admin site version 2

test/admin.test.js

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { after, before, test } from 'node:test';
 import sharp from 'sharp';
 import YAML from 'yaml';
-import { isPrivateAddress } from '../src/admin/auth.js';
+import { clientKey } from '../src/admin/auth.js';
 import { createAdminApp } from '../src/app.js';
 import { loadConfig } from '../src/config.js';
 import { createContentStore } from '../src/content.js';
@@ -229,19 +229,32 @@ test('journey, profile and homelab', async () => {
   assert.equal(publicStore.get().pages.homelab.de.lead, 'Was läuft');
 });
 
-test('home network check', () => {
-  for (const ip of ['127.0.0.1', '::1', '192.168.178.20', '10.0.0.5', '172.18.0.1', '::ffff:192.168.178.20', 'fd00::1', 'fe80::1']) {
-    assert.ok(isPrivateAddress(ip), ip);
-  }
-  for (const ip of ['79.221.147.164', '172.32.0.1', '2003:f6:8f30:d900::1', '8.8.8.8']) {
-    assert.ok(!isPrivateAddress(ip), ip);
-  }
+test('clients are counted by address, IPv6 by /64', () => {
+  assert.equal(clientKey('79.221.147.164'), '79.221.147.164');
+  assert.equal(clientKey('::ffff:192.168.178.20'), '192.168.178.20');
+  assert.equal(clientKey('2003:f6:8f30:d900::1'), '2003:f6:8f30:d900::/64');
+  assert.equal(clientKey('2003:00f6:8f30:d900:1234:5678:9abc:def0'), '2003:f6:8f30:d900::/64');
+  assert.equal(clientKey('2001:db8::1'), '2001:db8:0:0::/64');
+  assert.equal(clientKey('::1'), '0:0:0:0::/64');
 });
 
-test('too many wrong passwords lock the login', async () => {
+test('too many wrong passwords lock the login, per client behind the proxy', async () => {
+  const login = (ip, password) =>
+    request('/admin/login', {
+      method: 'POST',
+      headers: { 'x-forwarded-for': ip, 'x-forwarded-proto': 'https' },
+      body: new URLSearchParams({ password }),
+    });
+
   let res;
-  for (let i = 0; i < 11; i++) {
-    res = await request('/admin/login', { method: 'POST', body: new URLSearchParams({ password: `wrong ${i}` }) });
-  }
+  for (let i = 0; i < 11; i++) res = await login('203.0.113.7', `wrong ${i}`);
   assert.equal(res.status, 429);
+  assert.equal((await login('203.0.113.7', 'correct horse')).status, 429, 'even with the right password');
+  res = await login('198.51.100.1', 'correct horse');
+  assert.equal(res.status, 303, 'other visitors can still log in');
+  assert.match(res.headers.get('set-cookie'), /Secure/i, 'over https the cookie is secure');
+
+  for (let i = 0; i < 10; i++) await login(`2001:db8:1:2::${i + 1}`, 'nope');
+  assert.equal((await login('2001:db8:1:2::ff', 'nope')).status, 429, 'a new address in the same /64 does not help');
+  assert.equal((await login('2001:db8:1:3::1', 'nope')).status, 401);
 });