cesnimda
0954876295
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
48 lines
2.3 KiB
C#
48 lines
2.3 KiB
C#
using System.Net;
|
|
using System.Security.Claims;
|
|
using JobTrackerApi.Services;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Xunit;
|
|
|
|
namespace JobTrackerApi.Tests;
|
|
|
|
public sealed class RateLimitPartitionKeysTests
|
|
{
|
|
[Theory]
|
|
[InlineData("account-data")]
|
|
[InlineData("email-send")]
|
|
public void Account_requires_authenticated_identity_and_keeps_anonymous_addresses_separate(string policy)
|
|
{
|
|
var anonymous = Context("203.0.113.10", "irrelevant");
|
|
anonymous.User = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim(ClaimTypes.NameIdentifier, "unvalidated") }));
|
|
var otherIp = Context("203.0.113.11", "irrelevant");
|
|
Assert.Equal($"{policy}:ip:203.0.113.10", RateLimitPartitionKeys.Account(anonymous, policy));
|
|
Assert.NotEqual(RateLimitPartitionKeys.Account(anonymous, policy), RateLimitPartitionKeys.Account(otherIp, policy));
|
|
// Even an authenticated identifier shaped like an IP cannot collide with anonymous traffic.
|
|
var owner = Context("203.0.113.11", "irrelevant");
|
|
owner.User = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("sub", "203.0.113.10") }, "validated"));
|
|
Assert.Equal($"{policy}:user:203.0.113.10", RateLimitPartitionKeys.Account(owner, policy));
|
|
Assert.NotEqual(RateLimitPartitionKeys.Account(owner, policy), RateLimitPartitionKeys.Account(anonymous, policy));
|
|
}
|
|
|
|
[Fact]
|
|
public void Public_pdf_partition_isolated_by_client_and_slug()
|
|
{
|
|
var first = Context("203.0.113.10", "shared-slug");
|
|
var second = Context("203.0.113.11", "shared-slug");
|
|
var otherSlug = Context("203.0.113.10", "other-slug");
|
|
|
|
Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(second));
|
|
Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(otherSlug));
|
|
Assert.Equal(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(Context("203.0.113.10", "shared-slug")));
|
|
}
|
|
|
|
private static DefaultHttpContext Context(string address, string slug)
|
|
{
|
|
var context = new DefaultHttpContext();
|
|
context.Connection.RemoteIpAddress = IPAddress.Parse(address);
|
|
context.Request.RouteValues["slug"] = slug;
|
|
return context;
|
|
}
|
|
}
|