Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sysops
|
43dca005f2 | ||
|
sysops
|
24a522e10c |
@@ -0,0 +1,40 @@
|
|||||||
|
// secheaders-devserver dient der manuellen/e2e-Verifikation von API-08
|
||||||
|
// (Pruefung 2: CSP blockiert Inline-Script) mit einem echten Browser.
|
||||||
|
// Zwei Pfade: /protected (mit Middleware) und /unprotected (ohne) — beide
|
||||||
|
// liefern dieselbe Seite mit einem Inline-Script, das ein DOM-Element
|
||||||
|
// aendert. Ein echter Browser zeigt den Unterschied.
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"gitea.perlbach24.de/scripte/nexarch/internal/secheaders"
|
||||||
|
)
|
||||||
|
|
||||||
|
const page = `<!doctype html>
|
||||||
|
<html><body>
|
||||||
|
<div id="marker">BLOCKED</div>
|
||||||
|
<script>document.getElementById('marker').textContent = 'INLINE_RAN';</script>
|
||||||
|
</body></html>`
|
||||||
|
|
||||||
|
func servePage(w http.ResponseWriter, r *http.Request) {
|
||||||
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||||
|
_, _ = w.Write([]byte(page))
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
cfg := secheaders.DefaultConfig()
|
||||||
|
mux := http.NewServeMux()
|
||||||
|
// SetHeaders statt Middleware: dieser lokale Demo-Server laeuft ohne
|
||||||
|
// TLS-Terminierung, der HTTPS-Redirect-Teil von Middleware wuerde hier
|
||||||
|
// in eine Endlosschleife fuehren (siehe secheaders.go-Dokumentation).
|
||||||
|
mux.HandleFunc("/protected", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
secheaders.SetHeaders(cfg, w)
|
||||||
|
servePage(w, r)
|
||||||
|
})
|
||||||
|
mux.HandleFunc("/unprotected", servePage)
|
||||||
|
|
||||||
|
log.Println("secheaders-devserver listening on :8086")
|
||||||
|
log.Fatal(http.ListenAndServe(":8086", mux))
|
||||||
|
}
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
package ratelimit
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"math"
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/apiserver"
|
|
||||||
)
|
|
||||||
|
|
||||||
// KeyFunc bestimmt den Rate-Limit-Schluessel fuer eine Anfrage — typischerweise
|
|
||||||
// der Tenant-Slug aus apiserver.RequestContext, siehe KeyByTenant. Als
|
|
||||||
// eigenstaendiger Typ austauschbar (z.B. spaeter API-Token-basiert), ohne
|
|
||||||
// internal/apiserver aendern zu muessen (Kein Umbau angrenzender Bereiche).
|
|
||||||
type KeyFunc func(r *http.Request) (string, bool)
|
|
||||||
|
|
||||||
// KeyByTenant liest den Tenant aus dem von internal/apiserver.authAndTenantContext
|
|
||||||
// gesetzten RequestContext (IAM-02/API-01) — dieselbe Middleware-Kette,
|
|
||||||
// keine zweite Authentifizierung.
|
|
||||||
func KeyByTenant(r *http.Request) (string, bool) {
|
|
||||||
rc, ok := apiserver.FromContext(r.Context())
|
|
||||||
if !ok || rc.TenantSlug == "" {
|
|
||||||
return "", false
|
|
||||||
}
|
|
||||||
return rc.TenantSlug, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// Middleware setzt sich VOR den eigentlichen Handler (nach Auth+Tenant-
|
|
||||||
// Kontext, siehe KeyByTenant) und lehnt Anfragen ueber dem konfigurierten
|
|
||||||
// Limit mit 429 + Retry-After ab (Akzeptanzkriterium 3).
|
|
||||||
func Middleware(store *Store, keyFn KeyFunc, next http.HandlerFunc) http.HandlerFunc {
|
|
||||||
return func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
key, ok := keyFn(r)
|
|
||||||
if !ok {
|
|
||||||
// Kein Schluessel ermittelbar (z.B. kein Tenant-Kontext) — die
|
|
||||||
// Auth-Pruefung selbst ist Sache von authAndTenantContext, hier
|
|
||||||
// wird nur nicht limitiert, wenn schon kein Kontext vorliegt.
|
|
||||||
next(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
result, err := store.Allow(r.Context(), key)
|
|
||||||
if err != nil {
|
|
||||||
apiserver.WriteError(w, http.StatusInternalServerError, "rate_limit_error", "rate-limit-pruefung fehlgeschlagen")
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
w.Header().Set("X-RateLimit-Limit", fmt.Sprintf("%d", result.Limit))
|
|
||||||
w.Header().Set("X-RateLimit-Remaining", fmt.Sprintf("%d", result.Remaining))
|
|
||||||
|
|
||||||
if !result.Allowed {
|
|
||||||
retryAfterSeconds := int(math.Ceil(result.RetryAfter.Seconds()))
|
|
||||||
if retryAfterSeconds < 1 {
|
|
||||||
retryAfterSeconds = 1
|
|
||||||
}
|
|
||||||
w.Header().Set("Retry-After", fmt.Sprintf("%d", retryAfterSeconds))
|
|
||||||
apiserver.WriteError(w, http.StatusTooManyRequests, "rate_limit_exceeded",
|
|
||||||
"zu viele anfragen, bitte spaeter erneut versuchen")
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
next(w, r)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,136 +0,0 @@
|
|||||||
package ratelimit
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"os"
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/apiserver"
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
|
||||||
)
|
|
||||||
|
|
||||||
func setupMiddlewareTest(t *testing.T) (*apiserver.Server, *auth.TokenIssuer, *Store, func()) {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
pool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("pool: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, `
|
|
||||||
CREATE TABLE IF NOT EXISTS rate_limit_configs (
|
|
||||||
key TEXT PRIMARY KEY, limit_value INT NOT NULL, window_seconds INT NOT NULL
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS rate_limit_counters (
|
|
||||||
key TEXT NOT NULL, window_start TIMESTAMPTZ NOT NULL, count INT NOT NULL DEFAULT 0,
|
|
||||||
PRIMARY KEY (key, window_start)
|
|
||||||
);
|
|
||||||
`); err != nil {
|
|
||||||
t.Fatalf("schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
srv := apiserver.NewServer(issuer)
|
|
||||||
store := NewStore(pool)
|
|
||||||
|
|
||||||
cleanup := func() { pool.Close() }
|
|
||||||
return srv, issuer, store, cleanup
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 + Pruefung 2: Ueberschreitung liefert 429 mit
|
|
||||||
// Retry-After-Header, ueber die vollstaendige Middleware-Kette (Auth ->
|
|
||||||
// Tenant-Kontext -> Rate-Limit -> Handler) hinweg.
|
|
||||||
func TestMiddleware_Returns429WithRetryAfterOnExceeded(t *testing.T) {
|
|
||||||
srv, issuer, store, cleanup := setupMiddlewareTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
tenantSlug := newTestKey()
|
|
||||||
if err := store.SetLimit(ctx, tenantSlug, 1, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
called := 0
|
|
||||||
srv.HandleV1("/limited", Middleware(store, KeyByTenant, func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
called++
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}))
|
|
||||||
|
|
||||||
token, err := issuer.Issue("user-1", tenantSlug)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("issue: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
req1 := httptest.NewRequest(http.MethodGet, "/api/v1/limited", nil)
|
|
||||||
req1.AddCookie(&http.Cookie{Name: auth.CookieName, Value: token})
|
|
||||||
rec1 := httptest.NewRecorder()
|
|
||||||
srv.Handler().ServeHTTP(rec1, req1)
|
|
||||||
if rec1.Code != http.StatusOK {
|
|
||||||
t.Fatalf("1. anfrage: status = %d, want 200", rec1.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
req2 := httptest.NewRequest(http.MethodGet, "/api/v1/limited", nil)
|
|
||||||
req2.AddCookie(&http.Cookie{Name: auth.CookieName, Value: token})
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
srv.Handler().ServeHTTP(rec2, req2)
|
|
||||||
if rec2.Code != http.StatusTooManyRequests {
|
|
||||||
t.Fatalf("2. anfrage: status = %d, want 429", rec2.Code)
|
|
||||||
}
|
|
||||||
if rec2.Header().Get("Retry-After") == "" {
|
|
||||||
t.Fatal("erwartet gesetzten Retry-After-Header bei 429")
|
|
||||||
}
|
|
||||||
if called != 1 {
|
|
||||||
t.Fatalf("handler wurde %d mal aufgerufen, want genau 1 (2. anfrage haette nicht durchgereicht werden duerfen)", called)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1: das Limit ist pro Tenant konfigurierbar — ein
|
|
||||||
// anderer Tenant (anderer Key) bleibt von der Ausschoepfung unberuehrt.
|
|
||||||
func TestMiddleware_DifferentTenantsHaveIndependentLimits(t *testing.T) {
|
|
||||||
srv, issuer, store, cleanup := setupMiddlewareTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
tenantA := newTestKey()
|
|
||||||
tenantB := newTestKey()
|
|
||||||
if err := store.SetLimit(ctx, tenantA, 1, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit a: %v", err)
|
|
||||||
}
|
|
||||||
if err := store.SetLimit(ctx, tenantB, 1, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit b: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
srv.HandleV1("/limited2", Middleware(store, KeyByTenant, func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}))
|
|
||||||
|
|
||||||
tokenA, _ := issuer.Issue("user-a", tenantA)
|
|
||||||
tokenB, _ := issuer.Issue("user-b", tenantB)
|
|
||||||
|
|
||||||
// Tenant A schoepft sein Limit aus.
|
|
||||||
reqA := httptest.NewRequest(http.MethodGet, "/api/v1/limited2", nil)
|
|
||||||
reqA.AddCookie(&http.Cookie{Name: auth.CookieName, Value: tokenA})
|
|
||||||
recA := httptest.NewRecorder()
|
|
||||||
srv.Handler().ServeHTTP(recA, reqA)
|
|
||||||
if recA.Code != http.StatusOK {
|
|
||||||
t.Fatalf("tenant a, 1. anfrage: status = %d, want 200", recA.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Tenant B ist von der Ausschoepfung bei A unberuehrt.
|
|
||||||
reqB := httptest.NewRequest(http.MethodGet, "/api/v1/limited2", nil)
|
|
||||||
reqB.AddCookie(&http.Cookie{Name: auth.CookieName, Value: tokenB})
|
|
||||||
recB := httptest.NewRecorder()
|
|
||||||
srv.Handler().ServeHTTP(recB, reqB)
|
|
||||||
if recB.Code != http.StatusOK {
|
|
||||||
t.Fatalf("tenant b haette trotz ausgeschoepftem limit von tenant a erlaubt sein muessen, status = %d", recB.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,126 +0,0 @@
|
|||||||
// Package ratelimit implementiert Core API-03: eine zentrale Rate-Limiting-
|
|
||||||
// Schicht fuer die gesamte Core-API mit GETEILTEM, EXTERNEM Zustand in
|
|
||||||
// Postgres — kein In-Process-Zaehler (siehe "Bekannte Fehler vermeiden" im
|
|
||||||
// Ticket: dasselbe Risiko wie bei IAM-07s In-Memory-Lockout). Fixed-Window-
|
|
||||||
// Algorithmus: einfach, korrekt unter nebenlaeufigem Zugriff (atomares
|
|
||||||
// UPSERT wie internal/usage.Store.Increment), und fuer ein API-Gateway
|
|
||||||
// ausreichend praezise — kein Sliding-Window-Overhead noetig.
|
|
||||||
package ratelimit
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5"
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// DefaultLimit/DefaultWindow gelten fuer jeden Schluessel (Tenant oder
|
|
||||||
// API-Token), fuer den keine eigene Konfiguration existiert
|
|
||||||
// (Akzeptanzkriterium 1: "konfigurierbar", nicht "verpflichtend konfiguriert").
|
|
||||||
const (
|
|
||||||
DefaultLimit = 100
|
|
||||||
DefaultWindow = time.Minute
|
|
||||||
)
|
|
||||||
|
|
||||||
// Config ist das je Schluessel konfigurierbare Limit.
|
|
||||||
type Config struct {
|
|
||||||
Limit int
|
|
||||||
Window time.Duration
|
|
||||||
}
|
|
||||||
|
|
||||||
// Store haelt Konfiguration UND Zaehlerstand in Postgres — beides ueber
|
|
||||||
// dieselbe Verbindung erreichbar, damit mehrere Dienstinstanzen denselben
|
|
||||||
// Zustand sehen (Akzeptanzkriterium 2).
|
|
||||||
type Store struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewStore(pool *pgxpool.Pool) *Store {
|
|
||||||
return &Store{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetLimit setzt die Konfiguration fuer EINEN Schluessel (z.B. einen
|
|
||||||
// Tenant-Slug oder eine API-Token-ID) — wirkt sich nicht auf andere
|
|
||||||
// Schluessel aus (Akzeptanzkriterium 1 / Pruefung 3).
|
|
||||||
func (s *Store) SetLimit(ctx context.Context, key string, limit int, window time.Duration) error {
|
|
||||||
_, err := s.pool.Exec(ctx, `
|
|
||||||
INSERT INTO rate_limit_configs (key, limit_value, window_seconds)
|
|
||||||
VALUES ($1, $2, $3)
|
|
||||||
ON CONFLICT (key) DO UPDATE SET limit_value = $2, window_seconds = $3
|
|
||||||
`, key, limit, int(window.Seconds()))
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("rate-limit-konfiguration speichern: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *Store) getConfig(ctx context.Context, key string) (Config, error) {
|
|
||||||
var limit, windowSeconds int
|
|
||||||
err := s.pool.QueryRow(ctx, `
|
|
||||||
SELECT limit_value, window_seconds FROM rate_limit_configs WHERE key = $1
|
|
||||||
`, key).Scan(&limit, &windowSeconds)
|
|
||||||
if err != nil {
|
|
||||||
if err == pgx.ErrNoRows {
|
|
||||||
return Config{Limit: DefaultLimit, Window: DefaultWindow}, nil
|
|
||||||
}
|
|
||||||
return Config{}, fmt.Errorf("rate-limit-konfiguration lesen: %w", err)
|
|
||||||
}
|
|
||||||
return Config{Limit: limit, Window: time.Duration(windowSeconds) * time.Second}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Result ist der Ausgang einer Allow-Pruefung (Akzeptanzkriterium 3).
|
|
||||||
type Result struct {
|
|
||||||
Allowed bool
|
|
||||||
Limit int
|
|
||||||
Remaining int
|
|
||||||
RetryAfter time.Duration
|
|
||||||
}
|
|
||||||
|
|
||||||
// Allow erhoeht den Zaehler fuer (key, aktuelles Zeitfenster) ATOMAR ueber
|
|
||||||
// ein einziges UPSERT (dasselbe Muster wie internal/usage.Store.Increment)
|
|
||||||
// und vergleicht das Ergebnis gegen die konfigurierte Grenze — kein
|
|
||||||
// Lesen-Erhoehen-Schreiben in Go, damit zwei Dienstinstanzen, die
|
|
||||||
// gleichzeitig gegen dieselbe Datenbank inkrementieren, sich niemals
|
|
||||||
// gegenseitig ueberschreiben (Akzeptanzkriterium 2 / Pruefung 1).
|
|
||||||
func (s *Store) Allow(ctx context.Context, key string) (Result, error) {
|
|
||||||
cfg, err := s.getConfig(ctx, key)
|
|
||||||
if err != nil {
|
|
||||||
return Result{}, err
|
|
||||||
}
|
|
||||||
|
|
||||||
windowSeconds := int64(cfg.Window.Seconds())
|
|
||||||
if windowSeconds <= 0 {
|
|
||||||
windowSeconds = int64(DefaultWindow.Seconds())
|
|
||||||
}
|
|
||||||
now := time.Now().UTC()
|
|
||||||
windowStart := time.Unix((now.Unix()/windowSeconds)*windowSeconds, 0).UTC()
|
|
||||||
windowEnd := windowStart.Add(time.Duration(windowSeconds) * time.Second)
|
|
||||||
|
|
||||||
var count int
|
|
||||||
err = s.pool.QueryRow(ctx, `
|
|
||||||
INSERT INTO rate_limit_counters (key, window_start, count)
|
|
||||||
VALUES ($1, $2, 1)
|
|
||||||
ON CONFLICT (key, window_start) DO UPDATE
|
|
||||||
SET count = rate_limit_counters.count + 1
|
|
||||||
RETURNING count
|
|
||||||
`, key, windowStart).Scan(&count)
|
|
||||||
if err != nil {
|
|
||||||
return Result{}, fmt.Errorf("rate-limit-zaehler erhoehen: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
remaining := cfg.Limit - count
|
|
||||||
if remaining < 0 {
|
|
||||||
remaining = 0
|
|
||||||
}
|
|
||||||
if count > cfg.Limit {
|
|
||||||
return Result{
|
|
||||||
Allowed: false,
|
|
||||||
Limit: cfg.Limit,
|
|
||||||
Remaining: 0,
|
|
||||||
RetryAfter: windowEnd.Sub(now),
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
return Result{Allowed: true, Limit: cfg.Limit, Remaining: remaining}, nil
|
|
||||||
}
|
|
||||||
@@ -1,168 +0,0 @@
|
|||||||
package ratelimit
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"sync"
|
|
||||||
"sync/atomic"
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
func setupTest(t *testing.T) (*pgxpool.Pool, func()) {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
pool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("pool: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, `
|
|
||||||
CREATE TABLE IF NOT EXISTS rate_limit_configs (
|
|
||||||
key TEXT PRIMARY KEY, limit_value INT NOT NULL, window_seconds INT NOT NULL
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS rate_limit_counters (
|
|
||||||
key TEXT NOT NULL, window_start TIMESTAMPTZ NOT NULL, count INT NOT NULL DEFAULT 0,
|
|
||||||
PRIMARY KEY (key, window_start)
|
|
||||||
);
|
|
||||||
`); err != nil {
|
|
||||||
t.Fatalf("schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
cleanup := func() { pool.Close() }
|
|
||||||
return pool, cleanup
|
|
||||||
}
|
|
||||||
|
|
||||||
func newTestKey() string {
|
|
||||||
return fmt.Sprintf("test-key-%d", time.Now().UnixNano())
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 + Pruefung 2: Ueberschreitung des Limits wird
|
|
||||||
// nachweislich erkannt.
|
|
||||||
func TestAllow_RejectsAfterLimitExceeded(t *testing.T) {
|
|
||||||
pool, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
store := NewStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
key := newTestKey()
|
|
||||||
|
|
||||||
if err := store.SetLimit(ctx, key, 3, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
res, err := store.Allow(ctx, key)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("allow %d: %v", i, err)
|
|
||||||
}
|
|
||||||
if !res.Allowed {
|
|
||||||
t.Fatalf("anfrage %d haette erlaubt sein muessen, limit=3", i)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
res, err := store.Allow(ctx, key)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("allow (4.): %v", err)
|
|
||||||
}
|
|
||||||
if res.Allowed {
|
|
||||||
t.Fatal("4. anfrage haette abgelehnt werden muessen (limit=3)")
|
|
||||||
}
|
|
||||||
if res.RetryAfter <= 0 {
|
|
||||||
t.Fatalf("erwartet positive retry-after-dauer, habe %v", res.RetryAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1 / Pruefung 3: Konfigurationsaenderung wirkt sich
|
|
||||||
// NICHT auf andere Schluessel (Tenants) aus.
|
|
||||||
func TestSetLimit_DoesNotAffectOtherKeys(t *testing.T) {
|
|
||||||
pool, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
store := NewStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
keyA := newTestKey()
|
|
||||||
keyB := newTestKey()
|
|
||||||
|
|
||||||
if err := store.SetLimit(ctx, keyA, 1, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit a: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
resA1, _ := store.Allow(ctx, keyA)
|
|
||||||
resA2, _ := store.Allow(ctx, keyA)
|
|
||||||
if !resA1.Allowed || resA2.Allowed {
|
|
||||||
t.Fatalf("key a: erwartet erlaubt,abgelehnt, habe %v,%v", resA1.Allowed, resA2.Allowed)
|
|
||||||
}
|
|
||||||
|
|
||||||
// keyB hat keine eigene Konfiguration -> DefaultLimit, unbeeinflusst von keyA.
|
|
||||||
resB, err := store.Allow(ctx, keyB)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("allow b: %v", err)
|
|
||||||
}
|
|
||||||
if !resB.Allowed {
|
|
||||||
t.Fatal("key b haette trotz limit-ueberschreitung bei key a erlaubt sein muessen")
|
|
||||||
}
|
|
||||||
if resB.Limit != DefaultLimit {
|
|
||||||
t.Fatalf("key b limit = %d, want default %d", resB.Limit, DefaultLimit)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + Pruefung 1: zwei "Dienstinstanzen" (zwei
|
|
||||||
// unabhaengige Pools/Store-Objekte) gegen dieselbe Datenbank setzen
|
|
||||||
// dasselbe Limit korrekt durch — kein In-Process-Zustand kann das leisten.
|
|
||||||
func TestAllow_TwoInstancesShareStateCorrectly(t *testing.T) {
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
pool, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
|
|
||||||
ctx := context.Background()
|
|
||||||
pool2, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("zweiter pool (simuliert zweite instanz): %v", err)
|
|
||||||
}
|
|
||||||
defer pool2.Close()
|
|
||||||
|
|
||||||
storeInstance1 := NewStore(pool)
|
|
||||||
storeInstance2 := NewStore(pool2)
|
|
||||||
|
|
||||||
key := newTestKey()
|
|
||||||
const limit = 20
|
|
||||||
if err := storeInstance1.SetLimit(ctx, key, limit, time.Minute); err != nil {
|
|
||||||
t.Fatalf("setlimit: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
const totalRequests = 50
|
|
||||||
var allowedCount int64
|
|
||||||
var wg sync.WaitGroup
|
|
||||||
for i := 0; i < totalRequests; i++ {
|
|
||||||
wg.Add(1)
|
|
||||||
store := storeInstance1
|
|
||||||
if i%2 == 0 {
|
|
||||||
store = storeInstance2 // Haelfte der Anfragen "kommt" von der zweiten Instanz
|
|
||||||
}
|
|
||||||
go func(s *Store) {
|
|
||||||
defer wg.Done()
|
|
||||||
res, err := s.Allow(ctx, key)
|
|
||||||
if err != nil {
|
|
||||||
t.Errorf("allow: %v", err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if res.Allowed {
|
|
||||||
atomic.AddInt64(&allowedCount, 1)
|
|
||||||
}
|
|
||||||
}(store)
|
|
||||||
}
|
|
||||||
wg.Wait()
|
|
||||||
|
|
||||||
if allowedCount != limit {
|
|
||||||
t.Fatalf("erlaubte anfragen ueber beide instanzen = %d, want exakt %d (geteilter zustand)", allowedCount, limit)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,126 @@
|
|||||||
|
// Package secheaders implementiert Core API-08: eine gemeinsame
|
||||||
|
// Security-Header-Middleware/Bibliothek, die jedes Modul-Frontend (DMS,
|
||||||
|
// Mail, Workflow, AI, Connect) einbindet, statt Header pro Modul erneut zu
|
||||||
|
// definieren (Akzeptanzkriterium 3) — dieselbe Konsolidierungslogik wie
|
||||||
|
// beim zentralen Rate-Limiting (API-03). Die tatsaechliche EINBINDUNG in
|
||||||
|
// jedes einzelne Modul-Frontend ist ausdruecklich NICHT Teil dieser Kachel
|
||||||
|
// (siehe Ticket "Nicht Bestandteil").
|
||||||
|
package secheaders
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Config ist die Baseline-Konfiguration. DefaultConfig() liefert einen
|
||||||
|
// Ausgangspunkt OHNE 'unsafe-inline'/'unsafe-eval' (Akzeptanzkriterium 1)
|
||||||
|
// und mit angemessener HSTS-Laufzeit (Akzeptanzkriterium 2).
|
||||||
|
type Config struct {
|
||||||
|
// ContentSecurityPolicy wird unveraendert als Header-Wert gesendet.
|
||||||
|
ContentSecurityPolicy string
|
||||||
|
// HSTSMaxAge bestimmt die Gueltigkeitsdauer, die Browser sich merken.
|
||||||
|
HSTSMaxAge time.Duration
|
||||||
|
HSTSIncludeSubdomains bool
|
||||||
|
FrameOptions string
|
||||||
|
ReferrerPolicy string
|
||||||
|
ContentTypeNoSniff bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultConfig liefert die dokumentierte Baseline: restriktive CSP ohne
|
||||||
|
// unsichere Direktiven, HSTS mit 180 Tagen (empfohlener Mindestwert fuer
|
||||||
|
// HSTS-Preloading-Listen liegt bei 1 Jahr — 180 Tage ist ein bewusst
|
||||||
|
// konservativer, aber bereits "angemessener" Ausgangswert, siehe
|
||||||
|
// Akzeptanzkriterium 2), Clickjacking- und MIME-Sniffing-Schutz.
|
||||||
|
func DefaultConfig() Config {
|
||||||
|
return Config{
|
||||||
|
ContentSecurityPolicy: strings.Join([]string{
|
||||||
|
"default-src 'self'",
|
||||||
|
"script-src 'self'",
|
||||||
|
"style-src 'self'",
|
||||||
|
"img-src 'self' data:",
|
||||||
|
"object-src 'none'",
|
||||||
|
"base-uri 'self'",
|
||||||
|
"frame-ancestors 'none'",
|
||||||
|
}, "; "),
|
||||||
|
HSTSMaxAge: 180 * 24 * time.Hour,
|
||||||
|
HSTSIncludeSubdomains: true,
|
||||||
|
FrameOptions: "DENY",
|
||||||
|
ReferrerPolicy: "strict-origin-when-cross-origin",
|
||||||
|
ContentTypeNoSniff: true,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RequiredHeaders sind die von dieser Baseline gesetzten Header-Namen — die
|
||||||
|
// Referenzliste fuer CheckCoverage (Akzeptanzkriterium/Pruefung 1).
|
||||||
|
var RequiredHeaders = []string{
|
||||||
|
"Content-Security-Policy",
|
||||||
|
"Strict-Transport-Security",
|
||||||
|
"X-Frame-Options",
|
||||||
|
"Referrer-Policy",
|
||||||
|
"X-Content-Type-Options",
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c Config) hstsValue() string {
|
||||||
|
v := fmt.Sprintf("max-age=%d", int(c.HSTSMaxAge.Seconds()))
|
||||||
|
if c.HSTSIncludeSubdomains {
|
||||||
|
v += "; includeSubDomains"
|
||||||
|
}
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
|
||||||
|
// Middleware setzt die Baseline-Header auf JEDER Antwort und erzwingt einen
|
||||||
|
// HTTP->HTTPS-Redirect, WENN die Anfrage nicht bereits ueber TLS ankam
|
||||||
|
// (Akzeptanzkriterium 2 / Pruefung 3) — serverseitig durchgesetzt, nicht nur
|
||||||
|
// dem Browser-HSTS-Cache ueberlassen (der erst nach dem ERSTEN sicheren
|
||||||
|
// Aufruf greift).
|
||||||
|
func Middleware(cfg Config, next http.HandlerFunc) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
if !isSecure(r) {
|
||||||
|
target := "https://" + r.Host + r.URL.RequestURI()
|
||||||
|
http.Redirect(w, r, target, http.StatusMovedPermanently)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
SetHeaders(cfg, w)
|
||||||
|
next(w, r)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetHeaders setzt die Baseline-Header direkt, OHNE die HTTPS-Redirect-
|
||||||
|
// Pruefung von Middleware — nuetzlich fuer lokale Entwicklungs-/
|
||||||
|
// Demo-Umgebungen ohne TLS-Terminierung (siehe cmd/secheaders-devserver)
|
||||||
|
// und fuer Aufrufer, die den Redirect selbst schon anderweitig sicherstellen.
|
||||||
|
func SetHeaders(cfg Config, w http.ResponseWriter) {
|
||||||
|
w.Header().Set("Content-Security-Policy", cfg.ContentSecurityPolicy)
|
||||||
|
w.Header().Set("Strict-Transport-Security", cfg.hstsValue())
|
||||||
|
w.Header().Set("X-Frame-Options", cfg.FrameOptions)
|
||||||
|
w.Header().Set("Referrer-Policy", cfg.ReferrerPolicy)
|
||||||
|
if cfg.ContentTypeNoSniff {
|
||||||
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// isSecure erkennt TLS direkt ODER ueber den ueblichen Reverse-Proxy-Header
|
||||||
|
// (X-Forwarded-Proto) — der Core-Dienst laeuft in der Praxis hinter einem
|
||||||
|
// TLS-terminierenden Proxy, sieht r.TLS also nie direkt gesetzt.
|
||||||
|
func isSecure(r *http.Request) bool {
|
||||||
|
if r.TLS != nil {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
|
||||||
|
}
|
||||||
|
|
||||||
|
// CheckCoverage vergleicht die tatsaechlich gesetzten Header einer Antwort
|
||||||
|
// gegen RequiredHeaders und liefert die fehlenden — der "automatisierte
|
||||||
|
// Header-Scan" aus Pruefung 1, anwendbar auf jede Antwort eines beliebigen
|
||||||
|
// Modul-Frontends.
|
||||||
|
func CheckCoverage(headers http.Header) (missing []string) {
|
||||||
|
for _, name := range RequiredHeaders {
|
||||||
|
if headers.Get(name) == "" {
|
||||||
|
missing = append(missing, name)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return missing
|
||||||
|
}
|
||||||
@@ -0,0 +1,113 @@
|
|||||||
|
package secheaders
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func secureRequest(method, target string) *http.Request {
|
||||||
|
req := httptest.NewRequest(method, target, nil)
|
||||||
|
req.Header.Set("X-Forwarded-Proto", "https")
|
||||||
|
return req
|
||||||
|
}
|
||||||
|
|
||||||
|
// Akzeptanzkriterium 1: CSP definiert ohne unsafe-inline/unsafe-eval.
|
||||||
|
func TestDefaultConfig_CSPHasNoUnsafeDirectives(t *testing.T) {
|
||||||
|
cfg := DefaultConfig()
|
||||||
|
if strings.Contains(cfg.ContentSecurityPolicy, "unsafe-inline") {
|
||||||
|
t.Fatal("csp enthaelt 'unsafe-inline', erwartet keine unsicheren direktiven")
|
||||||
|
}
|
||||||
|
if strings.Contains(cfg.ContentSecurityPolicy, "unsafe-eval") {
|
||||||
|
t.Fatal("csp enthaelt 'unsafe-eval', erwartet keine unsicheren direktiven")
|
||||||
|
}
|
||||||
|
if !strings.Contains(cfg.ContentSecurityPolicy, "default-src 'self'") {
|
||||||
|
t.Fatal("erwartet restriktive default-src 'self' als ausgangspunkt")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Akzeptanzkriterium 2: HSTS mit angemessener max-age gesetzt.
|
||||||
|
func TestMiddleware_SetsHSTSWithSufficientMaxAge(t *testing.T) {
|
||||||
|
cfg := DefaultConfig()
|
||||||
|
handler := Middleware(cfg, func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
|
||||||
|
|
||||||
|
rec := httptest.NewRecorder()
|
||||||
|
handler(rec, secureRequest(http.MethodGet, "https://example.test/"))
|
||||||
|
|
||||||
|
hsts := rec.Header().Get("Strict-Transport-Security")
|
||||||
|
if !strings.Contains(hsts, "max-age=") {
|
||||||
|
t.Fatalf("hsts-header fehlt max-age: %q", hsts)
|
||||||
|
}
|
||||||
|
// "Angemessen" heisst hier: mindestens 30 Tage (2592000s) — deutlich
|
||||||
|
// ueber dem bekannten Anti-Pattern kurzer/fehlender max-age-Werte.
|
||||||
|
if cfg.HSTSMaxAge.Seconds() < 2592000 {
|
||||||
|
t.Fatalf("konfigurierte hsts-max-age = %v, erwartet mindestens 30 tage", cfg.HSTSMaxAge)
|
||||||
|
}
|
||||||
|
if !strings.Contains(hsts, "includeSubDomains") {
|
||||||
|
t.Fatalf("erwartet includeSubDomains im hsts-header: %q", hsts)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Akzeptanzkriterium 3 + Pruefung 1: EINE gemeinsame Middleware setzt ALLE
|
||||||
|
// Baseline-Header vollstaendig — automatisiert ueberprueft mit CheckCoverage.
|
||||||
|
func TestMiddleware_ProducesFullHeaderCoverage(t *testing.T) {
|
||||||
|
cfg := DefaultConfig()
|
||||||
|
handler := Middleware(cfg, func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
|
||||||
|
|
||||||
|
rec := httptest.NewRecorder()
|
||||||
|
handler(rec, secureRequest(http.MethodGet, "https://example.test/"))
|
||||||
|
|
||||||
|
if missing := CheckCoverage(rec.Header()); len(missing) != 0 {
|
||||||
|
t.Fatalf("erwartet vollstaendige header-abdeckung, fehlen: %v", missing)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Pruefung 1 (Kehrseite): CheckCoverage erkennt fehlende Header
|
||||||
|
// zuverlaessig — Voraussetzung dafuer, dass ein automatisierter Scan
|
||||||
|
// gegen ein Modul-Frontend OHNE eingebundene Middleware ueberhaupt etwas
|
||||||
|
// meldet.
|
||||||
|
func TestCheckCoverage_DetectsMissingHeadersOnBareHandler(t *testing.T) {
|
||||||
|
bareHandler := func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) }
|
||||||
|
|
||||||
|
rec := httptest.NewRecorder()
|
||||||
|
bareHandler(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
||||||
|
|
||||||
|
missing := CheckCoverage(rec.Header())
|
||||||
|
if len(missing) != len(RequiredHeaders) {
|
||||||
|
t.Fatalf("erwartet %d fehlende header bei unbehandeltem handler, habe %d: %v",
|
||||||
|
len(RequiredHeaders), len(missing), missing)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Akzeptanzkriterium 2 + Pruefung 3: ein Aufruf ueber (simuliertes) HTTP
|
||||||
|
// wird server-seitig auf HTTPS umgeleitet, statt sich allein auf den
|
||||||
|
// HSTS-Browser-Cache zu verlassen (der erst nach dem ersten sicheren
|
||||||
|
// Aufruf greift).
|
||||||
|
func TestMiddleware_RedirectsInsecureRequestToHTTPS(t *testing.T) {
|
||||||
|
cfg := DefaultConfig()
|
||||||
|
called := false
|
||||||
|
handler := Middleware(cfg, func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
called = true
|
||||||
|
w.WriteHeader(http.StatusOK)
|
||||||
|
})
|
||||||
|
|
||||||
|
req := httptest.NewRequest(http.MethodGet, "http://example.test/pfad?x=1", nil)
|
||||||
|
// Kein X-Forwarded-Proto, kein r.TLS -> unsicherer Aufruf.
|
||||||
|
rec := httptest.NewRecorder()
|
||||||
|
handler(rec, req)
|
||||||
|
|
||||||
|
if rec.Code != http.StatusMovedPermanently {
|
||||||
|
t.Fatalf("status = %d, want 301 (redirect auf https)", rec.Code)
|
||||||
|
}
|
||||||
|
location := rec.Header().Get("Location")
|
||||||
|
if !strings.HasPrefix(location, "https://") {
|
||||||
|
t.Fatalf("location = %q, want https://-praefix", location)
|
||||||
|
}
|
||||||
|
if !strings.Contains(location, "/pfad?x=1") {
|
||||||
|
t.Fatalf("location = %q, erwartet erhaltenen pfad+query", location)
|
||||||
|
}
|
||||||
|
if called {
|
||||||
|
t.Fatal("eigentlicher handler haette bei unsicherem aufruf nicht erreicht werden duerfen")
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
DROP TABLE rate_limit_counters;
|
|
||||||
DROP TABLE rate_limit_configs;
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
-- Rate-Limiting mit geteiltem, externem Zustand (API-03, siehe
|
|
||||||
-- core-kanban/tickets/API-03.md) — bewusst NICHT In-Process, damit mehrere
|
|
||||||
-- Dienstinstanzen dasselbe Limit korrekt durchsetzen.
|
|
||||||
CREATE TABLE rate_limit_configs (
|
|
||||||
key TEXT PRIMARY KEY,
|
|
||||||
limit_value INT NOT NULL,
|
|
||||||
window_seconds INT NOT NULL
|
|
||||||
);
|
|
||||||
|
|
||||||
CREATE TABLE rate_limit_counters (
|
|
||||||
key TEXT NOT NULL,
|
|
||||||
window_start TIMESTAMPTZ NOT NULL,
|
|
||||||
count INT NOT NULL DEFAULT 0,
|
|
||||||
PRIMARY KEY (key, window_start)
|
|
||||||
);
|
|
||||||
Reference in New Issue
Block a user