Archived
275 lines
11 KiB
Python
275 lines
11 KiB
Python
from pathlib import Path
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from router_dyndns.ddns import DdnsSettings, DdnsStore, make_app
|
|
from router_dyndns.ddns_security import admin_csrf_token
|
|
|
|
|
|
def test_shared_secret_is_not_admin_password_fallback(tmp_path: Path) -> None:
|
|
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", shared_secret="secret"))
|
|
client = TestClient(app)
|
|
|
|
response = client.get("/admin", auth=("admin", "secret"))
|
|
|
|
assert response.status_code == 500
|
|
assert response.json()["detail"] == "DDNS_ADMIN_PASSWORD is required"
|
|
|
|
|
|
def test_admin_page_shows_operator_views_without_create_form(tmp_path: Path) -> None:
|
|
database_path = tmp_path / "ddns.sqlite3"
|
|
store = DdnsStore(database_path)
|
|
store.create_domain_challenge("example.net")
|
|
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
response = client.get("/admin", auth=("admin", "admin"))
|
|
|
|
assert response.status_code == 200
|
|
assert response.headers["cache-control"] == "no-store"
|
|
assert '<link href="/admin.css?v=2" rel="stylesheet">' in response.text
|
|
assert '<script src="/admin-tables.js?v=2" defer></script>' in response.text
|
|
assert "Operator console" in response.text
|
|
assert "Generate credentials" not in response.text
|
|
assert 'action="/admin/accounts"' not in response.text
|
|
assert response.text.count("data-admin-table") == 3
|
|
assert response.text.count("data-table-search") == 3
|
|
assert response.text.count("data-table-page-size") == 3
|
|
assert response.text.count("data-table-pagination") == 3
|
|
assert "admin-table-scroll" in response.text
|
|
assert "Cleanup" in response.text
|
|
assert "Run now" in response.text
|
|
assert "Next run" in response.text
|
|
assert "Metrics" in response.text
|
|
assert "Blocked requests" in response.text
|
|
assert "Hostnames" in response.text
|
|
assert "Domain claims" in response.text
|
|
assert "Update events" in response.text
|
|
assert "example.net" in response.text
|
|
|
|
|
|
def test_custom_admin_path_moves_operator_routes(tmp_path: Path) -> None:
|
|
settings = DdnsSettings(
|
|
database_path=tmp_path / "ddns.sqlite3",
|
|
admin_password="admin",
|
|
admin_path="/ops",
|
|
)
|
|
store = DdnsStore(settings.database_path)
|
|
store.create_account("home.example.net", "router")
|
|
app = make_app(settings)
|
|
client = TestClient(app)
|
|
|
|
response = client.get("/ops", auth=("admin", "admin"))
|
|
|
|
assert response.status_code == 200
|
|
assert 'href="/ops/records"' in response.text
|
|
assert 'href="/ops/events"' in response.text
|
|
assert 'action="/ops/cleanup"' in response.text
|
|
assert 'action="/ops/accounts/rotate"' in response.text
|
|
assert 'action="/admin/cleanup"' not in response.text
|
|
assert client.get("/ops/records", auth=("admin", "admin")).status_code == 200
|
|
assert client.get("/records", auth=("admin", "admin")).status_code == 404
|
|
assert client.get("/admin", auth=("admin", "admin")).status_code == 404
|
|
|
|
|
|
def test_admin_records_and_events_are_paginated(tmp_path: Path) -> None:
|
|
database_path = tmp_path / "ddns.sqlite3"
|
|
store = DdnsStore(database_path)
|
|
first = store.create_account("first.example.net", "router")
|
|
second = store.create_account("second.example.net", "router")
|
|
store.upsert(first["hostname"], "203.0.113.1", None)
|
|
store.upsert(second["hostname"], "203.0.113.2", None)
|
|
store.log_update_event(first["hostname"], "203.0.113.1", None, "updated", "ok", "198.51.100.1")
|
|
store.log_update_event(second["hostname"], "203.0.113.2", None, "updated", "ok", "198.51.100.2")
|
|
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
records = client.get("/records?limit=1&offset=1", auth=("admin", "admin")).json()
|
|
events = client.get("/events?limit=1&offset=1", auth=("admin", "admin")).json()
|
|
|
|
assert records["limit"] == 1
|
|
assert records["offset"] == 1
|
|
assert records["total"] == 2
|
|
assert len(records["items"]) == 1
|
|
assert events["limit"] == 1
|
|
assert events["offset"] == 1
|
|
assert "next_before" in events
|
|
assert events["total"] == 2
|
|
assert len(events["items"]) == 1
|
|
|
|
|
|
def test_admin_records_and_events_reject_excessive_offsets(tmp_path: Path) -> None:
|
|
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
records = client.get("/records?offset=10001", auth=("admin", "admin"))
|
|
events = client.get("/events?offset=10001", auth=("admin", "admin"))
|
|
|
|
assert records.status_code == 422
|
|
assert events.status_code == 422
|
|
|
|
|
|
def test_update_events_page_orders_raw_and_rollup_events_in_sql(tmp_path: Path) -> None:
|
|
store = DdnsStore(tmp_path / "ddns.sqlite3")
|
|
store.log_update_event("raw-old.example.net", "203.0.113.1", None, "updated", "ok", "198.51.100.1")
|
|
store.log_update_event("raw-new.example.net", "203.0.113.2", None, "updated", "ok", "198.51.100.2")
|
|
store.log_update_rollup("rollup-mid.example.net", "203.0.113.3", None, "unchanged", "ok", "198.51.100.3")
|
|
|
|
with store.connect() as conn:
|
|
conn.execute("UPDATE update_events SET created_at = ? WHERE hostname = ?", ("2026-01-01T00:00:00+00:00", "raw-old.example.net"))
|
|
conn.execute("UPDATE update_events SET created_at = ? WHERE hostname = ?", ("2026-01-03T00:00:00+00:00", "raw-new.example.net"))
|
|
conn.execute(
|
|
"UPDATE update_event_rollups SET last_seen_at = ? WHERE hostname = ?",
|
|
("2026-01-02T00:00:00+00:00", "rollup-mid.example.net"),
|
|
)
|
|
|
|
page = store.list_update_events_page(limit=2, offset=1)
|
|
|
|
assert [event["hostname"] for event in page] == ["rollup-mid.example.net", "raw-old.example.net"]
|
|
|
|
|
|
def test_update_events_support_keyset_pagination(tmp_path: Path) -> None:
|
|
database_path = tmp_path / "ddns.sqlite3"
|
|
store = DdnsStore(database_path)
|
|
store.log_update_event("raw-old.example.net", "203.0.113.1", None, "updated", "ok", "198.51.100.1")
|
|
store.log_update_event("raw-new.example.net", "203.0.113.2", None, "updated", "ok", "198.51.100.2")
|
|
with store.connect() as conn:
|
|
conn.execute("UPDATE update_events SET created_at = ? WHERE hostname = ?", ("2026-01-01T00:00:00+00:00", "raw-old.example.net"))
|
|
conn.execute("UPDATE update_events SET created_at = ? WHERE hostname = ?", ("2026-01-02T00:00:00+00:00", "raw-new.example.net"))
|
|
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
first = client.get("/events?limit=1", auth=("admin", "admin")).json()
|
|
second = client.get(f"/events?limit=1&before={first['next_before']}", auth=("admin", "admin")).json()
|
|
|
|
assert first["items"][0]["hostname"] == "raw-new.example.net"
|
|
assert second["items"][0]["hostname"] == "raw-old.example.net"
|
|
|
|
|
|
def test_admin_posts_require_csrf(tmp_path: Path) -> None:
|
|
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
response = client.post(
|
|
"/admin/cleanup",
|
|
auth=("admin", "admin"),
|
|
data={},
|
|
)
|
|
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_admin_password_query_string_is_rejected(tmp_path: Path) -> None:
|
|
app = make_app(DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
response = client.get("/admin", params={"password": "admin"})
|
|
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_admin_routes_are_rate_limited(tmp_path: Path) -> None:
|
|
app = make_app(
|
|
DdnsSettings(
|
|
database_path=tmp_path / "ddns.sqlite3",
|
|
admin_password="admin",
|
|
admin_rate_limit_per_minute=1,
|
|
)
|
|
)
|
|
client = TestClient(app)
|
|
|
|
first = client.get("/admin", auth=("admin", "wrong"))
|
|
second = client.get("/admin", auth=("admin", "wrong"))
|
|
|
|
assert first.status_code == 401
|
|
assert second.status_code == 429
|
|
|
|
|
|
def test_admin_can_rotate_links_and_password(tmp_path: Path) -> None:
|
|
settings = DdnsSettings(
|
|
database_path=tmp_path / "ddns.sqlite3",
|
|
admin_password="admin",
|
|
public_base_url="http://ddns.example.net",
|
|
)
|
|
store = DdnsStore(settings.database_path)
|
|
account = store.create_account("home.example.net", "router")
|
|
app = make_app(settings)
|
|
client = TestClient(app)
|
|
csrf = admin_csrf_token(settings)
|
|
|
|
update = client.post(
|
|
"/admin/accounts/rotate",
|
|
auth=("admin", "admin"),
|
|
data={"csrf": csrf, "hostname": "home.example.net", "action": "update"},
|
|
)
|
|
assert update.status_code == 200
|
|
assert "Update URL changed" in update.text
|
|
assert client.get(f"/u/{account['update_slug']}", params={"myip": "203.0.113.9"}).status_code == 404
|
|
|
|
management = client.post(
|
|
"/admin/accounts/rotate",
|
|
auth=("admin", "admin"),
|
|
data={"csrf": csrf, "hostname": "home.example.net", "action": "management"},
|
|
)
|
|
assert management.status_code == 200
|
|
assert "Dashboard link changed" in management.text
|
|
assert "/m/" in management.text
|
|
|
|
password = client.post(
|
|
"/admin/accounts/rotate",
|
|
auth=("admin", "admin"),
|
|
data={"csrf": csrf, "hostname": "home.example.net", "action": "password"},
|
|
)
|
|
assert password.status_code == 200
|
|
assert "Router password changed" in password.text
|
|
assert "Full update URL:" in password.text
|
|
assert "/nic/update?" in password.text
|
|
assert "Kennwort (optional):" in password.text
|
|
statuses = {event["status"] for event in store.list_update_events_for_hostname("home.example.net", 10)}
|
|
assert "admin_update_url_rotated" in statuses
|
|
assert "admin_management_url_rotated" in statuses
|
|
assert "admin_router_credentials_rotated" in statuses
|
|
|
|
|
|
def test_admin_delete_normalizes_hostname_and_logs_audit_event(tmp_path: Path) -> None:
|
|
settings = DdnsSettings(database_path=tmp_path / "ddns.sqlite3", admin_password="admin")
|
|
store = DdnsStore(settings.database_path)
|
|
store.create_account("home.example.net", "router")
|
|
app = make_app(settings)
|
|
client = TestClient(app)
|
|
|
|
response = client.post(
|
|
"/admin/accounts/delete",
|
|
auth=("admin", "admin"),
|
|
data={"csrf": admin_csrf_token(settings), "hostname": " HOME.EXAMPLE.NET. "},
|
|
follow_redirects=False,
|
|
)
|
|
|
|
assert response.status_code == 303
|
|
assert store.get_account_by_hostname("home.example.net") is None
|
|
events = store.list_update_events_for_hostname("home.example.net", 10)
|
|
assert events[0]["status"] == "admin_hostname_deleted"
|
|
assert "secret" not in str(events[0]["detail"]).lower()
|
|
|
|
|
|
def test_admin_template_escapes_update_event_html(tmp_path: Path) -> None:
|
|
database_path = tmp_path / "ddns.sqlite3"
|
|
store = DdnsStore(database_path)
|
|
store.create_account("home.example.net", "router")
|
|
store.log_update_event(
|
|
"home.example.net",
|
|
"203.0.113.10",
|
|
None,
|
|
"dns_failed",
|
|
'<script>alert("xss")</script>',
|
|
"198.51.100.20",
|
|
)
|
|
app = make_app(DdnsSettings(database_path=database_path, admin_password="admin"))
|
|
client = TestClient(app)
|
|
|
|
response = client.get("/admin", auth=("admin", "admin"))
|
|
|
|
assert response.status_code == 200
|
|
assert '<script>alert("xss")</script>' not in response.text
|
|
assert "<script>alert("xss")</script>" in response.text
|