ip whitelist

tests/http_security.rs

@@ -36,6 +36,7 @@ async fn app() -> (
         log_dir: logs.clone(),
         latest_log: latest.clone(),
         whitelist: whitelist_path,
+        ip_whitelist_file: Some(dir.path().join("ip-whitelist.txt")),
         trust_proxy: true,
         trusted_proxy_cidrs: vec![
             "10.0.0.0/8".parse().unwrap(),
@@ -52,6 +53,7 @@ async fn app() -> (
         max_ws_connections: 2,
         redact_player_ips: true,
     });
+    std::fs::write(dir.path().join("ip-whitelist.txt"), "").unwrap();
     let auth = AuthorizationService::new(latest, Whitelist::parse(whitelist_json).unwrap());
     auth.rebuild().await.unwrap();
     let history = HistoryStore::new(HistoryIndex::scan(&logs).unwrap(), 1024, 2, 4096, true);
@@ -135,6 +137,39 @@ async fn untrusted_peer_cannot_spoof_an_authorized_forwarded_ip() {
     assert_eq!(response.status(), StatusCode::FORBIDDEN);
 }
 
+#[tokio::test]
+async fn denied_response_reports_the_ip_used_for_authorization() {
+    let (app, _dir, _tx) = app().await;
+    let mut request = request("127.0.0.1:5000");
+    request
+        .headers_mut()
+        .insert("x-forwarded-for", "100.64.0.27".parse().unwrap());
+    let response = app.oneshot(request).await.unwrap();
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    let body = axum::body::to_bytes(response.into_body(), 8192)
+        .await
+        .unwrap();
+    assert_eq!(
+        serde_json::from_slice::<serde_json::Value>(&body).unwrap()["client_ip"],
+        "100.64.0.27"
+    );
+}
+
+#[tokio::test]
+async fn owner_ip_whitelist_is_a_hot_reloaded_final_fallback() {
+    let (app, dir, _tx) = app().await;
+    let peer = "100.64.0.27:5000";
+    assert_eq!(
+        app.clone().oneshot(request(peer)).await.unwrap().status(),
+        StatusCode::FORBIDDEN
+    );
+    std::fs::write(dir.path().join("ip-whitelist.txt"), "100.64.0.27\n").unwrap();
+    assert_eq!(
+        app.oneshot(request(peer)).await.unwrap().status(),
+        StatusCode::OK
+    );
+}
+
 #[tokio::test]
 async fn unexpected_browser_origin_is_rejected() {
     let (app, _dir, _tx) = app().await;