49 lines
2.1 KiB
TypeScript
49 lines
2.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { checkRateLimit, clientKeyFromHeaders, MAX_IN_FLIGHT_INSPECTIONS, RATE_LIMIT_MAX_REQUESTS, RATE_LIMIT_WINDOW_MS, tryAcquireInspection } from "./admission";
|
|
|
|
describe("inspection admission", () => {
|
|
it("rejects work beyond the bounded in-flight budget", () => {
|
|
const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());
|
|
|
|
expect(releases.every(Boolean)).toBe(true);
|
|
expect(tryAcquireInspection()).toBeNull();
|
|
|
|
releases.forEach((release) => release?.());
|
|
const release = tryAcquireInspection();
|
|
expect(release).not.toBeNull();
|
|
release?.();
|
|
});
|
|
|
|
it("releases capacity at most once", () => {
|
|
const release = tryAcquireInspection();
|
|
expect(release).not.toBeNull();
|
|
release?.();
|
|
release?.();
|
|
|
|
const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());
|
|
expect(releases.every(Boolean)).toBe(true);
|
|
releases.forEach((item) => item?.());
|
|
});
|
|
|
|
it("applies a bounded per-client sliding-window limit", () => {
|
|
const key = "test-client-" + Math.random();
|
|
const now = 1_000_000;
|
|
for (let index = 0; index < RATE_LIMIT_MAX_REQUESTS; index += 1) {
|
|
expect(checkRateLimit(key, now + index)).toMatchObject({ allowed: true });
|
|
}
|
|
expect(checkRateLimit(key, now + RATE_LIMIT_MAX_REQUESTS)).toMatchObject({ allowed: false });
|
|
expect(checkRateLimit(key, now + RATE_LIMIT_WINDOW_MS + 1)).toMatchObject({ allowed: true });
|
|
});
|
|
|
|
it("does not trust forwarded client identity unless proxy trust is enabled", () => {
|
|
const headers = { get: (name: string) => name === "x-forwarded-for" ? "198.51.100.10, 10.0.0.1" : null };
|
|
const previous = process.env.CERTSCOPE_TRUST_PROXY;
|
|
delete process.env.CERTSCOPE_TRUST_PROXY;
|
|
expect(clientKeyFromHeaders(headers)).toBe("direct");
|
|
process.env.CERTSCOPE_TRUST_PROXY = "true";
|
|
expect(clientKeyFromHeaders(headers)).toBe("proxy:198.51.100.10");
|
|
if (previous === undefined) delete process.env.CERTSCOPE_TRUST_PROXY;
|
|
else process.env.CERTSCOPE_TRUST_PROXY = previous;
|
|
});
|
|
});
|