@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/auth/login_ip_integration_test.go

@@ -0,0 +1,153 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// loginFrom posts a login as peer ip (TCP address) with each empNo of its own
+// so that the key lock never interferes with the IP window.
+func (e loginEnv) loginFrom(t *testing.T, ip, empNo, pw string, hdr map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	tok, ck := e.csrf(t, nil)
+	req := httptest.NewRequest("POST", "/api/v1/auth/login", strings.NewReader(creds(empNo, pw)))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-CSRF-Token", tok)
+	req.RemoteAddr = ip + ":4000"
+	req.AddCookie(ck)
+	for k, v := range hdr {
+		req.Header.Set(k, v)
+	}
+	return e.do(req)
+}
+
+func (e loginEnv) ipFailures(t *testing.T, ip string) (n int) {
+	t.Helper()
+	if err := e.db.QueryRow(`SELECT COUNT(*) FROM login_attempt WHERE ip = ?`, ip).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+// seed inserts n failures of ip, all age seconds old, without running logins
+// (a real failure costs a bcrypt comparison, ~1 s under -race).
+func (e loginEnv) seed(t *testing.T, ip string, n, ageSeconds int) {
+	t.Helper()
+	for range n {
+		if _, err := e.db.Exec(`INSERT INTO login_attempt (ip, attempted_at) VALUES (?, NOW(6) - INTERVAL ? SECOND)`, ip, ageSeconds); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestLoginIP30thFailureIs401And31stIs429(t *testing.T) {
+	e := newLockEnv(t)
+	e.seed(t, "192.0.2.9", 29, 0)
+	// The 30th failure is a real login: still 401, and it is recorded.
+	if rec := e.loginFrom(t, "192.0.2.9", "100000", wrongPassword, nil); rec.Code != 401 {
+		t.Fatalf("30th: %d %s", rec.Code, rec.Body)
+	}
+	if n := e.ipFailures(t, "192.0.2.9"); n != 30 {
+		t.Fatalf("rows = %d", n)
+	}
+	rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword, nil)
+	if rec.Code != 429 || code(t, rec) != "LOGIN_THROTTLED" {
+		t.Fatalf("31st: %d %s", rec.Code, rec.Body)
+	}
+	if got, _ := strconv.Atoi(rec.Header().Get("Retry-After")); got < 895 || got > 900 {
+		t.Errorf("Retry-After = %q, want ~900", rec.Header().Get("Retry-After"))
+	}
+	// Throttled attempts are not counted, for the IP or the key.
+	if n := e.ipFailures(t, "192.0.2.9"); n != 30 {
+		t.Errorf("rows after throttled attempt = %d", n)
+	}
+	if n, _ := e.lockRow(t, "999999"); n != 0 {
+		t.Errorf("key counted: %d", n)
+	}
+}
+
+func TestLoginIPCorrectPasswordIsThrottledToo(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "ADMIN", true)
+	e.seed(t, "192.0.2.9", 30, 0)
+	if rec := e.loginFrom(t, "192.0.2.9", "123456", password, nil); rec.Code != 429 {
+		t.Fatalf("admin from throttled IP: %d %s", rec.Code, rec.Body)
+	}
+	if rec := e.loginFrom(t, "192.0.2.10", "123456", password, nil); rec.Code != 200 {
+		t.Fatalf("other IP: %d %s", rec.Code, rec.Body)
+	}
+}
+
+func TestLoginIPWindowSlides(t *testing.T) {
+	e := newLockEnv(t)
+	e.seed(t, "192.0.2.9", 1, 14*60) // oldest: leaves the window in ~1 min
+	e.seed(t, "192.0.2.9", 29, 60)
+	rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword, nil)
+	if rec.Code != 429 {
+		t.Fatalf("30 in window: %d", rec.Code)
+	}
+	if got, _ := strconv.Atoi(rec.Header().Get("Retry-After")); got < 50 || got > 61 {
+		t.Errorf("Retry-After = %d, want ~60 (oldest leaves in 1 min)", got)
+	}
+	// Push the oldest out: 29 in the window, so the next attempt is allowed (and counted).
+	if _, err := e.db.Exec(`UPDATE login_attempt SET attempted_at = attempted_at - INTERVAL 2 MINUTE ORDER BY attempted_at LIMIT 1`); err != nil {
+		t.Fatal(err)
+	}
+	if rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword, nil); rec.Code != 401 {
+		t.Fatalf("29 in window: %d %s", rec.Code, rec.Body)
+	}
+	if rec := e.loginFrom(t, "192.0.2.9", "999998", wrongPassword, nil); rec.Code != 429 {
+		t.Fatalf("back to 30: %d", rec.Code)
+	}
+}
+
+// With more than 30 rows the wait is until the 30th newest leaves, not the oldest.
+func TestLoginIPRetryAfterUsesThirtiethNewest(t *testing.T) {
+	e := newLockEnv(t)
+	e.seed(t, "192.0.2.9", 5, 14*60) // five old ones
+	e.seed(t, "192.0.2.9", 30, 10)   // 30 recent: the 30th newest is 10 s old
+	rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword, nil)
+	if got, _ := strconv.Atoi(rec.Header().Get("Retry-After")); rec.Code != 429 || got < 880 || got > 891 {
+		t.Fatalf("%d Retry-After=%q, want ~890", rec.Code, rec.Header().Get("Retry-After"))
+	}
+}
+
+func TestLoginIPLimitIsPerAddress(t *testing.T) {
+	e := newLockEnv(t)
+	e.seed(t, "192.0.2.9", 30, 0)
+	e.seed(t, "2001:db8::1", 5, 0)
+	if rec := e.loginFrom(t, "2001:db8::1", "999999", wrongPassword, nil); rec.Code != 401 {
+		t.Fatalf("other address: %d", rec.Code)
+	}
+}
+
+func TestLoginIPUsesForwardedClientWhenTrusted(t *testing.T) {
+	e := newLockEnv(t)
+	e.h = web.TrustedProxies(1)(e.h)
+	hdr := map[string]string{"X-Forwarded-For": "10.9.9.9, 198.51.100.1"}
+	if rec := e.loginFrom(t, "192.0.2.9", "100000", wrongPassword, hdr); rec.Code != 401 {
+		t.Fatalf("failure: %d", rec.Code)
+	}
+	if n := e.ipFailures(t, "198.51.100.1"); n != 1 || e.ipFailures(t, "192.0.2.9") != 0 || e.ipFailures(t, "10.9.9.9") != 0 {
+		t.Fatalf("failure not recorded for the forwarded client only")
+	}
+	e.seed(t, "198.51.100.1", 29, 0)
+	if rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword, hdr); rec.Code != 429 {
+		t.Fatalf("forwarded client not throttled: %d", rec.Code)
+	}
+	// Changing the spoofable prefix does not help; another proxy peer with another client is free.
+	if rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword,
+		map[string]string{"X-Forwarded-For": "1.1.1.1, 198.51.100.1"}); rec.Code != 429 {
+		t.Fatalf("spoofed prefix: %d", rec.Code)
+	}
+	if rec := e.loginFrom(t, "192.0.2.9", "999999", wrongPassword,
+		map[string]string{"X-Forwarded-For": "198.51.100.2"}); rec.Code != 401 {
+		t.Fatalf("other client: %d", rec.Code)
+	}
+}

package/backend/internal/auth/login_lock_integration_test.go

@@ -0,0 +1,205 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"database/sql"
+	"log/slog"
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+const wrongPassword = "Wrong-Horse-9"
+
+func newLockEnv(t *testing.T) loginEnv {
+	t.Helper()
+	return newLoginEnvWith(t, slog.New(slog.DiscardHandler), func(db *sql.DB) auth.Throttle { return auth.DBThrottle{DB: db} })
+}
+
+func (e loginEnv) fail(t *testing.T, empNo string) {
+	t.Helper()
+	if rec := e.login(t, creds(empNo, wrongPassword)); rec.Code != 401 {
+		t.Fatalf("failure attempt: %d %s", rec.Code, rec.Body)
+	}
+}
+
+func (e loginEnv) lockRow(t *testing.T, key string) (count int, locked bool) {
+	t.Helper()
+	err := e.db.QueryRow(`SELECT fail_count, COALESCE(locked_until > NOW(6), 0) FROM login_lock WHERE lock_key = ?`, key).Scan(&count, &locked)
+	if err == sql.ErrNoRows {
+		return 0, false
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return count, locked
+}
+
+// ageLock moves the key's lock state back by d minutes (time passing, DB clock).
+func (e loginEnv) ageLock(t *testing.T, key string, minutes int) {
+	t.Helper()
+	if _, err := e.db.Exec(`UPDATE login_lock SET last_fail_at = last_fail_at - INTERVAL ? MINUTE,
+		locked_until = locked_until - INTERVAL ? MINUTE WHERE lock_key = ?`, minutes, minutes, key); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoginLockFifthFailureIs401SixthIs429(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	if n, locked := e.lockRow(t, "123456"); n != 5 || !locked {
+		t.Fatalf("after 5th failure: count=%d locked=%v", n, locked)
+	}
+	rec := e.login(t, creds("123456", wrongPassword))
+	if rec.Code != 429 || code(t, rec) != "LOGIN_THROTTLED" {
+		t.Fatalf("6th attempt: %d %s", rec.Code, rec.Body)
+	}
+	if got := rec.Header().Get("Retry-After"); got != "900" && got != "899" {
+		t.Errorf("Retry-After = %q, want ~900", got)
+	}
+}
+
+func TestLoginLockCorrectPasswordDuringLockIs429AndDoesNotExtend(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	e.ageLock(t, "123456", 10) // 5 minutes left
+	var before string
+	if err := e.db.QueryRow(`SELECT locked_until FROM login_lock WHERE lock_key = '123456'`).Scan(&before); err != nil {
+		t.Fatal(err)
+	}
+	for _, pw := range []string{password, wrongPassword} {
+		rec := e.login(t, creds("123456", pw))
+		if rec.Code != 429 {
+			t.Fatalf("during lock with %q: %d %s", pw, rec.Code, rec.Body)
+		}
+		if got := rec.Header().Get("Retry-After"); got != "300" && got != "299" {
+			t.Errorf("Retry-After = %q, want ~300", got)
+		}
+	}
+	var after string
+	if err := e.db.QueryRow(`SELECT locked_until FROM login_lock WHERE lock_key = '123456'`).Scan(&after); err != nil {
+		t.Fatal(err)
+	}
+	if before != after {
+		t.Errorf("lock extended: %s → %s", before, after)
+	}
+	if e.sessions(t) != 0 {
+		t.Error("session opened during lock")
+	}
+}
+
+func TestLoginLockExpiresAfterFifteenMinutes(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	e.ageLock(t, "123456", 16)
+	if rec := e.login(t, creds("123456", password)); rec.Code != 200 {
+		t.Fatalf("after lock expiry: %d %s", rec.Code, rec.Body)
+	}
+	if n, _ := e.lockRow(t, "123456"); n != 0 {
+		t.Errorf("counter not cleared by success: %d", n)
+	}
+}
+
+func TestLoginLockCounterRestartsAfterExpiredLock(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	e.ageLock(t, "123456", 16)
+	e.fail(t, "123456")
+	if n, locked := e.lockRow(t, "123456"); n != 1 || locked {
+		t.Errorf("count=%d locked=%v, want 1 / unlocked", n, locked)
+	}
+}
+
+func TestLoginLockFailuresMustBeConsecutiveWithinWindow(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 4 {
+		e.fail(t, "123456")
+	}
+	e.ageLock(t, "123456", 16) // the 4 failures are stale
+	e.fail(t, "123456")
+	if n, locked := e.lockRow(t, "123456"); n != 1 || locked {
+		t.Errorf("count=%d locked=%v, want 1 / unlocked", n, locked)
+	}
+	// Within the window the count keeps growing.
+	e.ageLock(t, "123456", 14)
+	for range 3 {
+		e.fail(t, "123456")
+	}
+	if n, _ := e.lockRow(t, "123456"); n != 4 {
+		t.Errorf("count = %d, want 4", n)
+	}
+}
+
+func TestLoginLockSuccessClearsCounter(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 4 {
+		e.fail(t, "123456")
+	}
+	if rec := e.login(t, creds("123456", password)); rec.Code != 200 {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	for range 4 {
+		e.fail(t, "123456")
+	}
+	if rec := e.login(t, creds("123456", password)); rec.Code != 200 {
+		t.Fatalf("counter not reset by success: %d %s", rec.Code, rec.Body)
+	}
+}
+
+func TestLoginLockCountsUnknownAndMalformedKeys(t *testing.T) {
+	e := newLockEnv(t)
+	for _, key := range []string{"999999", "not-an-id"} {
+		for range 5 {
+			e.fail(t, key)
+		}
+		if rec := e.login(t, creds(key, wrongPassword)); rec.Code != 429 {
+			t.Errorf("%q: 6th attempt = %d, want 429", key, rec.Code)
+		}
+	}
+}
+
+func TestLoginLockIsPerKeyAndDisabledAccountsCount(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	e.addUser(t, "654321", "USER", false)
+	for range 5 {
+		e.fail(t, "654321") // disabled: same 401, still counted
+	}
+	if rec := e.login(t, creds("654321", password)); rec.Code != 429 {
+		t.Errorf("disabled key: %d", rec.Code)
+	}
+	if rec := e.login(t, creds("123456", password)); rec.Code != 200 {
+		t.Errorf("other key affected: %d %s", rec.Code, rec.Body)
+	}
+}
+
+func TestLoginLockKeyIsNormalised(t *testing.T) {
+	e := newLockEnv(t)
+	long := strings.Repeat("9", 40)
+	for range 5 {
+		e.fail(t, long)
+	}
+	// Same first 32 characters share the key.
+	if rec := e.login(t, creds(strings.Repeat("9", 32)+"x", wrongPassword)); rec.Code != 429 {
+		t.Errorf("cut key: %d", rec.Code)
+	}
+	if n, _ := e.lockRow(t, strings.Repeat("9", 32)); n != 5 {
+		t.Errorf("count = %d, want 5", n)
+	}
+}

package/backend/internal/auth/login_test.go

@@ -66,3 +66,18 @@ func TestComparePassword(t *testing.T) {
 		}
 	}
 }
+
+func TestLockKey(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"123456", "123456"},
+		{"12\x00\n34\t56\x7f", "123456"},
+		{strings.Repeat("a", 40), strings.Repeat("a", 32)},
+		{strings.Repeat("工", 33), strings.Repeat("工", 32)},
+		{"", ""},
+	}
+	for _, tc := range tests {
+		if got := LockKey(tc.in); got != tc.want {
+			t.Errorf("LockKey(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}

package/backend/internal/auth/login_throttle_audit_integration_test.go

@@ -0,0 +1,88 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"strconv"
+	"testing"
+)
+
+func (e loginEnv) throttledRows(t *testing.T) int {
+	t.Helper()
+	n := 0
+	for _, r := range e.audits(t) {
+		if r.Outcome == "THROTTLED" {
+			n++
+		}
+	}
+	return n
+}
+
+// A locked key answers 429 every time but is audited once per lock.
+func TestLoginKeyLockAuditedOncePerWindow(t *testing.T) {
+	e := newLockEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	for i := range 4 {
+		if rec := e.login(t, creds("123456", password)); rec.Code != 429 {
+			t.Fatalf("attempt %d: %d", i, rec.Code)
+		}
+	}
+	if n := e.throttledRows(t); n != 1 {
+		t.Fatalf("THROTTLED rows in one lock = %d, want 1", n)
+	}
+	// Another key is its own window.
+	for range 5 {
+		e.fail(t, "654321")
+	}
+	e.login(t, creds("654321", wrongPassword))
+	if n := e.throttledRows(t); n != 2 {
+		t.Fatalf("THROTTLED rows for two keys = %d, want 2", n)
+	}
+	// After the lock expires and the key locks again, a new window is audited.
+	e.ageLock(t, "123456", 16)
+	if _, err := e.db.Exec(`UPDATE login_throttle_audit SET audited_until = audited_until - INTERVAL 16 MINUTE`); err != nil {
+		t.Fatal(err)
+	}
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	e.login(t, creds("123456", wrongPassword))
+	e.login(t, creds("123456", wrongPassword))
+	if n := e.throttledRows(t); n != 3 {
+		t.Fatalf("THROTTLED rows after second lock = %d, want 3", n)
+	}
+}
+
+// The IP limit is audited once per window too, and a different key from the
+// same address does not add a row.
+func TestLoginIPLimitAuditedOncePerWindow(t *testing.T) {
+	e := newLockEnv(t)
+	e.seed(t, "192.0.2.9", 30, 0)
+	for _, k := range []string{"111111", "222222", "333333"} {
+		if rec := e.loginFrom(t, "192.0.2.9", k, wrongPassword, nil); rec.Code != 429 {
+			t.Fatalf("%s: %d", k, rec.Code)
+		}
+	}
+	if n := e.throttledRows(t); n != 1 {
+		t.Fatalf("THROTTLED rows = %d, want 1", n)
+	}
+}
+
+// Both limits at once: the larger Retry-After, and a new window on either side is audited.
+func TestLoginBothLimitsLargerRetryAfter(t *testing.T) {
+	e := newLockEnv(t)
+	for range 5 {
+		e.fail(t, "123456")
+	}
+	e.seed(t, "192.0.2.9", 30, 10*60) // IP frees in ~5 min, key lock holds ~15 min
+	rec := e.login(t, creds("123456", wrongPassword))
+	if got, _ := strconv.Atoi(rec.Header().Get("Retry-After")); rec.Code != 429 || got < 890 || got > 900 {
+		t.Fatalf("%d Retry-After=%q, want ~900", rec.Code, rec.Header().Get("Retry-After"))
+	}
+	if n := e.throttledRows(t); n != 1 {
+		t.Fatalf("THROTTLED rows = %d, want 1", n)
+	}
+}

package/backend/internal/auth/purge.go

@@ -0,0 +1,93 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+	"time"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+)
+
+// Purge schedule (B1b-07). Expired rows already fail every check, so the purge
+// only bounds table size; a few minutes of delay change nothing.
+const (
+	PurgeInterval = 5 * time.Minute
+	PurgeJitter   = time.Minute
+	purgeBatch    = 1000
+)
+
+// Purger deletes dead rows of the session and throttle tables: expired
+// sessions, login_lock rows without an active lock whose last failure left the
+// window, login_attempt rows outside the IP window and expired
+// login_throttle_audit claims. Each DELETE removes at most Batch rows, so row
+// locks are held briefly, and repeats until a short batch.
+//
+// Every replica runs its own Purger and no leader is elected. That is safe:
+// each condition only matches rows that every reader already ignores, a
+// DELETE of a row that is already gone affects nothing, and two runners on the
+// same rows only wait for each other's row locks. A deadlock or lock-wait
+// timeout ends that table's turn without an error; the next run continues.
+type Purger struct {
+	DB    *sql.DB
+	Log   *slog.Logger
+	Batch int // rows per DELETE; 0 means 1000
+}
+
+// Purge runs one pass over all four tables. The returned error is the first
+// non-contention database error; the remaining tables are still purged.
+func (p Purger) Purge(ctx context.Context) error {
+	batch := p.Batch
+	if batch <= 0 {
+		batch = purgeBatch
+	}
+	tables := []struct {
+		name string
+		del  func(context.Context, *sql.DB, int) (int64, error)
+	}{
+		{"session", func(c context.Context, d *sql.DB, n int) (int64, error) { return store.DeleteExpired(c, d, limits, n) }},
+		{"login_lock", func(c context.Context, d *sql.DB, n int) (int64, error) {
+			return store.DeleteStaleLocks(c, d, lockPolicy, n)
+		}},
+		{"login_attempt", func(c context.Context, d *sql.DB, n int) (int64, error) {
+			return store.DeleteOldAttempts(c, d, ipPolicy, n)
+		}},
+		{"login_throttle_audit", store.DeleteExpiredThrottleAudits},
+	}
+	var first error
+	for _, t := range tables {
+		n, err := drain(ctx, p.DB, batch, t.del)
+		if ctx.Err() != nil {
+			return ctx.Err() // shutdown; not a failure
+		}
+		switch {
+		case err != nil && db.IsContention(err):
+			p.Log.Info("purge yielded to another runner", "table", t.name, "deleted", n)
+		case err != nil:
+			p.Log.Warn("purge failed", "table", t.name, "deleted", n, "error", err.Error())
+			if first == nil {
+				first = err
+			}
+		case n > 0:
+			p.Log.Info("purged", "table", t.name, "deleted", n)
+		}
+	}
+	return first
+}
+
+// drain repeats del until it deletes fewer than batch rows and returns the
+// total.
+func drain(ctx context.Context, d *sql.DB, batch int, del func(context.Context, *sql.DB, int) (int64, error)) (int64, error) {
+	var total int64
+	for {
+		n, err := del(ctx, d, batch)
+		total += n
+		if err != nil || n < int64(batch) {
+			return total, err
+		}
+		if err := ctx.Err(); err != nil {
+			return total, err
+		}
+	}
+}