itsi 0.1.20 → 0.2.2

data/gems/server/test/middleware/grpc/test_service_impl.rb

@@ -0,0 +1,28 @@
+require_relative 'test_service_services_pb'  # generated by grpc_tools_ruby_protoc
+
+class TestServiceImpl < Test::TestService::Service
+  # Unary: echo back the message  [oai_citation_attribution:2‡Gustavo Caso](https://gustavocaso.dev/posts/grpc-tutorial-with-ruby/)
+  def unary_echo(req, _unused_call)
+    Test::EchoResponse.new(message: req.message)
+  end
+
+  # Client‑streaming: collect all incoming messages into one response  [oai_citation_attribution:3‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def client_stream(stream, _call)
+    msgs = stream.map(&:message)
+    Test::StreamResponse.new(messages: msgs)
+  end
+
+  # Server‑streaming: send back one StreamResponse per incoming request, with each char  [oai_citation_attribution:4‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def server_stream(req, _call)
+    Enumerator.new do |y|
+      req.message.each_char { |c| y << Test::StreamResponse.new(messages: [c]) }
+    end
+  end
+
+  # Bidirectional: for each incoming EchoRequest, immediately echo it back  [oai_citation_attribution:5‡Medium](https://alessiobussolari.medium.com/integrating-grpc-with-ruby-on-rails-2b2a203107d5?utm_source=chatgpt.com)
+  def bidi_stream(stream, _call)
+    Enumerator.new do |y|
+      stream.each { |req| y << Test::EchoResponse.new(message: req.message.upcase) }
+    end
+  end
+end

data/gems/server/test/middleware/grpc/test_service_pb.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: test_service.proto
+
+require 'google/protobuf'
+
+
+descriptor_data = "\n\x12test_service.proto\x12\x04test\"\x1e\n\x0b\x45\x63hoRequest\x12\x0f\n\x07message\x18\x01 \x01(\t\"\x1f\n\x0c\x45\x63hoResponse\x12\x0f\n\x07message\x18\x01 \x01(\t\" \n\rStreamRequest\x12\x0f\n\x07message\x18\x01 \x01(\t\"\"\n\x0eStreamResponse\x12\x10\n\x08messages\x18\x01 \x03(\t2\xfa\x01\n\x0bTestService\x12\x34\n\tUnaryEcho\x12\x11.test.EchoRequest\x1a\x12.test.EchoResponse\"\x00\x12=\n\x0c\x43lientStream\x12\x13.test.StreamRequest\x1a\x14.test.StreamResponse\"\x00(\x01\x12;\n\x0cServerStream\x12\x11.test.EchoRequest\x1a\x14.test.StreamResponse\"\x00\x30\x01\x12\x39\n\nBidiStream\x12\x11.test.EchoRequest\x1a\x12.test.EchoResponse\"\x00(\x01\x30\x01\x62\x06proto3"
+
+pool = Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Test
+  EchoRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.EchoRequest").msgclass
+  EchoResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.EchoResponse").msgclass
+  StreamRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.StreamRequest").msgclass
+  StreamResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("test.StreamResponse").msgclass
+end

data/gems/server/test/middleware/grpc/test_service_services_pb.rb

@@ -0,0 +1,30 @@
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# Source: test_service.proto for package 'test'
+
+require 'grpc'
+require_relative 'test_service_pb'
+
+module Test
+  module TestService
+    # A service with one of each RPC type  [oai_citation_attribution:0‡Википедия — свободная энциклопедия](https://ru.wikipedia.org/wiki/GRPC?utm_source=chatgpt.com)
+    class Service
+
+      include ::GRPC::GenericService
+
+      self.marshal_class_method = :encode
+      self.unmarshal_class_method = :decode
+      self.service_name = 'test.TestService'
+
+      # Unary RPC
+      rpc :UnaryEcho, ::Test::EchoRequest, ::Test::EchoResponse
+      # Client‑streaming RPC
+      rpc :ClientStream, stream(::Test::StreamRequest), ::Test::StreamResponse
+      # Server‑streaming RPC
+      rpc :ServerStream, ::Test::EchoRequest, stream(::Test::StreamResponse)
+      # Bidirectional streaming RPC
+      rpc :BidiStream, stream(::Test::EchoRequest), stream(::Test::EchoResponse)
+    end
+
+    Stub = Service.rpc_stub_class
+  end
+end

data/gems/server/test/middleware/header_interpolation.rb

@@ -0,0 +1,35 @@
+class TestHeaderInterpolation < Minitest::Test
+  def test_request_header_interpolation_and_response_header_interpolation
+    server(
+      itsi_rb: lambda do
+        # 1) Echo back incoming header "X-Auth-User" in a new request header "X-User"
+        request_headers \
+          additions: { "X-User" => ["{X-Auth-User}"] },
+          removals:  []
+
+        # 2) After the handler runs, take the request‑echoed "X-User" and also echo it into "X-User-Echo" in the response
+        response_headers \
+          additions: { "X-User-Echo" => ["{X-User}"] },
+          removals:  []
+
+        get("/echo") do |r|
+          # Return the value of the new X-User header in the body for verification
+          r.ok("Hello #{r.header("X-User").first}", headers: {"X-User" => [r.header("X-User").first]})
+        end
+      end
+    ) do
+      # Simulate a client sending X-Auth-User: alice
+      req_headers = { "X-Auth-User" => "alice" }
+
+      res = get_resp("/echo", req_headers)
+      assert_equal "200", res.code
+
+      # The request middleware should have created X-User == "alice",
+      # and the handler returned it in the body:
+      assert_equal "Hello alice", res.body
+
+      # The response middleware should have added X-User-Echo == "alice"
+      assert_equal "alice", res["X-User-Echo"]
+    end
+  end
+end

data/gems/server/test/middleware/intrusion_protection.rb

@@ -0,0 +1,259 @@
+require_relative "../helpers/test_helper"
+require "redis"
+
+class TestIntrusionProtection < Minitest::Test
+
+  # 1. Banned URL pattern causes immediate ban + 403
+  def test_banned_url_pattern
+    server(
+      itsi_rb: lambda do
+        location "/secret" do
+          intrusion_protection \
+            banned_url_patterns: ["/secret"],
+            banned_time_seconds: 0.1,
+            store_config: { redis: { connection_url: "redis://localhost:6379/14" } }
+          get { |r| r.ok "never" }
+        end
+        location "/public" do
+          get { |r| r.ok "public" }
+        end
+      end
+    ) do
+
+      # First request: matched → banned + forbidden
+      res1 = get_resp("/secret")
+      assert_equal "403", res1.code
+
+      # Immediately banned: second request also forbidden
+      res2 = get_resp("/secret")
+      assert_equal "403", res2.code
+
+      # After ban TTL expires
+      sleep 0.11
+
+      res3 = get_resp("/public")
+      assert_equal "200", res3.code
+      res4 = get_resp("/secret")
+      assert_equal "403", res4.code
+    end
+  end
+
+  # 2. Banned header pattern causes ban + 403
+  def test_banned_header_pattern
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_header_patterns: { "User-Agent" => ["BadBot"] },
+          banned_time_seconds: 0.1,
+          store_config: "in_memory"
+        get("/hi") { |r| r.ok "hi" }
+      end
+    ) do
+      # First: header matches → banned
+      res1 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res1.code
+
+      # Still banned until TTL
+      res2 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res2.code
+
+      sleep 0.11
+      # After TTL, banned set clears; header still matches → ban again
+      res3 = get_resp("/hi", { "User-Agent" => "MyBadBot/1.0" })
+      assert_equal "403", res3.code
+    end
+  end
+
+  # 3. Clean traffic passes through
+  def test_clean_traffic
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: [".*\\.php$"],
+          banned_header_patterns: { "X-Test" => ["evil"] },
+          banned_time_seconds: 0.1,
+          store_config: { redis: { connection_url: "redis://localhost:6379/13" } }
+        get("/hello") { |r| r.ok "world" }
+      end
+    ) do
+      # Non‑matching URL & header → allowed
+      res = get_resp("/hello", { "User-Agent" => "Mozilla/5.0" })
+      assert_equal "200", res.code
+      assert_equal "world", res.body
+    end
+  end
+
+  # 4. Custom error_response
+  def test_custom_error_response
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/bad"],
+          banned_header_patterns: {},
+          banned_time_seconds: 5,
+          store_config: "in_memory",
+          error_response: {
+            code: 401,
+            plaintext: { inline: "Halt!" },
+            default: "plaintext"
+          }
+        get("/bad") { |r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/bad")
+      assert_equal "401", res.code
+      assert_equal "Halt!", res.body
+    end
+  end
+
+  # 5. Intrusion protection middleware stacks (nested: parent + child)
+  def test_nested_intrusion_protection_stacking
+    server(
+      itsi_rb: lambda do
+        location "/protected" do
+          intrusion_protection \
+            banned_url_patterns: ["/nested"],
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+
+          location "/nested" do
+            intrusion_protection \
+              banned_header_patterns: { "X-Evil" => ["1"] },
+              banned_time_seconds: 0.1,
+              store_config: "in_memory"
+            get { |r| r.ok "should not see this" }
+          end
+
+          get { |r| r.ok "Should also not see this" }
+        end
+        location "/public" do
+          get { |r| r.ok "safe" }
+        end
+      end
+    ) do
+      # 1. Triggers child (header) rule → ban
+      res1 = get_resp("protected/nested", { "X-Evil" => "1" })
+      assert_equal "403", res1.code
+
+      sleep 0.11
+
+      # 3. Triggers parent (path) rule → ban
+      res3 = get_resp("protected/nested")
+      assert_equal "403", res3.code
+
+      sleep 0.11
+
+      # 4. Confirm public route works
+      res4 = get_resp("/public")
+      assert_equal "200", res4.code
+    end
+  end
+
+  # 6. Sibling intrusion protection rules stack independently
+  def test_sibling_intrusion_protection_stacking
+    server(
+      itsi_rb: lambda do
+        location "/one" do
+          intrusion_protection \
+            banned_url_patterns: ["/one"],
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+          get { |r| r.ok "never" }
+        end
+
+        location "/two" do
+          intrusion_protection \
+            banned_header_patterns: { "X-Bot" => ["true"] },
+            banned_time_seconds: 0.1,
+            store_config: "in_memory"
+          get { |r| r.ok "never" }
+        end
+
+        location "/ok" do
+          get { |r| r.ok "ok" }
+        end
+      end
+    ) do
+      # Route `/one` banned by path
+      res1 = get_resp("/one")
+      assert_equal "403", res1.code
+
+      # Route `/two` banned by header
+      res2 = get_resp("/two", { "X-Bot" => "true" })
+      assert_equal "403", res2.code
+
+      # Route `/ok` untouched
+      res3 = get_resp("/ok")
+      assert_equal "200", res3.code
+
+      # Wait for TTL to expire, confirm unban
+      sleep 0.11
+
+      # `/one` still banned due to path match → re-ban
+      res4 = get_resp("/one")
+      assert_equal "403", res4.code
+
+      # `/two` still banned by header → re-ban
+      res5 = get_resp("/two", { "X-Bot" => "true" })
+      assert_equal "403", res5.code
+    end
+  end
+
+  # 7. Trusted proxy: bans applied based on forwarded IP
+  def test_trusted_proxy_bans_based_on_forwarded_ip
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/flagged"],
+          banned_time_seconds: 0.1,
+          trusted_proxies: {
+            "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          },
+          store_config: "in_memory"
+        get("/flagged") { |r| r.ok "should not see" }
+        get("/okay")    { |r| r.ok "ok" }
+      end
+    ) do
+      # Request with client IP 203.0.113.42 via trusted proxy → triggers ban
+      res1 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "403", res1.code
+
+      # Second request (same IP) still banned
+      res2 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "403", res2.code
+
+      # Different client IP → not banned
+      res3 = get_resp("/flagged", { "X-Forwarded-For" => "203.0.113.99" })
+      assert_equal "403", res3.code  # path still matches; gets banned
+
+      # Wait for first ban to expire
+      sleep 0.11
+      res4 = get_resp("/okay", { "X-Forwarded-For" => "203.0.113.42" })
+      assert_equal "200", res4.code
+    end
+  end
+
+  # 8. Untrusted proxy: forwarded IP ignored; ban keyed by socket IP
+  def test_untrusted_proxy_ignores_forwarded_ip
+    server(
+      itsi_rb: lambda do
+        intrusion_protection \
+          banned_url_patterns: ["/banned"],
+          banned_time_seconds: 0.1,
+          trusted_proxies: {
+            "10.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          },
+          store_config: "in_memory"
+        get("/banned") { |r| r.ok "nope" }
+      end
+    ) do
+      # This header is ignored (sender IP is not trusted)
+      res1 = get_resp("/banned", { "X-Forwarded-For" => "198.51.100.7" })
+      assert_equal "403", res1.code
+
+      # Banned again based on socket IP, not spoofed one
+      res2 = get_resp("/banned", { "X-Forwarded-For" => "198.51.100.99" })
+      assert_equal "403", res2.code
+    end
+  end
+end

data/gems/server/test/middleware/location.rb

@@ -0,0 +1,220 @@
+require_relative "../helpers/test_helper"
+
+class TestNestedLocation < Minitest::Test
+  # Tests that a nested block takes precedence over its parent block
+  def test_basic_nested_route
+    server(
+      itsi_rb: lambda do
+        # The outer location "/" applies to all routes.
+        location "/" do
+          # A nested location matching "/foo" with its own GET handler.
+          location "/foo" do
+            get("/bar") { |r| r.respond("From nested /foo/bar") }
+          end
+          # This GET handler is only hit if no nested location applies.
+          get("/bar") { |r| r.respond("From root /bar") }
+        end
+      end
+    ) do
+      res_nested = get_resp("/foo/bar")
+      assert_equal "From nested /foo/bar", res_nested.body
+
+      res_root = get_resp("/bar")
+      assert_equal "From root /bar", res_root.body
+    end
+  end
+
+  # Tests deep nesting where dynamic segments are used
+  def test_deeply_nested_route
+    server(
+      itsi_rb: lambda do
+        location "/v1" do
+          location "/users" do
+            # A nested capture for user id.
+            location "/:user_id" do
+              get("/profile") { |r, params| r.respond("User profile for v1/users/#{params[:user_id]}") }
+            end
+          end
+        end
+      end
+    ) do
+      res = get_resp("/v1/users/123/profile")
+      assert_equal "User profile for v1/users/123", res.body
+    end
+  end
+
+  # Tests that ordering of nested location blocks is honored. Only the first matching block should execute.
+  def test_nested_route_ordering
+    server(
+      itsi_rb: lambda do
+        location "/" do
+          location "/alpha" do
+            # This is the first nested match for "/alpha/beta"
+            location "/beta" do
+              get("/gamma") { |r| r.respond("Response from first nested /alpha/beta/gamma") }
+            end
+            # Though this block also matches "/alpha/beta", it should never be reached.
+            location "/beta" do
+              get("/gamma") { |r| r.respond("Response from second nested /alpha/beta/gamma") }
+            end
+          end
+          # This handler is defined on the outer level and is a fallback.
+          get("/alpha/beta/gamma") { |r| r.respond("Response from outer /alpha/beta/gamma") }
+        end
+      end
+    ) do
+      res = get_resp("/alpha/beta/gamma")
+      # According to the recursive matching rules, the first matching child (/alpha then /beta) is used.
+      assert_equal "Response from first nested /alpha/beta/gamma", res.body
+    end
+  end
+
+  # Tests multiple nested levels under a common outer location.
+  def test_multiple_nested_options
+    server(
+      itsi_rb: lambda do
+        location "/api" do
+          get("/status") { |r| r.respond("API Status from /api") }
+          location "/users" do
+            get("/list") { |r| r.respond("User List from /api/users") }
+            location "/:user_id" do
+              get("/details") { |r| r.respond("User Details from /api/users/:user_id") }
+            end
+          end
+        end
+      end
+    ) do
+      res_status = get_resp("/api/status")
+      assert_equal "API Status from /api", res_status.body
+
+      res_list = get_resp("/api/users/list")
+      assert_equal "User List from /api/users", res_list.body
+
+      res_details = get_resp("/api/users/42/details")
+      assert_equal "User Details from /api/users/:user_id", res_details.body
+    end
+  end
+
+  def test_dynamic_vs_wildcard_precedence
+     server(
+       itsi_rb: lambda do
+         location "/products" do
+           # This nested block should match when a numeric id is provided.
+           location "/:id([0-9]+)" do
+             get("/details") { |r| r.respond("Product details for numeric id") }
+           end
+           # Fallback handler for when the numeric match does not occur.
+           get("/details") { |r| r.respond("General product details") }
+         end
+       end
+     ) do
+       res_dynamic = get_resp("/products/123/details")
+       assert_equal "Product details for numeric id", res_dynamic.body
+
+       res_fallback = get_resp("/products/details")
+       assert_equal "General product details", res_fallback.body
+     end
+   end
+
+   # Test deep nesting with multiple dynamic segments (year, month, slug) versus a fallback archive route.
+   def test_multiple_dynamic_segments
+     server(
+       itsi_rb: lambda do
+         location "/blog" do
+           # Nested dynamic segments for a blog post.
+           location "/:year([0-9]{4})" do
+             location "/:month([0-9]{1,2})" do
+               location "/:slug" do
+                 get { |r, params| r.respond("Blog post: #{params[:year]}/#{params[:month]}/#{params[:slug]}") }
+               end
+             end
+           end
+           # Fallback route for blog archive.
+           get("/archive") { |r| r.respond("Blog archive") }
+         end
+       end
+     ) do
+       res_post = get_resp("/blog/2021/9/challenge-post")
+       assert_equal "Blog post: 2021/9/challenge-post", res_post.body
+
+       res_archive = get_resp("/blog/archive")
+       assert_equal "Blog archive", res_archive.body
+     end
+   end
+
+   # Test mixed static and dynamic segments. The static route should override the dynamic one for an exact match.
+   def test_static_vs_dynamic_precedence
+     server(
+       itsi_rb: lambda do
+         location "/dashboard" do
+           # Static route for settings.
+           location "/settings" do
+             get { |r| r.respond("Dashboard settings") }
+           end
+           # Dynamic route for other sections.
+           location "/:section" do
+             get { |r, params| r.respond("Dashboard section: #{params[:section]}") }
+           end
+         end
+       end
+     ) do
+       res_static = get_resp("/dashboard/settings")
+       assert_equal "Dashboard settings", res_static.body
+
+       res_dynamic = get_resp("/dashboard/stats")
+       assert_equal "Dashboard section: stats", res_dynamic.body
+     end
+   end
+
+   # Test overlapping regex-based routing versus a fallback dynamic match.
+   def test_overlapping_regex_and_fallback
+     server(
+       itsi_rb: lambda do
+         location "/files" do
+           # This nested location will match when the filename ends with .txt.
+           location "/:filename([a-z]+\.txt)" do
+             get { |r, params| r.respond("Text file: #{params[:filename]}") }
+           end
+           # Fallback for any file that doesn't match the above regex.
+           location "/:filename" do
+             get { |r, params| r.respond("Other file: #{params[:filename]}") }
+           end
+         end
+       end
+     ) do
+       res_txt = get_resp("/files/readme.txt")
+       assert_equal "Text file: readme.txt", res_txt.body
+
+       res_other = get_resp("/files/readme.pdf")
+       assert_equal "Other file: readme.pdf", res_other.body
+     end
+   end
+
+   # Test a deeper nested structure that mimics a versioned API with sub-resources.
+   def test_complex_nested_structure
+     server(
+       itsi_rb: lambda do
+         location "/api" do
+           location "/v1" do
+             location "/users" do
+               location "/:user_id" do
+                 location "/profile" do
+                   get("/") { |r, params| r.respond("User Profile for #{r.params[:user_id]}") }
+                 end
+                 location "/orders" do
+                   get("/") { |r, params| r.respond("User Orders for #{r.params[:user_id]}") }
+                 end
+               end
+             end
+           end
+         end
+       end
+     ) do
+       res_profile = get_resp("/api/v1/users/42/profile")
+       assert_equal "User Profile for 42", res_profile.body
+
+       res_orders = get_resp("/api/v1/users/42/orders")
+       assert_equal "User Orders for 42", res_orders.body
+     end
+   end
+end

data/gems/server/test/middleware/max_body.rb

@@ -0,0 +1,20 @@
+require_relative "../helpers/test_helper"
+
+class TestMaxBody < Minitest::Test
+  def test_max_body_enforced
+    server(
+      itsi_rb: lambda do
+        max_body limit_bytes: 20
+        post("/") { |r|
+          r.ok "OK"
+        }
+      end
+    ) do
+      small = "a" * 10
+      large = "b" * 100
+
+      assert_equal "200", post("/", small).code
+      assert_equal "413", post("/", large).code
+    end
+  end
+end