itsi 0.1.19 → 0.2.2

data/gems/server/test/middleware/allow_list.rb

@@ -0,0 +1,128 @@
+# test_allow_list.rb
+require_relative "../helpers/test_helper"
+
+class TestAllowList < Minitest::Test
+  # 1. Single‐pattern: only localhost is allowed
+  def test_single_pattern_allows_and_denies
+    server(
+      itsi_rb: lambda do
+        allow_list allowed_patterns: ["^127\\.0\\.0\\.1$"]
+        get("/foo") { |r| r.ok "allowed" }
+      end
+    ) do
+      # Our test client always comes from 127.0.0.1
+      res1 = get_resp("/foo")
+      assert_equal "200", res1.code
+      assert_equal "allowed", res1.body
+
+      # If we change the pattern so it no longer matches, 127.0.0.1 is now forbidden
+      server(
+        itsi_rb: lambda do
+          allow_list allowed_patterns: ["^10\\.0\\."]
+          get("/foo") { |r| r.ok "never" }
+        end
+      ) do
+        res2 = get_resp("/foo")
+        assert_equal "403", res2.code
+      end
+    end
+  end
+
+  # 2. Multiple‐pattern: localhost or 192.168.x.x
+  def test_multiple_patterns
+    server(
+      itsi_rb: lambda do
+        allow_list allowed_patterns: ["^127\\.0\\.0\\.1$", "^192\\.168\\."]
+        get("/ping") { |r| r.ok "pong" }
+      end
+    ) do
+      # localhost matches first pattern
+      res1 = get_resp("/ping")
+      assert_equal "200", res1.code
+      assert_equal "pong", res1.body
+
+      # If we restrict to only 192.168.*, localhost becomes forbidden
+      server(
+        itsi_rb: lambda do
+          allow_list allowed_patterns: ["^192\\.168\\."]
+          get("/ping") { |r| r.ok "never" }
+        end
+      ) do
+        res2 = get_resp("/ping")
+        assert_equal "403", res2.code
+      end
+    end
+  end
+
+  # 3. Custom error_response
+  def test_custom_error_response
+    server(
+      itsi_rb: lambda do
+        allow_list \
+          allowed_patterns: ["^192\\.168\\."],  # localhost no longer matches
+          error_response: {
+            code: 403,
+            plaintext: { inline: "No access" },
+            default: "plaintext"
+          }
+        get("/x") { |r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/x")
+      assert_equal "403", res.code
+      assert_equal "No access", res.body
+    end
+  end
+
+  # 4. Trusted proxies: extract client IP from header if proxy is trusted
+   def test_trusted_proxy_allows_based_on_header
+     server(
+       itsi_rb: lambda do
+         allow_list \
+           allowed_patterns: ["^203\\.0\\.113\\.7$"],  # only allow this client IP
+           trusted_proxies: {
+             "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+           }
+         get("/trusted") { |r| r.ok "trusted" }
+       end
+     ) do
+       res = get_resp("/trusted", { "X-Forwarded-For" => "203.0.113.7" })
+       assert_equal "200", res.code
+       assert_equal "trusted", res.body
+     end
+   end
+
+   def test_trusted_proxy_denies_if_forwarded_ip_does_not_match
+     server(
+       itsi_rb: lambda do
+         allow_list \
+           allowed_patterns: ["^203\\.0\\.113\\.7$"],  # only allow this
+           trusted_proxies: {
+             "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+           }
+         get("/trusted") { |r| r.ok "nope" }
+       end
+     ) do
+       # Send a forwarded IP that doesn't match the allow list
+       res = get_resp("/trusted", { "X-Forwarded-For" => "192.0.2.55" })
+       assert_equal "403", res.code
+     end
+   end
+
+   def test_untrusted_proxy_ignores_forwarded_ip
+     server(
+       itsi_rb: lambda do
+         allow_list \
+           allowed_patterns: ["^203\\.0\\.113\\.7$"],  # client IP matches, but header is ignored
+           trusted_proxies: {
+             "10.0.0.1" => { header: { name: "X-Forwarded-For" } } # current proxy (127.0.0.1) is not trusted
+           }
+         get("/trusted") { |r| r.ok "never" }
+       end
+     ) do
+       res = get_resp("/trusted", { "X-Forwarded-For" => "203.0.113.7" })
+       # Since proxy is untrusted, header is ignored, and 127.0.0.1 is checked (not allowed)
+       assert_equal "403", res.code
+     end
+   end
+end

data/gems/server/test/middleware/auth_api_key.rb

@@ -0,0 +1,141 @@
+require_relative "../helpers/test_helper"
+
+class TestAuthApiKey < Minitest::Test
+
+  # 1. Anonymous inline keys: valid secret in Authorization header
+  def test_anonymous_inline_success
+    server(
+      itsi_rb: lambda do
+        auth_api_key valid_keys: [
+          Itsi.create_password_hash("supersecret", "sha256")
+        ]
+        get("/foo") {|r| r.ok "ok" }
+      end
+    ) do
+      res = get_resp("/foo", { "Authorization" => "Bearer supersecret" })
+
+      assert_equal "200", res.code
+      assert_equal "ok", res.body
+    end
+  end
+
+  # 2. Anonymous inline: missing token → 401
+  def test_anonymous_inline_missing
+    server(
+      itsi_rb: lambda do
+        auth_api_key valid_keys: [Itsi.create_password_hash("supersecret", "sha256")]
+        get("/foo") {|r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/foo")
+      assert_equal "401", res.code
+    end
+  end
+
+  # 3. Identified inline keys: need both ID header and Bearer token
+  def test_identified_inline_success
+    key_id = "Key-1"
+    server(
+      itsi_rb: lambda do
+        auth_api_key valid_keys: { "#{key_id}" => Itsi.create_password_hash("supersecret", "sha256") }
+        get("/bar") {|r| r.ok "bar OK" }
+      end
+    ) do
+      headers = {
+        "X-Api-Key-Id" => key_id,
+        "Authorization" => "Bearer supersecret"
+      }
+      res = get_resp("/bar", headers)
+      assert_equal "200", res.code
+      assert_equal "bar OK", res.body
+    end
+  end
+
+  # 4. Identified inline: wrong ID → 401
+  def test_identified_inline_wrong_id
+    key_id = "Key-1"
+    server(
+      itsi_rb: lambda do
+        auth_api_key valid_keys: { "#{key_id}" => Itsi.create_password_hash("supersecret", "sha256") }
+        get("/bar") {|r| r.ok "never" }
+      end
+    ) do
+      headers = { "X-Api-Key-Id" => "bad", "Authorization" => "Bearer supersecret" }
+      res = get_resp("/bar", headers)
+      assert_equal "401", res.code
+    end
+  end
+
+  # 5. Custom token_source/query param
+  def test_custom_token_source_query
+    server(
+      itsi_rb: lambda do
+        auth_api_key \
+          valid_keys: [Itsi.create_password_hash("supersecret", "sha256")],
+          token_source: { query: "api_key" }
+        get("/q") {|r| r.ok "qok" }
+      end
+    ) do
+      res = get_resp("/q?api_key=supersecret")
+      assert_equal "200", res.code
+      assert_equal "qok", res.body
+    end
+  end
+
+  # 6. Custom key_id_source/query param
+  def test_custom_key_id_source_query
+    server(
+      itsi_rb: lambda do
+        auth_api_key \
+          valid_keys: { "#{@id1}" => Itsi.create_password_hash("supersecret", "sha256") },
+          key_id_source: { query: "kid" }
+        get("/q") {|r| r.ok "qok" }
+      end
+    ) do
+      res = get_resp("/q?kid=#{@id1}", { "Authorization" => "Bearer supersecret" })
+      assert_equal "200", res.code
+      assert_equal "qok", res.body
+    end
+  end
+
+  # 7. Custom error_response override
+  def test_custom_error_response
+    server(
+      itsi_rb: lambda do
+        auth_api_key \
+          valid_keys: [Itsi.create_password_hash("supersecret", "sha256") ],
+          error_response: { code: 403,
+                            plaintext: { inline: "nope" },
+                            default: "plaintext" }
+        get("/x") {|r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/x")
+      assert_equal "403", res.code
+      assert_equal "nope", res.body
+    end
+  end
+
+  # 8. Scoped to a location path
+  def test_scoped_to_location
+    server(
+      itsi_rb: lambda do
+        location "/admin/*" do
+          auth_api_key valid_keys: [Itsi.create_password_hash("supersecret", "sha256") ]
+        end
+        get("/admin/secret") {|r| r.ok "adm ok" }
+        get("/public") {|r| r.ok "pub ok" }
+      end
+    ) do
+      # Unprotected
+      r1 = get_resp("/public")
+      assert_equal "200", r1.code
+      # Protected
+      r2 = get_resp("/admin/secret")
+      assert_equal "401", r2.code
+      # Then with key
+      r3 = get_resp("/admin/secret", { "Authorization" => "Bearer supersecret" })
+      assert_equal "200", r3.code
+    end
+  end
+end

data/gems/server/test/middleware/auth_basic.rb

@@ -0,0 +1,91 @@
+require_relative "../helpers/test_helper"
+
+class TestAuthBasic < Minitest::Test
+
+
+  # 1. Inline credentials success
+  def test_inline_success
+    server(
+      itsi_rb: lambda do
+        auth_basic realm: "Admin", credential_pairs: { "alice" => Itsi.create_password_hash("wonderland", "sha256") }
+        get("/secure") {|r| r.ok "hello" }
+      end
+    ) do
+      hdr = { "Authorization" => "Basic #{["alice:wonderland"].pack("m0")}" }
+      res = get_resp("/secure", hdr)
+      assert_equal "200", res.code
+      assert_equal "hello", res.body
+    end
+  end
+
+  # 2. Missing credentials → 401 + WWW-Authenticate header
+  def test_missing_credentials
+    server(
+      itsi_rb: lambda do
+        auth_basic realm: "Admin", credential_pairs: { "alice" => Itsi.create_password_hash("wonderland", "sha256") }
+        get("/secure") {|r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/secure")
+      assert_equal "401", res.code
+      assert_match /Basic realm="Admin"/, res["WWW-Authenticate"]
+    end
+  end
+
+  # 3. Invalid credentials → 401
+  def test_invalid_credentials
+    server(
+      itsi_rb: lambda do
+        auth_basic realm: "Area", credential_pairs: { "alice" => Itsi.create_password_hash("wonderland", "sha256") }
+        get("/secure") {|r| r.ok "never" }
+      end
+    ) do
+      bad = ["bob:wrong"].pack("m0")
+      res = get_resp("/secure", { "Authorization" => "Basic #{bad}" })
+      assert_equal "401", res.code
+    end
+  end
+
+  # 4. Load from credentials_file
+  def test_credentials_file
+    Dir.mktmpdir do |dir|
+      Dir.chdir("#{dir}") do
+        path = File.join(dir, ".itsi-credentials")
+        File.write(path, "alice:#{Itsi.create_password_hash("wonderland", "sha256")}\n")
+        server(
+          itsi_rb: lambda do
+            auth_basic  # default will load .itsi-credentials
+            get("/a") {|r| r.ok "ok" }
+          end
+        ) do
+          hdr = { "Authorization" => "Basic #{["alice:wonderland"].pack("m0")}" }
+          res = get_resp("/a", hdr)
+          assert_equal "200", res.code
+        end
+      end
+    end
+  end
+
+  # 5. Apply to sub-path only
+  def test_scoped_to_location
+    server(
+      itsi_rb: lambda do
+        location "/admin/*" do
+          auth_basic realm: "Adm", credential_pairs: { "alice" => Itsi.create_password_hash("wonderland", "sha256") }
+        end
+        get("/admin/yes") {|r| r.ok "y"}
+        get("/no")        {|r| r.ok "n"}
+      end
+    ) do
+      # outside
+      assert_equal "n", get_resp("/no").body
+      # inside, need auth
+      res1 = get_resp("/admin/yes")
+      assert_equal "401", res1.code
+      # then with creds
+      hdr = { "Authorization" => "Basic #{["alice:wonderland"].pack("m0")}" }
+      res2 = get_resp("/admin/yes", hdr)
+      assert_equal "200", res2.code
+    end
+  end
+end

data/gems/server/test/middleware/auth_jwt.rb

@@ -0,0 +1,214 @@
+require_relative "../helpers/test_helper"
+require "jwt"
+require "openssl"
+require "securerandom"
+require "base64"
+
+class TestAuthJwt < Minitest::Test
+  ALGORITHMS = {
+    "HS256" => -> {
+      secret = Base64.strict_encode64(SecureRandom.random_bytes(32))
+      verifier = secret
+      signer  = Base64.decode64(secret)
+      [verifier, signer]
+    },
+    "HS384" => -> {
+      secret = Base64.strict_encode64(SecureRandom.random_bytes(48))
+      [secret, Base64.decode64(secret)]
+    },
+    "HS512" => -> {
+      secret = Base64.strict_encode64(SecureRandom.random_bytes(64))
+      [secret, Base64.decode64(secret)]
+    },
+    "RS256" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "RS384" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "RS512" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "PS256" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "PS384" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "PS512" => -> {
+      rsa = OpenSSL::PKey::RSA.new(2048)
+      [rsa.public_key.to_pem, rsa]
+    },
+    "ES256" => -> {
+      private_key = OpenSSL::PKey::EC.generate("prime256v1")
+      asn1 = OpenSSL::ASN1::Sequence(
+          [
+            OpenSSL::ASN1::Sequence(
+              [
+                OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+                OpenSSL::ASN1::ObjectId(private_key.public_key.group.curve_name)
+              ]
+            ),
+            OpenSSL::ASN1::BitString(private_key.public_key.to_octet_string(:uncompressed))
+          ]
+        )
+      public_key = OpenSSL::PKey::EC.new(asn1.to_der)
+      [public_key.to_pem, private_key]
+    },
+    "ES384" => -> {
+      private_key = OpenSSL::PKey::EC.generate("secp384r1")
+      asn1 = OpenSSL::ASN1::Sequence(
+          [
+            OpenSSL::ASN1::Sequence(
+              [
+                OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+                OpenSSL::ASN1::ObjectId(private_key.public_key.group.curve_name)
+              ]
+            ),
+            OpenSSL::ASN1::BitString(private_key.public_key.to_octet_string(:uncompressed))
+          ]
+        )
+      public_key = OpenSSL::PKey::EC.new(asn1.to_der)
+      [public_key.to_pem, private_key]
+    }
+  }
+
+  # 1. Missing token → 401
+  def test_missing_token
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => ["Zm9v"] }
+        get("/j") { |r| r.ok "j" }
+      end
+    ) do
+      res = get_resp("/j")
+      assert_equal "401", res.code
+    end
+  end
+
+  # 2. Invalid token → 401
+  def test_invalid_token
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => ["Zm9v"] }
+        get("/j") { |r| r.ok "j" }
+      end
+    ) do
+      res = get_resp("/j", { "Authorization" => "Bearer invalid.token" })
+      assert_equal "401", res.code
+    end
+
+  end
+
+  # Dynamically define one test per algorithm
+  ALGORITHMS.each do |alg, gen|
+    define_method("test_#{alg.downcase}_success") do
+      verifier, signer = gen.call
+      # build a minimal payload
+      payload = { "sub" => "user", "aud" => "aud1", "iss" => "iss1", "iat" => Time.now.to_i, exp: Time.now.to_i + 10 }
+      token = JWT.encode(payload, signer, alg)
+      server(
+        itsi_rb: lambda do
+          auth_jwt verifiers: { alg => [verifier] }
+          get("/#{alg.downcase}") { |r| r.ok alg }
+        end
+      ) do
+        res = get_resp("/#{alg.downcase}", { "Authorization" => "Bearer #{token}" })
+        assert_equal "200", res.code, "#{alg} should verify successfully"
+        assert_equal alg, res.body
+      end
+    end
+  end
+
+  # 5. Audience restriction
+  def test_audience_restriction
+    verifier, signer = ALGORITHMS["HS256"].call
+    payload = { "aud" => "good", exp: Time.now.to_i + 10 }
+    token   = JWT.encode(payload, signer, "HS256")
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => [verifier] }, audiences: ["good"]
+        get("/a") { |r| r.ok "ok" }
+      end
+    ) do
+      res1 = get_resp("/a", { "Authorization" => "Bearer #{token}" })
+      assert_equal "200", res1.code
+      # wrong audience
+      bad = JWT.encode({ "aud" => "bad" }, signer, "HS256")
+      res2 = get_resp("/a", { "Authorization" => "Bearer #{bad}" })
+      assert_equal "401", res2.code
+    end
+  end
+
+  # 6. Subject & issuer restrictions
+  def test_subject_and_issuer
+    verifier, signer = ALGORITHMS["HS256"].call
+    payload = { "sub" => "mysub", "iss" => "myiss", exp: Time.now.to_i + 10 }
+    token   = JWT.encode(payload, signer, "HS256")
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => [verifier] },
+                 subjects: ["mysub"], issuers: ["myiss"]
+        get("/si") { |r| r.ok "si" }
+      end
+    ) do
+      res = get_resp("/si", { "Authorization" => "Bearer #{token}" })
+      assert_equal "200", res.code
+    end
+  end
+
+  # 7. Custom token_source query
+  def test_custom_token_source_query
+    verifier, signer = ALGORITHMS["HS256"].call
+    token = JWT.encode({exp: Time.now.to_i + 10}, signer, "HS256")
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => [verifier] }, token_source: { query: "jwt" }
+        get("/") { |r| r.ok "root" }
+      end
+    ) do
+      res = get_resp("/?jwt=#{token}")
+      assert_equal "200", res.code
+    end
+  end
+
+  # 8. Leeway works for 'exp' skew
+  def test_leeway_exp
+    verifier, signer = ALGORITHMS["HS256"].call
+    expired_iat = Time.now.to_i - 120
+    token = JWT.encode({ "exp" => expired_iat }, signer, "HS256")
+    server(
+      itsi_rb: lambda do
+        auth_jwt verifiers: { "HS256" => [verifier] }, leeway: 300
+        get("/") { |r| r.ok "ok" }
+      end
+    ) do
+      res = get_resp("/", { "Authorization" => "Bearer #{token}" })
+      assert_equal "200", res.code
+    end
+  end
+
+  # 9. Scoped to location
+  def test_scoped_to_location
+    verifier, signer = ALGORITHMS["HS256"].call
+    token = JWT.encode({exp: Time.now.to_i + 10}, signer, "HS256")
+    server(
+      itsi_rb: lambda do
+        location "/api/*" do
+          auth_jwt verifiers: { "HS256" => [verifier] }
+          get("x") { |r| r.ok "x" }
+        end
+        get("/public") { |r| r.ok "p" }
+      end
+    ) do
+      assert_equal "p", get_resp("/public").body
+      assert_equal "401", get_resp("/api/x").code
+      assert_equal "x", get_resp("/api/x", { "Authorization" => "Bearer #{token}" }).body
+    end
+  end
+end

data/gems/server/test/middleware/cache_control.rb

@@ -0,0 +1,82 @@
+require_relative "../helpers/test_helper"
+
+require_relative "../helpers/test_helper"
+
+class TestCacheControl < Minitest::Test
+  def test_cache_control_headers_are_set
+    server(
+      itsi_rb: lambda do
+        cache_control \
+          max_age: 3600,
+          public: true,
+          vary: ["Accept-Encoding"],
+          additional_headers: { "X-Custom-Header" => "HIT" }
+        get("/foo") { |r| r.ok "content" }
+      end
+    ) do
+      require 'debug'
+      res = get_resp("/foo")
+      # Check that the Cache-Control header is present and contains required directives
+      assert_includes res["Cache-Control"], "public"
+      assert_includes res["Cache-Control"], "max-age=3600"
+
+      # Check that the Expires header exists and is a valid HTTP date string
+      assert res.key?("Expires"), "Expires header should be present"
+      # A basic check: the Expires header should include a comma and a GMT designation
+      assert_match /GMT/, res["Expires"]
+
+      # Check that the Vary header is set correctly
+      assert_equal "Accept-Encoding", res["Vary"]
+
+      # Check that additional custom header is set
+      assert_equal "HIT", res["X-Custom-Header"]
+    end
+  end
+
+  def test_cache_control_not_set_for_error_statuses
+    server(
+      itsi_rb: lambda do
+        cache_control max_age: 3600, public: true
+        get("/foo") { |r| r.respond("error", 500) }
+      end
+    ) do
+      res = get_resp("/foo")
+      refute res.key?("Cache-Control"), "Cache-Control should not be set for 500 errors"
+      refute res.key?("Expires"), "Expires should not be set for 500 errors"
+    end
+  end
+
+  def test_cache_control_s_max_age_and_stale_directives
+    server(
+      itsi_rb: lambda do
+        cache_control \
+          max_age: 3600,
+          s_max_age: 1800,
+          stale_while_revalidate: 30,
+          stale_if_error: 60,
+          private: true
+        get("/foo") { |r| r.ok "some content" }
+      end
+    ) do
+      res = get_resp("/foo")
+      cc = res["Cache-Control"]
+      assert_includes cc, "private"
+      assert_includes cc, "s-maxage=1800"
+      assert_includes cc, "stale-while-revalidate=30"
+      assert_includes cc, "stale-if-error=60"
+    end
+  end
+
+  def test_cache_control_set_without_optional_fields
+    server(
+      itsi_rb: lambda do
+        cache_control public: true
+        get("/foo") { |r| r.ok "minimal" }
+      end
+    ) do
+      res = get_resp("/foo")
+      cc = res["Cache-Control"]
+      assert_includes cc, "public"
+    end
+  end
+end

data/gems/server/test/middleware/cidr_to_regex.rb

@@ -0,0 +1,46 @@
+require 'minitest/autorun'
+require 'ipaddr'
+
+class TestCidrToRegex < Minitest::Test
+  include Itsi::Server::CidrToRegex
+
+  def test_simple_cidr
+    regex = cidr_to_regex("192.168.1.0/24")
+    assert_match regex, "192.168.1.0"
+    assert_match regex, "192.168.1.255"
+    refute_match regex, "192.168.2.0"
+  end
+
+  def test_class_b_cidr
+    regex = cidr_to_regex("10.1.0.0/16")
+    assert_match regex, "10.1.0.1"
+    assert_match regex, "10.1.255.255"
+    refute_match regex, "10.2.0.0"
+  end
+
+  def test_class_a_cidr
+    regex = cidr_to_regex("10.0.0.0/8")
+    assert_match regex, "10.255.255.255"
+    refute_match regex, "11.0.0.0"
+  end
+
+  def test_tiny_range
+    regex = cidr_to_regex("127.0.0.0/30")
+    assert_match regex, "127.0.0.0"
+    assert_match regex, "127.0.0.3"
+    refute_match regex, "127.0.0.4"
+  end
+
+  def test_single_ip
+    regex = cidr_to_regex("8.8.8.8/32")
+    assert_match regex, "8.8.8.8"
+    refute_match regex, "8.8.8.9"
+  end
+
+  def test_edge_case_lower_bound
+    regex = cidr_to_regex("0.0.0.0/8")
+    assert_match regex, "0.0.0.0"
+    assert_match regex, "0.255.255.255"
+    refute_match regex, "1.0.0.0"
+  end
+end