Ilia Denisov
041106d623
CI / changes (pull_request) Successful in 3s
CI / unit (pull_request) Successful in 11s
CI / integration (pull_request) Successful in 17s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m11s
Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.
The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.
Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.
PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.
65 lines
2.0 KiB
Go
65 lines
2.0 KiB
Go
package banview
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func viewAt(clk *time.Time) *View {
|
|
v := New()
|
|
v.now = func() time.Time { return *clk }
|
|
return v
|
|
}
|
|
|
|
func TestIngestRecentDropsExpired(t *testing.T) {
|
|
clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
|
|
v := viewAt(&clk)
|
|
v.Ingest([]Ban{
|
|
{IP: "1.1.1.1", Reason: "tripwire", Since: clk, Expires: clk.Add(time.Hour)},
|
|
{IP: "2.2.2.2", Reason: "rejections", Since: clk.Add(-2 * time.Hour), Expires: clk.Add(-time.Hour)}, // expired
|
|
{IP: "", Reason: "x", Since: clk, Expires: clk.Add(time.Hour)}, // empty IP
|
|
})
|
|
got := v.Recent()
|
|
if len(got) != 1 || got[0].IP != "1.1.1.1" || got[0].Reason != "tripwire" {
|
|
t.Fatalf("Recent = %+v, want one live ban for 1.1.1.1", got)
|
|
}
|
|
}
|
|
|
|
func TestIngestReplaces(t *testing.T) {
|
|
clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
|
|
v := viewAt(&clk)
|
|
v.Ingest([]Ban{{IP: "1.1.1.1", Since: clk, Expires: clk.Add(time.Hour)}})
|
|
v.Ingest([]Ban{{IP: "2.2.2.2", Since: clk, Expires: clk.Add(time.Hour)}})
|
|
got := v.Recent()
|
|
if len(got) != 1 || got[0].IP != "2.2.2.2" {
|
|
t.Fatalf("Recent = %+v, want only the latest report (2.2.2.2)", got)
|
|
}
|
|
}
|
|
|
|
func TestRecentOrdersBySince(t *testing.T) {
|
|
clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
|
|
v := viewAt(&clk)
|
|
v.Ingest([]Ban{
|
|
{IP: "old", Since: clk.Add(-10 * time.Minute), Expires: clk.Add(time.Hour)},
|
|
{IP: "new", Since: clk.Add(-1 * time.Minute), Expires: clk.Add(time.Hour)},
|
|
})
|
|
got := v.Recent()
|
|
if len(got) != 2 || got[0].IP != "new" || got[1].IP != "old" {
|
|
t.Fatalf("Recent order = %+v, want most recent first", got)
|
|
}
|
|
}
|
|
|
|
func TestUnbanRoundTrip(t *testing.T) {
|
|
clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
|
|
v := viewAt(&clk)
|
|
v.RequestUnban("3.3.3.3")
|
|
v.RequestUnban("") // ignored
|
|
drained := v.DrainUnbans()
|
|
if len(drained) != 1 || drained[0] != "3.3.3.3" {
|
|
t.Fatalf("DrainUnbans = %v, want [3.3.3.3]", drained)
|
|
}
|
|
if again := v.DrainUnbans(); again != nil {
|
|
t.Fatalf("second DrainUnbans = %v, want nil (cleared)", again)
|
|
}
|
|
}
|