@things-factory/shell 10.1.228 → 10.1.234

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "10.1.228",
+  "version": "10.1.234",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -142,5 +142,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "fc4ede44617418df8701e83b83d177db4142a8f3"
+  "gitHead": "92f29853680fff527a5f1d167ab3ad9b27837ba9"
 }

package/tests/ip-list-rule.test.ts

@@ -0,0 +1,87 @@
+/* The domain is given in state, so the URL lookup is never reached - and importing it drags in every entity. */
+jest.mock('../server/utils/get-domain', () => ({ getDomainFromURL: jest.fn() }))
+
+import { domainMiddleware, REFUSAL_HEADER, REFUSED_ADDRESS } from '../server/middlewares/domain-middleware'
+import { refuseBadIPList } from '../server/middlewares/ip-list-rule'
+
+/**
+ * One IP list entry that is not a regular expression used to throw on every request of the domain - nobody got
+ * in, with a server error. Saving refuses it by list and entry; one already stored is passed over.
+ */
+
+function run(iplist: any, ip: string) {
+  const headers: Record<string, string> = {}
+  const context: any = {
+    state: { domain: { id: 'd1', iplist } },
+    req: { headers: { 'x-client-ip': ip }, connection: {}, socket: {} },
+    status: 200,
+    set: (name: string, value: string) => (headers[name.toLowerCase()] = value)
+  }
+  let passed = false
+  return domainMiddleware(context, async () => {
+    passed = true
+  }).then(() => ({ status: context.status, headers, passed, unsafeIP: context.state.unsafeIP }))
+}
+
+function refusalOf(iplist: any) {
+  try {
+    refuseBadIPList(iplist)
+  } catch (e: any) {
+    return { code: e.code, params: e.params }
+  }
+}
+
+describe('a stored entry that is not a regular expression', () => {
+  it('★ does not break the request: the other whitelist entries still let the address in', async () => {
+    expect(await run({ whitelist: ['10.0.0.[', '^10\\.'] }, '10.0.0.1')).toMatchObject({ status: 200, passed: true })
+  })
+
+  it('★ matches nothing: an address outside the rest of the whitelist is refused, not a server error', async () => {
+    expect(await run({ whitelist: ['10.0.0.['] }, '10.0.0.1')).toMatchObject({
+      status: 403,
+      headers: { [REFUSAL_HEADER]: REFUSED_ADDRESS },
+      passed: false
+    })
+  })
+
+  it('★ in the blacklist and the protected list it is passed over as well', async () => {
+    expect(await run({ blacklist: ['('] }, '10.0.0.1')).toMatchObject({ status: 200, passed: true })
+    expect(await run({ protectedlist: ['(', '^10\\.'] }, '10.0.0.1')).toMatchObject({ passed: true, unsafeIP: false })
+  })
+})
+
+describe('saving the IP lists', () => {
+  it('★ refuses an entry that is not a regular expression, naming the list and the entry', () => {
+    expect(refusalOf({ whitelist: ['^10\\.', '10.0.0.['] })).toEqual({ code: 'ip-whitelist-entry-invalid', params: { entry: '10.0.0.[' } })
+    expect(refusalOf({ blacklist: ['('] })).toEqual({ code: 'ip-blacklist-entry-invalid', params: { entry: '(' } })
+    expect(refusalOf({ protectedlist: [10] })).toEqual({ code: 'ip-protectedlist-entry-invalid', params: { entry: '10' } })
+  })
+
+  it('★ refuses an empty entry - an empty pattern matches every address', () => {
+    expect(refusalOf({ whitelist: ['^10\\.', ' '] })).toEqual({ code: 'ip-whitelist-entry-empty', params: {} })
+  })
+
+  it('takes lists of regular expressions, and lists left out', () => {
+    expect(refusalOf({ whitelist: ['^10\\.'], blacklist: [], privileges: [{ category: 'board', privilege: 'mutation' }] })).toBeUndefined()
+    expect(refusalOf({})).toBeUndefined()
+    expect(refusalOf(null)).toBeUndefined()
+  })
+
+  it('every refusal has its sentence in Korean and English', () => {
+    for (const locale of ['ko', 'en']) {
+      const sentences = require(`../translations/${locale}.json`)
+      for (const list of ['whitelist', 'blacklist', 'protectedlist']) {
+        for (const kind of ['invalid', 'empty']) {
+          expect([locale, typeof sentences[`error.ip-${list}-entry-${kind}`]]).toEqual([locale, 'string'])
+        }
+      }
+    }
+  })
+
+  it('the save door checks before it writes', () => {
+    const source = require('fs').readFileSync(require('path').resolve(__dirname, '../server/service/domain/domain-mutation.ts'), 'utf8')
+    const door = source.slice(source.indexOf('async updateSecureIPList('))
+    expect(door.indexOf('refuseBadIPList(iplist)')).toBeGreaterThan(0)
+    expect(door.indexOf('refuseBadIPList(iplist)')).toBeLessThan(door.indexOf('repository.save'))
+  })
+})

package/translations/en.json

@@ -206,5 +206,11 @@
   "text.tax-kind-zero-rated": "Zero-rated",
   "text.tax-kind-exempt": "Exempt",
   "button.rename": "rename",
-  "button.search": "search"
+  "button.search": "search",
+  "error.ip-whitelist-entry-invalid": "'{entry}' in the allow list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-blacklist-entry-invalid": "'{entry}' in the block list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-protectedlist-entry-invalid": "'{entry}' in the protected list is not an IP address regular expression. For example: ^10\\.0\\.",
+  "error.ip-whitelist-entry-empty": "The allow list has an empty entry. Leave nothing empty between commas.",
+  "error.ip-blacklist-entry-empty": "The block list has an empty entry. Leave nothing empty between commas.",
+  "error.ip-protectedlist-entry-empty": "The protected list has an empty entry. Leave nothing empty between commas."
 }

package/translations/ko.json

@@ -206,5 +206,11 @@
   "text.tax-kind-zero-rated": "영세율",
   "text.tax-kind-exempt": "면세",
   "button.rename": "이름변경",
-  "button.search": "찾기"
+  "button.search": "찾기",
+  "error.ip-whitelist-entry-invalid": "허용 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-blacklist-entry-invalid": "차단 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-protectedlist-entry-invalid": "보호 목록의 '{entry}'는 IP 주소 정규식이 아닙니다. 예: ^10\\.0\\.",
+  "error.ip-whitelist-entry-empty": "허용 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요.",
+  "error.ip-blacklist-entry-empty": "차단 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요.",
+  "error.ip-protectedlist-entry-empty": "보호 목록에 빈 항목이 있습니다. 쉼표 사이를 비우지 마세요."
 }