itsi 0.1.19 → 0.2.2

data/gems/server/test/middleware/etag.rb

@@ -0,0 +1,75 @@
+require_relative "../helpers/test_helper"
+
+class TestETag < Minitest::Test
+  def test_strong_etag_added
+    server(
+      itsi_rb: lambda do
+        etag type: "strong", algorithm: "sha256", min_body_size: 0, handle_if_none_match: false
+        get("/foo") { |r| r.ok "etag-body" }
+      end
+    ) do
+      res = get_resp("/foo")
+      assert res["ETag"].start_with?("\"")
+      refute res["ETag"].start_with?("W/")
+    end
+  end
+
+  def test_weak_etag_added_with_md5
+    server(
+      itsi_rb: lambda do
+        etag type: "weak", algorithm: "md5", min_body_size: 0, handle_if_none_match: false
+        get("/foo") { |r| r.ok "etag-weak-md5" }
+      end
+    ) do
+      res = get_resp("/foo")
+      assert res["ETag"].start_with?("W/\"")
+    end
+  end
+
+  def test_etag_not_added_below_min_body_size
+    server(
+      itsi_rb: lambda do
+        etag min_body_size: 50
+        get("/foo") { |r| r.ok "short" }
+      end
+    ) do
+      res = get_resp("/foo")
+      refute res.key?("ETag")
+    end
+  end
+
+  def test_etag_responds_with_304_if_none_match
+    body = "etag-content"
+    server(
+      itsi_rb: lambda do
+        etag type: "strong", min_body_size: 0, handle_if_none_match: true
+        get("/foo") { |r| r.ok body }
+      end
+    ) do
+      first = get_resp("/foo")
+      etag = first["ETag"]
+      assert etag
+
+      second = get_resp("/foo", { "If-None-Match" => etag })
+      assert_equal "304", second.code
+      refute second.body && second.body.size > 0
+    end
+  end
+
+  def test_etag_ignored_for_streaming_body
+    server(
+      itsi_rb: lambda do
+        etag min_body_size: 0
+        get("/stream") do |req|
+          r = req.response
+          r << "streaming-1"
+          r << "streaming-2"
+          r.close
+        end
+      end
+    ) do
+      res = get_resp("/stream")
+      refute res.key?("ETag")
+    end
+  end
+end

data/gems/server/test/middleware/grpc/grpc.rb

@@ -0,0 +1,158 @@
+require_relative "../../helpers/test_helper"
+require_relative "test_service_impl"
+
+class TestGrpc < Minitest::Test
+  Stub = Test::TestService::Stub
+
+  def new_stub(uri)
+    address = uri.to_s[/\/\/(.*)/,1]    # e.g. "127.0.0.1:12345"
+    channel = GRPC::Core::Channel.new(address,
+                                      {},              # channel_args hash
+                                      :this_channel_is_insecure,
+    )
+    stub = Stub.new(nil,
+                                 nil,
+                                 channel_override: channel)
+  end
+
+  def test_unary_echo
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      stub = new_stub(@uri)
+      req = Test::EchoRequest.new(message: "hello")
+      res = stub.unary_echo(req)
+      assert_equal "hello", res.message
+    end
+  end
+
+  def test_client_stream
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      stub = new_stub(@uri)
+      # send a few messages in one stream
+      requests = %w[a b c].map { |m| Test::StreamRequest.new(message: m) }
+      res = stub.client_stream(requests.each)
+      assert_equal %w[a b c], res.messages
+    end
+  end
+
+  def test_server_stream
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      stub = new_stub(@uri)
+      req = Test::EchoRequest.new(message: "xy")
+      # expect two StreamResponse frames, one per character
+      chars = stub.server_stream(req).map(&:messages).flatten
+      assert_equal ["x", "y"], chars
+    end
+  end
+
+  def test_bidi_stream
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      stub = new_stub(@uri)
+      inputs = %w[test1 test2].map { |m| Test::EchoRequest.new(message: m) }
+      # each response uppercases its incoming message
+      results = stub.bidi_stream(inputs.each).map(&:message)
+      assert_equal ["TEST1", "TEST2"], results
+    end
+  end
+
+  def test_empty_streams
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      stub = new_stub(@uri)
+
+      # empty client‐streaming
+      res = stub.client_stream([].each)
+      assert_equal [], res.messages
+
+      # empty server‐streaming
+      empty_server = stub.server_stream(Test::EchoRequest.new(message: "")).to_a
+      assert empty_server.empty?
+
+      # empty bidi‐streaming
+      empty_bidi = stub.bidi_stream([].each).to_a
+      assert empty_bidi.empty?
+    end
+  end
+
+
+  def test_unary_echo_json
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      payload = { "message" => "hello" }.to_json
+      res = post("test.TestService/UnaryEcho", payload, { "Content-Type" => "application/json" })
+      json = JSON.parse(res.body)
+      assert_equal 200, res.code.to_i
+      assert_equal "hello", json["message"]
+    end
+  end
+
+  def test_client_stream_json
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      input = [{"message" => "a"}, {"message" => "b"}, {"message" => "c"}]
+      res = post("test.TestService/ClientStream", input.to_json, { "Content-Type" => "application/json" })
+      json = JSON.parse(res.body)
+      assert_equal 200, res.code.to_i
+      assert_equal %w[a b c], json["messages"]
+    end
+  end
+
+  def test_server_stream_json
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      payload = { "message" => "xy" }.to_json
+      res = post("test.TestService/ServerStream", payload, { "Content-Type" => "application/json" })
+      arr = JSON.parse(res.body)
+      # service streams back one JSON object per character
+      messages = arr.flat_map { |frame| frame["messages"] }
+      assert_equal 200, res.code.to_i
+      assert_equal ["x","y"], messages
+    end
+  end
+
+  def test_bidi_stream_json
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      inputs = [{"message":"foo"}, {"message":"Bar"}]
+      res = post("test.TestService/BidiStream", inputs.to_json, { "Content-Type" => "application/json" })
+      arr = JSON.parse(res.body)
+      # bidi uppercases each incoming message
+      results = arr.map { |frame| frame["message"] }
+      assert_equal 200, res.code.to_i
+      assert_equal ["FOO","BAR"], results
+    end
+  end
+
+  def test_empty_streams_json
+    server(itsi_rb: lambda do
+      grpc TestServiceImpl.new
+    end) do
+      # empty client-stream → still JSON object with empty messages
+      res1 = post("test.TestService/ClientStream", "[]", { "Content-Type" => "application/json" })
+      json1 = JSON.parse(res1.body)
+      assert_nil json1["messages"]
+
+      # empty server-stream
+      res2 = post("test.TestService/ServerStream", { "message" => "" }.to_json, { "Content-Type" => "application/json" })
+      arr2 = JSON.parse(res2.body)
+      assert arr2.empty?
+
+      # empty bidi-stream
+      res3 = post("test.TestService/BidiStream", "[]", { "Content-Type" => "application/json" })
+      arr3 = JSON.parse(res3.body)
+      assert arr3.empty?
+    end
+  end
+end

data/gems/server/test/middleware/grpc/test_service.proto

@@ -0,0 +1,32 @@
+syntax = "proto3";
+
+package test;
+
+// A service with one of each RPC type  [oai_citation_attribution:0‡Википедия — свободная энциклопедия](https://ru.wikipedia.org/wiki/GRPC?utm_source=chatgpt.com)
+service TestService {
+  // Unary RPC
+  rpc UnaryEcho (EchoRequest) returns (EchoResponse) {}
+
+  // Client‑streaming RPC
+  rpc ClientStream (stream StreamRequest) returns (StreamResponse) {}
+
+  // Server‑streaming RPC
+  rpc ServerStream (EchoRequest) returns (stream StreamResponse) {}
+
+  // Bidirectional streaming RPC
+  rpc BidiStream (stream EchoRequest) returns (stream EchoResponse) {}
+}
+
+message EchoRequest {
+  string message = 1;
+}
+message EchoResponse {
+  string message = 1;
+}
+
+message StreamRequest {
+  string message = 1;
+}
+message StreamResponse {
+  repeated string messages = 1;
+}

data/gems/server/test/middleware/grpc/test_service_impl.rb

@@ -0,0 +1,28 @@
+require_relative 'test_service_services_pb'  # generated by grpc_tools_ruby_protoc
+
+class TestServiceImpl < Test::TestService::Service
+  # Unary: echo back the message  [oai_citation_attribution:2‡Gustavo Caso](https://gustavocaso.dev/posts/grpc-tutorial-with-ruby/)
+  def unary_echo(req, _unused_call)
+    Test::EchoResponse.new(message: req.message)
+  end
+
+  # Client‑streaming: collect all incoming messages into one response  [oai_citation_attribution:3‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def client_stream(stream, _call)
+    msgs = stream.map(&:message)
+    Test::StreamResponse.new(messages: msgs)
+  end
+
+  # Server‑streaming: send back one StreamResponse per incoming request, with each char  [oai_citation_attribution:4‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def server_stream(req, _call)
+    Enumerator.new do |y|
+      req.message.each_char { |c| y << Test::StreamResponse.new(messages: [c]) }
+    end
+  end
+
+  # Bidirectional: for each incoming EchoRequest, immediately echo it back  [oai_citation_attribution:5‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def bidi_stream(stream, _call)
+    Enumerator.new do |y|
+      stream.each { |req| y << Test::EchoResponse.new(message: req.message.upcase) }
+    end
+  end
+end

data/gems/server/test/middleware/grpc/test_service_pb.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: test_service.proto
+
+require 'google/protobuf'
+
+
+descriptor_data = "\n\x12test_service.proto\x12\x04test\"\x1e\n\x0b\x45\x63hoRequest\x12\x0f\n\x07message\x18\x01 \x01(\t\"\x1f\n\x0c\x45\x63hoResponse\x12\x0f\n\x07message\x18\x01 \x01(\t\" \n\rStreamRequest\x12\x0f\n\x07message\x18\x01 \x01(\t\"\"\n\x0eStreamResponse\x12\x10\n\x08messages\x18\x01 \x03(\t2\xfa\x01\n\x0bTestService\x12\x34\n\tUnaryEcho\x12\x11.test.EchoRequest\x1a\x12.test.EchoResponse\"\x00\x12=\n\x0c\x43lientStream\x12\x13.test.StreamRequest\x1a\x14.test.StreamResponse\"\x00(\x01\x12;\n\x0cServerStream\x12\x11.test.EchoRequest\x1a\x14.test.StreamResponse\"\x00\x30\x01\x12\x39\n\nBidiStream\x12\x11.test.EchoRequest\x1a\x12.test.EchoResponse\"\x00(\x01\x30\x01\x62\x06proto3"
+
+pool = Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Test
+  EchoRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.EchoRequest").msgclass
+  EchoResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.EchoResponse").msgclass
+  StreamRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.StreamRequest").msgclass
+  StreamResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.StreamResponse").msgclass
+end

data/gems/server/test/middleware/grpc/test_service_services_pb.rb

@@ -0,0 +1,30 @@
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# Source: test_service.proto for package 'test'
+
+require 'grpc'
+require_relative 'test_service_pb'
+
+module Test
+  module TestService
+    # A service with one of each RPC type  [oai_citation_attribution:0‡Википедия — свободная энциклопедия](https://ru.wikipedia.org/wiki/GRPC?utm_source=chatgpt.com)
+    class Service
+
+      include ::GRPC::GenericService
+
+      self.marshal_class_method = :encode
+      self.unmarshal_class_method = :decode
+      self.service_name = 'test.TestService'
+
+      # Unary RPC
+      rpc :UnaryEcho, ::Test::EchoRequest, ::Test::EchoResponse
+      # Client‑streaming RPC
+      rpc :ClientStream, stream(::Test::StreamRequest), ::Test::StreamResponse
+      # Server‑streaming RPC
+      rpc :ServerStream, ::Test::EchoRequest, stream(::Test::StreamResponse)
+      # Bidirectional streaming RPC
+      rpc :BidiStream, stream(::Test::EchoRequest), stream(::Test::EchoResponse)
+    end
+
+    Stub = Service.rpc_stub_class
+  end
+end

data/gems/server/test/middleware/header_interpolation.rb

@@ -0,0 +1,35 @@
+class TestHeaderInterpolation < Minitest::Test
+  def test_request_header_interpolation_and_response_header_interpolation
+    server(
+      itsi_rb: lambda do
+        # 1) Echo back incoming header "X-Auth-User" in a new request header "X-User"
+        request_headers \
+          additions: { "X-User" => ["{X-Auth-User}"] },
+          removals:  []
+
+        # 2) After the handler runs, take the request‑echoed "X-User" and also echo it into "X-User-Echo" in the response
+        response_headers \
+          additions: { "X-User-Echo" => ["{X-User}"] },
+          removals:  []
+
+        get("/echo") do |r|
+          # Return the value of the new X-User header in the body for verification
+          r.ok("Hello #{r.header("X-User").first}", headers: {"X-User" => [r.header("X-User").first]})
+        end
+      end
+    ) do
+      # Simulate a client sending X-Auth-User: alice
+      req_headers = { "X-Auth-User" => "alice" }
+
+      res = get_resp("/echo", req_headers)
+      assert_equal "200", res.code
+
+      # The request middleware should have created X-User == "alice",
+      # and the handler returned it in the body:
+      assert_equal "Hello alice", res.body
+
+      # The response middleware should have added X-User-Echo == "alice"
+      assert_equal "alice", res["X-User-Echo"]
+    end
+  end
+end

data/gems/server/test/middleware/intrusion_protection.rb

@@ -0,0 +1,259 @@
+require_relative "../helpers/test_helper"
+require "redis"
+
+class TestIntrusionProtection < Minitest::Test
+
+  # 1. Banned URL pattern causes immediate ban + 403
+  def test_banned_url_pattern
+    server(
+      itsi_rb: lambda do
+        location "/secret" do
+          intrusion_protection \
+            banned_url_patterns: ["/secret"],
+            banned_time_seconds: 0.1,
+            store_config: { redis: { connection_url: "redis://localhost:6379/14" } }
+          get { |r| r.ok "never" }
+        end
+        location "/public" do
+          get { |r| r.ok "public" }
+        end
+      end
+    ) do
+
+      # First request: matched → banned + forbidden
+      res1 = get_resp("/secret")
+      assert_equal "403", res1.code
+
+      # Immediately banned: second request also forbidden
+      res2 = get_resp("/secret")
+      assert_equal "403", res2.code
+
+      # After ban TTL expires
+      sleep 0.11
+
+      res3 = get_resp("/public")
+      assert_equal "200", res3.code
+      res4 = get_resp("/secret")
+      assert_equal "403", res4.code
+    end
+  end
+
+  # 2. Banned header pattern causes ban + 403
+  def test_banned_header_pattern
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_header_patterns: { "User-Agent" => ["BadBot"] },
+          banned_time_seconds: 0.1,
+          store_config: "in_memory"
+        get("/hi") { |r| r.ok "hi" }
+      end
+    ) do
+      # First: header matches → banned
+      res1 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res1.code
+
+      # Still banned until TTL
+      res2 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res2.code
+
+      sleep 0.11
+      # After TTL, banned set clears; header still matches → ban again
+      res3 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res3.code
+    end
+  end
+
+  # 3. Clean traffic passes through
+  def test_clean_traffic
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: [".*\\.php$"],
+          banned_header_patterns: { "X-Test" => ["evil"] },
+          banned_time_seconds: 0.1,
+          store_config: { redis: { connection_url: "redis://localhost:6379/13" } }
+        get("/hello") { |r| r.ok "world" }
+      end
+    ) do
+      # Non‑matching URL & header → allowed
+      res = get_resp("/hello", { "User-Agent" => "Mozilla/5.0" })
+      assert_equal "200", res.code
+      assert_equal "world", res.body
+    end
+  end
+
+  # 4. Custom error_response
+  def test_custom_error_response
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/bad"],
+          banned_header_patterns: {},
+          banned_time_seconds: 5,
+          store_config: "in_memory",
+          error_response: {
+            code: 401,
+            plaintext: { inline: "Halt!" },
+            default: "plaintext"
+          }
+        get("/bad") { |r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/bad")
+      assert_equal "401", res.code
+      assert_equal "Halt!", res.body
+    end
+  end
+
+  # 5. Intrusion protection middleware stacks (nested: parent + child)
+  def test_nested_intrusion_protection_stacking
+    server(
+      itsi_rb: lambda do
+        location "/protected" do
+          intrusion_protection \
+            banned_url_patterns: ["/nested"],
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+
+          location "/nested" do
+            intrusion_protection \
+              banned_header_patterns: { "X-Evil" => ["1"] },
+              banned_time_seconds: 0.1,
+              store_config: "in_memory"
+            get { |r| r.ok "should not see this" }
+          end
+
+          get { |r| r.ok "Should also not see this" }
+        end
+        location "/public" do
+          get { |r| r.ok "safe" }
+        end
+      end
+    ) do
+      # 1. Triggers child (header) rule → ban
+      res1 = get_resp("protected/nested", { "X-Evil" => "1" })
+      assert_equal "403", res1.code
+
+      sleep 0.11
+
+      # 3. Triggers parent (path) rule → ban
+      res3 = get_resp("protected/nested")
+      assert_equal "403", res3.code
+
+      sleep 0.11
+
+      # 4. Confirm public route works
+      res4 = get_resp("/public")
+      assert_equal "200", res4.code
+    end
+  end
+
+  # 6. Sibling intrusion protection rules stack independently
+  def test_sibling_intrusion_protection_stacking
+    server(
+      itsi_rb: lambda do
+        location "/one" do
+          intrusion_protection \
+            banned_url_patterns: ["/one"],
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+          get { |r| r.ok "never" }
+        end
+
+        location "/two" do
+          intrusion_protection \
+            banned_header_patterns: { "X-Bot" => ["true"] },
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+          get { |r| r.ok "never" }
+        end
+
+        location "/ok" do
+          get { |r| r.ok "ok" }
+        end
+      end
+    ) do
+      # Route `/one` banned by path
+      res1 = get_resp("/one")
+      assert_equal "403", res1.code
+
+      # Route `/two` banned by header
+      res2 = get_resp("/two", { "X-Bot" => "true" })
+      assert_equal "403", res2.code
+
+      # Route `/ok` untouched
+      res3 = get_resp("/ok")
+      assert_equal "200", res3.code
+
+      # Wait for TTL to expire, confirm unban
+      sleep 0.11
+
+      # `/one` still banned due to path match → re-ban
+      res4 = get_resp("/one")
+      assert_equal "403", res4.code
+
+      # `/two` still banned by header → re-ban
+      res5 = get_resp("/two", { "X-Bot" => "true" })
+      assert_equal "403", res5.code
+    end
+  end
+
+  # 7. Trusted proxy: bans applied based on forwarded IP
+  def test_trusted_proxy_bans_based_on_forwarded_ip
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/flagged"],
+          banned_time_seconds: 0.1,
+          trusted_proxies: {
+            "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          },
+          store_config: "in_memory"
+        get("/flagged") { |r| r.ok "should not see" }
+        get("/okay")    { |r| r.ok "ok" }
+      end
+    ) do
+      # Request with client IP 203.0.113.42 via trusted proxy → triggers ban
+      res1 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "403", res1.code
+
+      # Second request (same IP) still banned
+      res2 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "403", res2.code
+
+      # Different client IP → not banned
+      res3 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.99" })
+      assert_equal "403", res3.code  # path still matches; gets banned
+
+      # Wait for first ban to expire
+      sleep 0.11
+      res4 = get_resp("/okay", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "200", res4.code
+    end
+  end
+
+  # 8. Untrusted proxy: forwarded IP ignored; ban keyed by socket IP
+  def test_untrusted_proxy_ignores_forwarded_ip
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/banned"],
+          banned_time_seconds: 0.1,
+          trusted_proxies: {
+            "10.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          },
+          store_config: "in_memory"
+        get("/banned") { |r| r.ok "nope" }
+      end
+    ) do
+      # This header is ignored (sender IP is not trusted)
+      res1 = get_resp("/banned", { "X-Forwarded-For" => "198.51.100.7" })
+      assert_equal "403", res1.code
+
+      # Banned again based on socket IP, not spoofed one
+      res2 = get_resp("/banned", { "X-Forwarded-For" => "198.51.100.99" })
+      assert_equal "403", res2.code
+    end
+  end
+end