||
let response = router.clone().oneshot(
|
||||
request("/api/config/global-security")
|
||||
.method("PUT")
|
||||
.header("content-type", "application/json")
|
||||
.header("cookie", &cookie)
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.body(Body::from(body)).unwrap(),
|
||||
).await.unwrap();
|
||||
}))
|
||||
.unwrap();
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/api/config/global-security")
|
||||
.method("PUT")
|
||||
.header("content-type", "application/json")
|
||||
.header("cookie", &cookie)
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.body(Body::from(body))
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::BAD_REQUEST);
|
||||
|
||||
// GET returns the same standalone section shape accepted by PUT, at the
|
||||
// matching revision and without unrequested configuration fields.
|
||||
let read = router.clone().oneshot(
|
||||
request("/api/config/global-security")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty()).unwrap(),
|
||||
).await.unwrap();
|
||||
let read = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/api/config/global-security")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(read.status(), StatusCode::OK);
|
||||
let view = json_body(read).await;
|
||||
assert_eq!(view["revision"], 1);
|
||||
assert_eq!(view["section"], "global-security");
|
||||
assert_eq!(view["value"]["user_agent_blocking"]["patterns"][0], "bad-bot");
|
||||
assert_eq!(
|
||||
view["value"]["user_agent_blocking"]["patterns"][0],
|
||||
"bad-bot"
|
||||
);
|
||||
assert!(view.get("config").is_none());
|
||||
assert!(view["value"].get("global_security").is_none());
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user