84 lines
3.0 KiB
Go
84 lines
3.0 KiB
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/tinode/chat/server/store/types"
|
|
)
|
|
|
|
type staticTenantLoginIPWhitelistProvider struct {
|
|
config *tenantLoginIPWhitelistConfig
|
|
err error
|
|
}
|
|
|
|
func (p staticTenantLoginIPWhitelistProvider) TenantLoginIPWhitelist(types.TenantID) (*tenantLoginIPWhitelistConfig, error) {
|
|
return p.config, p.err
|
|
}
|
|
|
|
func resetTenantLoginIPWhitelistTestState(t *testing.T) {
|
|
t.Helper()
|
|
previousProvider := loginIPWhitelistProvider
|
|
tenantLoginIPWhitelistCache.Lock()
|
|
previousCache := tenantLoginIPWhitelistCache.items
|
|
tenantLoginIPWhitelistCache.items = make(map[types.TenantID]tenantLoginIPWhitelistCacheEntry)
|
|
tenantLoginIPWhitelistCache.Unlock()
|
|
t.Cleanup(func() {
|
|
loginIPWhitelistProvider = previousProvider
|
|
tenantLoginIPWhitelistCache.Lock()
|
|
tenantLoginIPWhitelistCache.items = previousCache
|
|
tenantLoginIPWhitelistCache.Unlock()
|
|
})
|
|
}
|
|
|
|
func TestTenantLoginIPChannel(t *testing.T) {
|
|
for platform, expected := range map[string]string{
|
|
"web": "web", "WEB": "web", "ios": "app", "android": "app", "": "app",
|
|
} {
|
|
if actual := tenantLoginIPChannel(platform); actual != expected {
|
|
t.Fatalf("platform %q: got %q, want %q", platform, actual, expected)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCheckTenantLoginIPWhitelist(t *testing.T) {
|
|
resetTenantLoginIPWhitelistTestState(t)
|
|
tenantID := types.TenantID(1)
|
|
loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{config: &tenantLoginIPWhitelistConfig{
|
|
TenantID: tenantID,
|
|
AppList: []string{"203.0.113.10", "2001:db8::/32"},
|
|
WebList: []string{"198.51.100.0/24"},
|
|
}}
|
|
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "ios", "203.0.113.10:443"); err != nil {
|
|
t.Fatalf("APP白名单地址应允许登录: %v", err)
|
|
}
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "web", "198.51.100.8:443"); err != nil {
|
|
t.Fatalf("Web白名单网段应允许登录: %v", err)
|
|
}
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "web", "203.0.113.10:443"); !errors.Is(err, types.ErrPermissionDenied) {
|
|
t.Fatalf("APP地址不应绕过Web白名单: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestCheckTenantLoginIPWhitelistEmptyMeansUnrestricted(t *testing.T) {
|
|
resetTenantLoginIPWhitelistTestState(t)
|
|
tenantID := types.TenantID(1)
|
|
loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{config: &tenantLoginIPWhitelistConfig{TenantID: tenantID}}
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "web", "192.0.2.8:443"); err != nil {
|
|
t.Fatalf("未配置渠道白名单时不应限制登录: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestCheckTenantLoginIPWhitelistProviderFailureAllowsLogin(t *testing.T) {
|
|
resetTenantLoginIPWhitelistTestState(t)
|
|
tenantID := types.TenantID(1)
|
|
loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{err: errors.New("admin timeout")}
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "ios", "203.0.113.10:443"); err != nil {
|
|
t.Fatalf("白名单配置服务失败时不应阻断登录: %v", err)
|
|
}
|
|
if err := checkTenantLoginIPWhitelist(tenantID, "web", "198.51.100.8:443"); err != nil {
|
|
t.Fatalf("白名单失败空配置应被短暂缓存并继续放行: %v", err)
|
|
}
|
|
}
|