feat: enforce tenant login IP whitelists

server/tenant_login_ip_whitelist_test.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/tinode/chat/server/store/types"
+)
+
+type staticTenantLoginIPWhitelistProvider struct {
+	config *tenantLoginIPWhitelistConfig
+	err    error
+}
+
+func (p staticTenantLoginIPWhitelistProvider) TenantLoginIPWhitelist(types.TenantID) (*tenantLoginIPWhitelistConfig, error) {
+	return p.config, p.err
+}
+
+func resetTenantLoginIPWhitelistTestState(t *testing.T) {
+	t.Helper()
+	previousProvider := loginIPWhitelistProvider
+	tenantLoginIPWhitelistCache.Lock()
+	previousCache := tenantLoginIPWhitelistCache.items
+	tenantLoginIPWhitelistCache.items = make(map[types.TenantID]tenantLoginIPWhitelistCacheEntry)
+	tenantLoginIPWhitelistCache.Unlock()
+	t.Cleanup(func() {
+		loginIPWhitelistProvider = previousProvider
+		tenantLoginIPWhitelistCache.Lock()
+		tenantLoginIPWhitelistCache.items = previousCache
+		tenantLoginIPWhitelistCache.Unlock()
+	})
+}
+
+func TestTenantLoginIPChannel(t *testing.T) {
+	for platform, expected := range map[string]string{
+		"web": "web", "WEB": "web", "ios": "app", "android": "app", "": "app",
+	} {
+		if actual := tenantLoginIPChannel(platform); actual != expected {
+			t.Fatalf("platform %q: got %q, want %q", platform, actual, expected)
+		}
+	}
+}
+
+func TestCheckTenantLoginIPWhitelist(t *testing.T) {
+	resetTenantLoginIPWhitelistTestState(t)
+	tenantID := types.TenantID(1)
+	loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{config: &tenantLoginIPWhitelistConfig{
+		TenantID: tenantID,
+		AppList:  []string{"203.0.113.10", "2001:db8::/32"},
+		WebList:  []string{"198.51.100.0/24"},
+	}}
+
+	if err := checkTenantLoginIPWhitelist(tenantID, "ios", "203.0.113.10:443"); err != nil {
+		t.Fatalf("APP白名单地址应允许登录: %v", err)
+	}
+	if err := checkTenantLoginIPWhitelist(tenantID, "web", "198.51.100.8:443"); err != nil {
+		t.Fatalf("Web白名单网段应允许登录: %v", err)
+	}
+	if err := checkTenantLoginIPWhitelist(tenantID, "web", "203.0.113.10:443"); !errors.Is(err, types.ErrPermissionDenied) {
+		t.Fatalf("APP地址不应绕过Web白名单: %v", err)
+	}
+}
+
+func TestCheckTenantLoginIPWhitelistEmptyMeansUnrestricted(t *testing.T) {
+	resetTenantLoginIPWhitelistTestState(t)
+	tenantID := types.TenantID(1)
+	loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{config: &tenantLoginIPWhitelistConfig{TenantID: tenantID}}
+	if err := checkTenantLoginIPWhitelist(tenantID, "web", "192.0.2.8:443"); err != nil {
+		t.Fatalf("未配置渠道白名单时不应限制登录: %v", err)
+	}
+}