Ilia Denisov
041106d623
CI / changes (pull_request) Successful in 3s
CI / unit (pull_request) Successful in 11s
CI / integration (pull_request) Successful in 17s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m11s
Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.
The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.
Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.
PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.
98 lines
2.9 KiB
Go
98 lines
2.9 KiB
Go
package config
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
pkgtel "scrabble/pkg/telemetry"
|
|
)
|
|
|
|
// TestLoadTelemetryDefaults verifies the gateway telemetry defaults: the
|
|
// "scrabble-gateway" service name and both exporters off.
|
|
func TestLoadTelemetryDefaults(t *testing.T) {
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("Load: %v", err)
|
|
}
|
|
if c.Telemetry.ServiceName != defaultServiceName {
|
|
t.Errorf("Telemetry.ServiceName = %q, want %q", c.Telemetry.ServiceName, defaultServiceName)
|
|
}
|
|
if c.Telemetry.TracesExporter != pkgtel.ExporterNone || c.Telemetry.MetricsExporter != pkgtel.ExporterNone {
|
|
t.Errorf("exporters = %q/%q, want none/none", c.Telemetry.TracesExporter, c.Telemetry.MetricsExporter)
|
|
}
|
|
}
|
|
|
|
// TestLoadRejectsUnsupportedExporter verifies an exporter outside the supported
|
|
// set fails validation.
|
|
func TestLoadRejectsUnsupportedExporter(t *testing.T) {
|
|
t.Setenv("GATEWAY_OTEL_METRICS_EXPORTER", "prometheus")
|
|
if _, err := Load(); err == nil {
|
|
t.Fatal("Load: expected an error for an unsupported exporter, got nil")
|
|
}
|
|
}
|
|
|
|
// TestLoadMaxBodyBytes verifies the body-cap default and that a non-positive
|
|
// override fails validation.
|
|
func TestLoadMaxBodyBytes(t *testing.T) {
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("Load: %v", err)
|
|
}
|
|
if c.MaxBodyBytes != DefaultMaxBodyBytes {
|
|
t.Errorf("MaxBodyBytes = %d, want %d", c.MaxBodyBytes, DefaultMaxBodyBytes)
|
|
}
|
|
t.Setenv("GATEWAY_MAX_BODY_BYTES", "0")
|
|
if _, err := Load(); err == nil {
|
|
t.Fatal("Load: expected an error for a non-positive body cap, got nil")
|
|
}
|
|
}
|
|
|
|
// TestLoadAbuseDefaults verifies the anti-abuse ban defaults: disabled (prod-only),
|
|
// the agreed thresholds, and no honeytoken.
|
|
func TestLoadAbuseDefaults(t *testing.T) {
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("Load: %v", err)
|
|
}
|
|
want := DefaultAbuse()
|
|
if c.Abuse != want {
|
|
t.Errorf("Abuse = %+v, want %+v", c.Abuse, want)
|
|
}
|
|
if c.Abuse.BanEnabled {
|
|
t.Error("ban must default to disabled (enabled only in prod)")
|
|
}
|
|
}
|
|
|
|
// TestLoadAbuseOverrides verifies the anti-abuse environment variables are parsed.
|
|
func TestLoadAbuseOverrides(t *testing.T) {
|
|
t.Setenv("GATEWAY_ABUSE_BAN_ENABLED", "true")
|
|
t.Setenv("GATEWAY_ABUSE_BAN_THRESHOLD", "50")
|
|
t.Setenv("GATEWAY_ABUSE_BAN_WINDOW", "90s")
|
|
t.Setenv("GATEWAY_ABUSE_BAN_DURATION", "30m")
|
|
t.Setenv("GATEWAY_HONEYTOKEN", "deadbeef")
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("Load: %v", err)
|
|
}
|
|
want := AbuseConfig{
|
|
BanEnabled: true,
|
|
BanThreshold: 50,
|
|
BanWindow: 90 * time.Second,
|
|
BanDuration: 30 * time.Minute,
|
|
Honeytoken: "deadbeef",
|
|
}
|
|
if c.Abuse != want {
|
|
t.Errorf("Abuse = %+v, want %+v", c.Abuse, want)
|
|
}
|
|
}
|
|
|
|
// TestLoadAbuseRejectsBadThreshold verifies an enabled ban with a non-positive
|
|
// threshold fails validation.
|
|
func TestLoadAbuseRejectsBadThreshold(t *testing.T) {
|
|
t.Setenv("GATEWAY_ABUSE_BAN_ENABLED", "true")
|
|
t.Setenv("GATEWAY_ABUSE_BAN_THRESHOLD", "0")
|
|
if _, err := Load(); err == nil {
|
|
t.Fatal("Load: expected an error for an enabled ban with a zero threshold, got nil")
|
|
}
|
|
}
|