@oneuptime/common 12.0.7 → 12.0.9

package/Tests/Server/Services/InventoryItemManualCreate.test.ts

@@ -0,0 +1,248 @@
+import InventoryItem from "../../../Models/DatabaseModels/InventoryItem";
+import InventoryItemService from "../../../Server/Services/InventoryItemService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import ObjectID from "../../../Types/ObjectID";
+import EntitySource from "../../../Types/Telemetry/EntitySource";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { keyForManualEntity } from "../../../Utils/Telemetry/EntityKey";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * InventoryItemService.onBeforeCreate is the whole of the manual-CI
+ * write path: it is what decides a create is manual, validates it, and
+ * derives the identity the registry needs from the two fields a human can
+ * supply. It also has to leave machine creates — ingest and the inventory
+ * mirror, which arrive with their keys already computed — completely alone.
+ *
+ * Every assertion below is one of those two duties.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "0f8b9c0d-e1a2-4b3c-8d5e-6f7a8b9c0d1e",
+);
+
+type CallCreate = (createBy: CreateBy<InventoryItem>) => Promise<unknown>;
+
+const callOnBeforeCreate: CallCreate = (
+  createBy: CreateBy<InventoryItem>,
+): Promise<unknown> => {
+  return (
+    InventoryItemService as unknown as {
+      onBeforeCreate: (c: CreateBy<InventoryItem>) => Promise<unknown>;
+    }
+  ).onBeforeCreate(createBy);
+};
+
+/*
+ * Explicitly admits `undefined` per field. The suite needs to build creates
+ * with a field genuinely absent (that is what the validation tests are), and
+ * `Partial<InventoryItem>` rejects an explicit undefined under this
+ * project's `exactOptionalPropertyTypes`.
+ */
+interface ManualCreateOverrides {
+  projectId?: ObjectID | undefined;
+  entityType?: EntityType | undefined;
+  displayName?: string | undefined;
+  description?: string | undefined;
+}
+
+function manualCreate(
+  overrides: ManualCreateOverrides = {},
+): CreateBy<InventoryItem> {
+  const data: InventoryItem = new InventoryItem();
+  data.projectId = PROJECT_ID;
+  data.entityType = EntityType.ExternalService;
+  data.displayName = "Stripe Payments API";
+  Object.assign(data, overrides);
+
+  return { data, props: { isRoot: true } } as CreateBy<InventoryItem>;
+}
+
+describe("manual entity creation", () => {
+  test("a create with no entity key is treated as manual", async () => {
+    const createBy: CreateBy<InventoryItem> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.source).toBe(EntitySource.Manual);
+  });
+
+  test("derives the entity key from project, type and name", async () => {
+    const createBy: CreateBy<InventoryItem> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe(
+      keyForManualEntity(
+        PROJECT_ID.toString(),
+        EntityType.ExternalService,
+        "Stripe Payments API",
+      ),
+    );
+  });
+
+  test("records the canonicalized name as the identifying attribute", async () => {
+    const createBy: CreateBy<InventoryItem> = manualCreate({
+      displayName: "  Stripe Payments API  ",
+    });
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.identifyingAttributes).toEqual({
+      "oneuptime.entity.name": "stripe payments api",
+    });
+  });
+
+  test("trims the stored display name but keeps its original casing", async () => {
+    const createBy: CreateBy<InventoryItem> = manualCreate({
+      displayName: "  Stripe Payments API  ",
+    });
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.displayName).toBe("Stripe Payments API");
+  });
+
+  test("two names differing only by case resolve to one identity", async () => {
+    const first: CreateBy<InventoryItem> = manualCreate({
+      displayName: "Stripe API",
+    });
+    const second: CreateBy<InventoryItem> = manualCreate({
+      displayName: "stripe api",
+    });
+
+    await callOnBeforeCreate(first);
+    await callOnBeforeCreate(second);
+
+    /*
+     * The unique index on (projectId, entityType, entityKey) then rejects
+     * the second as a duplicate rather than admitting a near-identical row.
+     */
+    expect(second.data.entityKey).toBe(first.data.entityKey);
+  });
+
+  test("stamps first and last seen so the row sorts with the rest", async () => {
+    const createBy: CreateBy<InventoryItem> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.firstSeenAt).toBeInstanceOf(Date);
+    expect(createBy.data.lastSeenAt).toBeInstanceOf(Date);
+  });
+
+  test("accepts every manually creatable type", async () => {
+    for (const entityType of [
+      EntityType.ExternalService,
+      EntityType.ExternalDatabase,
+      EntityType.Appliance,
+    ]) {
+      const createBy: CreateBy<InventoryItem> = manualCreate({ entityType });
+      await callOnBeforeCreate(createBy);
+
+      expect(createBy.data.entityType).toBe(entityType);
+      expect(createBy.data.entityKey).toBeTruthy();
+    }
+  });
+});
+
+describe("manual entity validation", () => {
+  test("rejects a type that OneUptime discovers on its own", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ entityType: EntityType.Service })),
+    ).rejects.toThrow(/cannot be created manually/);
+  });
+
+  test("rejects an inventory-mirrored type", async () => {
+    /*
+     * These arrive from the mirror with a precomputed key; a hand-made one
+     * would be a permanent duplicate of the row the mirror maintains.
+     */
+    await expect(
+      callOnBeforeCreate(
+        manualCreate({ entityType: EntityType.NetworkDevice }),
+      ),
+    ).rejects.toThrow(/cannot be created manually/);
+  });
+
+  test("rejects a missing name", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ displayName: undefined })),
+    ).rejects.toThrow(/Name is required/);
+  });
+
+  test("rejects a whitespace-only name", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ displayName: "   " })),
+    ).rejects.toThrow(/Name is required/);
+  });
+
+  test("rejects a missing entity type", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ entityType: undefined })),
+    ).rejects.toThrow(/Entity Type is required/);
+  });
+
+  test("rejects a missing project", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ projectId: undefined })),
+    ).rejects.toThrow(/Project ID is required/);
+  });
+});
+
+describe("machine creates are left alone", () => {
+  test("a discovered create keeps its precomputed key and source", async () => {
+    const data: InventoryItem = new InventoryItem();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.KubernetesPod;
+    data.entityKey = "210dac24142f1baa";
+    data.source = EntitySource.Discovered;
+    data.displayName = "checkout-7d9f";
+    data.identifyingAttributes = { "k8s.pod.name": "checkout-7d9f" };
+
+    const createBy: CreateBy<InventoryItem> = {
+      data,
+      props: { isRoot: true },
+    } as CreateBy<InventoryItem>;
+
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe("210dac24142f1baa");
+    expect(createBy.data.source).toBe(EntitySource.Discovered);
+    expect(createBy.data.identifyingAttributes).toEqual({
+      "k8s.pod.name": "checkout-7d9f",
+    });
+  });
+
+  test("a discovered create of an otherwise un-creatable type is not rejected", async () => {
+    /*
+     * The manual-type restriction must apply to users, not to ingest — which
+     * legitimately creates services, pods and hosts.
+     */
+    const data: InventoryItem = new InventoryItem();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.Service;
+    data.entityKey = "abcdef0123456789";
+    data.source = EntitySource.Discovered;
+
+    await expect(
+      callOnBeforeCreate({
+        data,
+        props: { isRoot: true },
+      } as CreateBy<InventoryItem>),
+    ).resolves.toBeDefined();
+  });
+
+  test("an inventory mirror create keeps its precomputed key and source", async () => {
+    const data: InventoryItem = new InventoryItem();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.NetworkDevice;
+    data.entityKey = "9f8e7d6c5b4a3210";
+    data.source = EntitySource.Inventory;
+    data.displayName = "core-switch-1";
+
+    const createBy: CreateBy<InventoryItem> = {
+      data,
+      props: { isRoot: true },
+    } as CreateBy<InventoryItem>;
+
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe("9f8e7d6c5b4a3210");
+    expect(createBy.data.source).toBe(EntitySource.Inventory);
+  });
+});

package/Tests/Server/Services/IpAllowlistSpoofing.test.ts

@@ -0,0 +1,450 @@
+import Dashboard from "../../../Models/DatabaseModels/Dashboard";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import DashboardService from "../../../Server/Services/DashboardService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import { ExpressRequest } from "../../../Server/Utils/Express";
+import ForbiddenException from "../../../Types/Exception/ForbiddenException";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+/*
+ * The dashboard and status page IP allowlists both read the client address off
+ * the request. Nginx builds X-Forwarded-For with $proxy_add_x_forwarded_for,
+ * which KEEPS what the caller sent and appends the address it saw -- so the
+ * left of that header is written by the caller.
+ *
+ * The bug these tests pin: the services took the whole header, split it, and
+ * asked whether ANY entry was allowlisted. A caller who sent
+ * `X-Forwarded-For: <an allowlisted address>` arrived as
+ * ["<allowlisted>", "<their real address>"], the first entry matched, and the
+ * allowlist was gone. Knowing (or guessing) one allowlisted address was the
+ * whole attack.
+ */
+
+const ALLOWLISTED_IP: string = "203.0.113.7";
+const ALLOWLISTED_RANGE: string = "10.0.0.0/8";
+const ATTACKER_IP: string = "198.51.100.5";
+const ALLOWLIST: string = `${ALLOWLISTED_RANGE}\n${ALLOWLISTED_IP}`;
+
+type BuildRequestFunction = (options?: {
+  forwardedFor?: string | Array<string> | undefined;
+  realIp?: string | undefined;
+  remoteAddress?: string | undefined;
+  ip?: string | undefined;
+  ips?: Array<string> | undefined;
+}) => ExpressRequest;
+
+const buildRequest: BuildRequestFunction = (options?: {
+  forwardedFor?: string | Array<string> | undefined;
+  realIp?: string | undefined;
+  remoteAddress?: string | undefined;
+  ip?: string | undefined;
+  ips?: Array<string> | undefined;
+}): ExpressRequest => {
+  const headers: Record<string, string | Array<string>> = {};
+
+  if (options?.forwardedFor !== undefined) {
+    headers["x-forwarded-for"] = options.forwardedFor;
+  }
+
+  if (options?.realIp !== undefined) {
+    headers["x-real-ip"] = options.realIp;
+  }
+
+  return {
+    params: {},
+    body: {},
+    query: {},
+    cookies: {},
+    headers,
+    socket: { remoteAddress: options?.remoteAddress },
+    ip: options?.ip,
+    ips: options?.ips || [],
+  } as unknown as ExpressRequest;
+};
+
+/*
+ * What our Nginx hands the app for a caller at `peer` who put `spoofed` in
+ * their own X-Forwarded-For.
+ */
+type ForwardedByNginxFunction = (
+  peer: string,
+  spoofed?: string | undefined,
+) => string;
+
+const forwardedByNginx: ForwardedByNginxFunction = (
+  peer: string,
+  spoofed?: string | undefined,
+): string => {
+  return spoofed === undefined ? peer : `${spoofed}, ${peer}`;
+};
+
+describe("dashboard IP allowlist", () => {
+  let dashboardId: ObjectID;
+  let dashboard: Dashboard;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    dashboardId = ObjectID.generate();
+
+    dashboard = new Dashboard();
+    dashboard.id = dashboardId;
+    dashboard.projectId = ObjectID.generate();
+    dashboard.isPublicDashboard = true;
+    dashboard.enableMasterPassword = false;
+    dashboard.ipWhitelist = ALLOWLIST;
+
+    jest
+      .spyOn(DashboardService, "findOneById")
+      .mockResolvedValue(dashboard as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  type CheckAccessFunction = (req: ExpressRequest) => Promise<{
+    hasReadAccess: boolean;
+    error?: unknown;
+  }>;
+
+  const checkAccess: CheckAccessFunction = (req: ExpressRequest) => {
+    return DashboardService.hasReadAccess({ dashboardId, req });
+  };
+
+  describe("refuses a spoofed X-Forwarded-For", () => {
+    it("refuses when the header begins with an allowlisted address", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP, ALLOWLISTED_IP),
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when the header begins with an address inside an allowlisted range", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP, "10.9.9.9"),
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses however many allowlisted addresses are prepended", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: `${ALLOWLISTED_IP}, 10.1.1.1, ${ALLOWLISTED_IP}, 10.2.2.2, ${ATTACKER_IP}`,
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when the allowlisted address is sent as a repeated header", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: [ALLOWLISTED_IP, ATTACKER_IP],
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses a forged X-Real-IP", async () => {
+      /*
+       * X-Real-IP is only trustworthy because our Nginx overwrites it, which
+       * means it says nothing on a request that did not come through it. The
+       * allowlist no longer consults it at all.
+       */
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP),
+            realIp: ALLOWLISTED_IP,
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses a forged req.ips entry", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP),
+            ips: [ALLOWLISTED_IP],
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when the trusted entry is unparseable rather than reading further left", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: `${ALLOWLISTED_IP}, unknown` }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+  });
+
+  describe("still admits legitimate callers", () => {
+    it("admits an allowlisted address that Nginx appended", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ALLOWLISTED_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+
+    it("admits an address inside an allowlisted CIDR range", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx("10.4.5.6") }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("admits an allowlisted caller who also sent a junk X-Forwarded-For of their own", async () => {
+      /*
+       * A legitimate caller behind their own corporate proxy sends a header
+       * we cannot interpret. It sits to the left of the Nginx entry, so it
+       * changes nothing.
+       */
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ALLOWLISTED_IP, "unknown, 10.9.9.9"),
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("admits an allowlisted caller reaching the app directly with no proxy header", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(buildRequest({ remoteAddress: ALLOWLISTED_IP }));
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("admits an allowlisted IPv4 caller reported in IPv4-mapped IPv6 form", async () => {
+      /*
+       * Node reports ::ffff:10.4.5.6 for an IPv4 peer on a dual-stack
+       * listener. Unnormalized it would never match the 10.0.0.0/8 rule.
+       */
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(buildRequest({ remoteAddress: "::ffff:10.4.5.6" }));
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("refuses a non-allowlisted caller", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ATTACKER_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when no address can be established at all", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(buildRequest());
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("skips the check entirely when no allowlist is configured", async () => {
+      delete dashboard.ipWhitelist;
+
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ATTACKER_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+  });
+});
+
+describe("status page IP allowlist", () => {
+  let statusPageId: ObjectID;
+  let statusPage: StatusPage;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    statusPageId = ObjectID.generate();
+
+    statusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.projectId = ObjectID.generate();
+    statusPage.isPublicStatusPage = true;
+    statusPage.enableMasterPassword = false;
+    statusPage.ipWhitelist = ALLOWLIST;
+
+    jest
+      .spyOn(StatusPageService, "findOneById")
+      .mockResolvedValue(statusPage as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  type CheckAccessFunction = (req: ExpressRequest) => Promise<{
+    hasReadAccess: boolean;
+    error?: unknown;
+  }>;
+
+  const checkAccess: CheckAccessFunction = (req: ExpressRequest) => {
+    return StatusPageService.hasReadAccess({ statusPageId, req });
+  };
+
+  describe("refuses a spoofed X-Forwarded-For", () => {
+    it("refuses when the header begins with an allowlisted address", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP, ALLOWLISTED_IP),
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when the header begins with an address inside an allowlisted range", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP, "10.9.9.9"),
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses however many allowlisted addresses are prepended", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: `${ALLOWLISTED_IP}, 10.1.1.1, ${ALLOWLISTED_IP}, ${ATTACKER_IP}`,
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses a forged X-Real-IP", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({
+            forwardedFor: forwardedByNginx(ATTACKER_IP),
+            realIp: ALLOWLISTED_IP,
+          }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when the trusted entry is unparseable rather than reading further left", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: `${ALLOWLISTED_IP}, unknown` }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+  });
+
+  describe("still admits legitimate callers", () => {
+    it("admits an allowlisted address that Nginx appended", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ALLOWLISTED_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+
+    it("admits an address inside an allowlisted CIDR range", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx("10.4.5.6") }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("admits an allowlisted IPv4 caller reported in IPv4-mapped IPv6 form", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(buildRequest({ remoteAddress: "::ffff:10.4.5.6" }));
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+
+    it("refuses a non-allowlisted caller", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ATTACKER_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("refuses when no address can be established at all", async () => {
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(buildRequest());
+
+      expect(result.hasReadAccess).toBe(false);
+      expect(result.error).toBeInstanceOf(ForbiddenException);
+    });
+
+    it("skips the check entirely when no allowlist is configured", async () => {
+      delete statusPage.ipWhitelist;
+
+      const result: { hasReadAccess: boolean; error?: unknown } =
+        await checkAccess(
+          buildRequest({ forwardedFor: forwardedByNginx(ATTACKER_IP) }),
+        );
+
+      expect(result.hasReadAccess).toBe(true);
+    });
+  });
+});