@better-auth/core 1.5.7-beta.1 → 1.6.0

package/src/utils/ip.test.ts

@@ -1,255 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createRateLimitKey, isValidIP, normalizeIP } from "./ip";
-
-describe("IP Normalization", () => {
-	describe("isValidIP", () => {
-		it("should validate IPv4 addresses", () => {
-			expect(isValidIP("192.168.1.1")).toBe(true);
-			expect(isValidIP("127.0.0.1")).toBe(true);
-			expect(isValidIP("0.0.0.0")).toBe(true);
-			expect(isValidIP("255.255.255.255")).toBe(true);
-		});
-
-		it("should validate IPv6 addresses", () => {
-			expect(isValidIP("2001:db8::1")).toBe(true);
-			expect(isValidIP("::1")).toBe(true);
-			expect(isValidIP("::")).toBe(true);
-			expect(isValidIP("2001:0db8:0000:0000:0000:0000:0000:0001")).toBe(true);
-		});
-
-		it("should reject invalid IPs", () => {
-			expect(isValidIP("not-an-ip")).toBe(false);
-			expect(isValidIP("999.999.999.999")).toBe(false);
-			expect(isValidIP("gggg::1")).toBe(false);
-		});
-	});
-
-	describe("IPv4 Normalization", () => {
-		it("should return IPv4 addresses unchanged", () => {
-			expect(normalizeIP("192.168.1.1")).toBe("192.168.1.1");
-			expect(normalizeIP("127.0.0.1")).toBe("127.0.0.1");
-			expect(normalizeIP("10.0.0.1")).toBe("10.0.0.1");
-		});
-	});
-
-	describe("IPv6 Normalization", () => {
-		it("should normalize compressed IPv6 to full form", () => {
-			expect(normalizeIP("2001:db8::1", { ipv6Subnet: 128 })).toBe(
-				"2001:0db8:0000:0000:0000:0000:0000:0001",
-			);
-			expect(normalizeIP("::1", { ipv6Subnet: 128 })).toBe(
-				"0000:0000:0000:0000:0000:0000:0000:0001",
-			);
-			expect(normalizeIP("::", { ipv6Subnet: 128 })).toBe(
-				"0000:0000:0000:0000:0000:0000:0000:0000",
-			);
-		});
-
-		it("should normalize uppercase to lowercase", () => {
-			expect(normalizeIP("2001:DB8::1", { ipv6Subnet: 128 })).toBe(
-				"2001:0db8:0000:0000:0000:0000:0000:0001",
-			);
-			expect(normalizeIP("2001:0DB8:ABCD:EF00::1", { ipv6Subnet: 128 })).toBe(
-				"2001:0db8:abcd:ef00:0000:0000:0000:0001",
-			);
-		});
-
-		it("should handle various IPv6 formats consistently", () => {
-			// All these represent the same address
-			const normalized = "2001:0db8:0000:0000:0000:0000:0000:0001";
-			expect(normalizeIP("2001:db8::1", { ipv6Subnet: 128 })).toBe(normalized);
-			expect(normalizeIP("2001:0db8:0:0:0:0:0:1", { ipv6Subnet: 128 })).toBe(
-				normalized,
-			);
-			expect(normalizeIP("2001:db8:0::1", { ipv6Subnet: 128 })).toBe(
-				normalized,
-			);
-			expect(normalizeIP("2001:0db8::0:0:0:1", { ipv6Subnet: 128 })).toBe(
-				normalized,
-			);
-		});
-
-		it("should handle IPv6 with :: at different positions", () => {
-			expect(
-				normalizeIP("2001:db8:85a3::8a2e:370:7334", { ipv6Subnet: 128 }),
-			).toBe("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
-			expect(normalizeIP("::ffff:192.0.2.1")).not.toContain("::");
-		});
-	});
-
-	describe("IPv4-mapped IPv6 Conversion", () => {
-		it("should convert IPv4-mapped IPv6 to IPv4", () => {
-			expect(normalizeIP("::ffff:192.0.2.1")).toBe("192.0.2.1");
-			expect(normalizeIP("::ffff:127.0.0.1")).toBe("127.0.0.1");
-			expect(normalizeIP("::FFFF:10.0.0.1")).toBe("10.0.0.1");
-		});
-
-		it("should handle hex-encoded IPv4 in mapped addresses", () => {
-			// ::ffff:c000:0201 = ::ffff:192.0.2.1 = 192.0.2.1
-			expect(normalizeIP("::ffff:c000:0201")).toBe("192.0.2.1");
-			// ::ffff:7f00:0001 = ::ffff:127.0.0.1 = 127.0.0.1
-			expect(normalizeIP("::ffff:7f00:0001")).toBe("127.0.0.1");
-		});
-
-		it("should handle full form IPv4-mapped IPv6", () => {
-			expect(normalizeIP("0:0:0:0:0:ffff:192.0.2.1")).toBe("192.0.2.1");
-		});
-	});
-
-	describe("IPv6 Subnet Support", () => {
-		it("should extract /64 subnet", () => {
-			/* cspell:disable-next-line */
-			const ip1 = normalizeIP("2001:db8:0:0:1234:5678:90ab:cdef", {
-				ipv6Subnet: 64,
-			});
-			const ip2 = normalizeIP("2001:db8:0:0:ffff:ffff:ffff:ffff", {
-				ipv6Subnet: 64,
-			});
-			// Both should have same /64 prefix
-			expect(ip1).toBe("2001:0db8:0000:0000:0000:0000:0000:0000");
-			expect(ip2).toBe("2001:0db8:0000:0000:0000:0000:0000:0000");
-			expect(ip1).toBe(ip2);
-		});
-
-		it("should extract /48 subnet", () => {
-			/* cspell:disable-next-line */
-			const ip1 = normalizeIP("2001:db8:1234:5678:90ab:cdef:1234:5678", {
-				ipv6Subnet: 48,
-			});
-			const ip2 = normalizeIP("2001:db8:1234:ffff:ffff:ffff:ffff:ffff", {
-				ipv6Subnet: 48,
-			});
-			// Both should have same /48 prefix
-			expect(ip1).toBe("2001:0db8:1234:0000:0000:0000:0000:0000");
-			expect(ip2).toBe("2001:0db8:1234:0000:0000:0000:0000:0000");
-			expect(ip1).toBe(ip2);
-		});
-
-		it("should extract /32 subnet", () => {
-			/* cspell:disable-next-line */
-			const ip1 = normalizeIP("2001:db8:1234:5678:90ab:cdef:1234:5678", {
-				ipv6Subnet: 32,
-			});
-			const ip2 = normalizeIP("2001:db8:ffff:ffff:ffff:ffff:ffff:ffff", {
-				ipv6Subnet: 32,
-			});
-			// Both should have same /32 prefix
-			expect(ip1).toBe("2001:0db8:0000:0000:0000:0000:0000:0000");
-			expect(ip2).toBe("2001:0db8:0000:0000:0000:0000:0000:0000");
-			expect(ip1).toBe(ip2);
-		});
-
-		it("should handle /64 subnet by default", () => {
-			const ip1 = normalizeIP("2001:db8::1");
-			const ip2 = normalizeIP("2001:db8::1", { ipv6Subnet: 64 });
-			expect(ip1).toBe(ip2);
-			expect(ip1).toBe("2001:0db8:0000:0000:0000:0000:0000:0000");
-		});
-
-		it("should not affect IPv4 addresses when ipv6Subnet is set", () => {
-			expect(normalizeIP("192.168.1.1", { ipv6Subnet: 64 })).toBe(
-				"192.168.1.1",
-			);
-		});
-	});
-
-	describe("Rate Limit Key Creation", () => {
-		it("should create keys with separator", () => {
-			expect(createRateLimitKey("192.168.1.1", "/sign-in")).toBe(
-				"192.168.1.1|/sign-in",
-			);
-			expect(createRateLimitKey("2001:db8::1", "/api/auth")).toBe(
-				"2001:db8::1|/api/auth",
-			);
-		});
-
-		it("should prevent collision attacks", () => {
-			// Without separator: "192.0.2.1" + "/sign-in" = "192.0.2.1/sign-in"
-			//                    "192.0.2" + ".1/sign-in" = "192.0.2.1/sign-in"
-			// With separator: they're different
-			const key1 = createRateLimitKey("192.0.2.1", "/sign-in");
-			const key2 = createRateLimitKey("192.0.2", ".1/sign-in");
-			expect(key1).not.toBe(key2);
-			expect(key1).toBe("192.0.2.1|/sign-in");
-			expect(key2).toBe("192.0.2|.1/sign-in");
-		});
-	});
-
-	describe("Security: Bypass Prevention", () => {
-		it("should prevent IPv6 representation bypass", () => {
-			// Attacker tries different representations of same address
-			const representations = [
-				"2001:db8::1",
-				"2001:DB8::1",
-				"2001:0db8::1",
-				"2001:db8:0::1",
-				"2001:0db8:0:0:0:0:0:1",
-				"2001:db8::0:1",
-			];
-
-			const normalized = representations.map((ip) =>
-				normalizeIP(ip, { ipv6Subnet: 128 }),
-			);
-			// All should normalize to the same value
-			const uniqueValues = new Set(normalized);
-			expect(uniqueValues.size).toBe(1);
-			expect(normalized[0]).toBe("2001:0db8:0000:0000:0000:0000:0000:0001");
-		});
-
-		it("should prevent IPv4-mapped bypass", () => {
-			// Attacker switches between IPv4 and IPv4-mapped IPv6
-			const ip1 = normalizeIP("192.0.2.1");
-			const ip2 = normalizeIP("::ffff:192.0.2.1");
-			const ip3 = normalizeIP("::FFFF:192.0.2.1");
-			const ip4 = normalizeIP("::ffff:c000:0201");
-
-			// All should normalize to the same IPv4
-			expect(ip1).toBe("192.0.2.1");
-			expect(ip2).toBe("192.0.2.1");
-			expect(ip3).toBe("192.0.2.1");
-			expect(ip4).toBe("192.0.2.1");
-		});
-
-		it("should group IPv6 subnet attacks", () => {
-			// Attacker rotates through addresses in their /64 allocation
-			const attackIPs = [
-				"2001:db8:abcd:1234:0000:0000:0000:0001",
-				"2001:db8:abcd:1234:1111:2222:3333:4444",
-				"2001:db8:abcd:1234:ffff:ffff:ffff:ffff",
-				"2001:db8:abcd:1234:aaaa:bbbb:cccc:dddd",
-			];
-
-			const normalized = attackIPs.map((ip) =>
-				normalizeIP(ip, { ipv6Subnet: 64 }),
-			);
-
-			// All should map to same /64 subnet
-			const uniqueValues = new Set(normalized);
-			expect(uniqueValues.size).toBe(1);
-			expect(normalized[0]).toBe("2001:0db8:abcd:1234:0000:0000:0000:0000");
-		});
-	});
-
-	describe("Edge Cases", () => {
-		it("should handle localhost addresses", () => {
-			expect(normalizeIP("127.0.0.1")).toBe("127.0.0.1");
-			expect(normalizeIP("::1", { ipv6Subnet: 128 })).toBe(
-				"0000:0000:0000:0000:0000:0000:0000:0001",
-			);
-		});
-
-		it("should handle all-zeros address", () => {
-			expect(normalizeIP("0.0.0.0")).toBe("0.0.0.0");
-			expect(normalizeIP("::", { ipv6Subnet: 128 })).toBe(
-				"0000:0000:0000:0000:0000:0000:0000:0000",
-			);
-		});
-
-		it("should handle link-local addresses", () => {
-			expect(normalizeIP("169.254.0.1")).toBe("169.254.0.1");
-			expect(normalizeIP("fe80::1", { ipv6Subnet: 128 })).toBe(
-				"fe80:0000:0000:0000:0000:0000:0000:0001",
-			);
-		});
-	});
-});