@@ -964,35 +964,35 @@ describe("trusted-proxy auth", () => {
964964expect(res.reason).toBe("trusted_proxy_loopback_source");
965965});
966966967-it("accepts local-direct password fallback when trusted-proxy auth fails", async () => {
967+it("rejects local-direct password credentials when trusted-proxy auth fails", async () => {
968968const limiter = createLimiterSpy();
969969const res = await authorizeLocalDirect({
970970password: "local-password", // pragma: allowlist secret
971971connectPassword: "local-password", // pragma: allowlist secret
972972rateLimiter: limiter,
973973});
974974975-expect(res).toEqual({ ok: true, method: "password" });
976-expect(limiter.check).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
977-expect(limiter.reset).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
975+expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
976+expect(limiter.check).not.toHaveBeenCalled();
977+expect(limiter.reset).not.toHaveBeenCalled();
978978expect(limiter.recordFailure).not.toHaveBeenCalled();
979979});
980980981-it("rejects wrong local-direct password fallback and records the failure", async () => {
981+it("ignores wrong local-direct password credentials when trusted-proxy auth fails", async () => {
982982const limiter = createLimiterSpy();
983983const res = await authorizeLocalDirect({
984984password: "local-password", // pragma: allowlist secret
985985connectPassword: "wrong-password", // pragma: allowlist secret
986986rateLimiter: limiter,
987987});
988988989-expect(res).toEqual({ ok: false, reason: "password_mismatch" });
990-expect(limiter.check).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
991-expect(limiter.recordFailure).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
989+expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
990+expect(limiter.check).not.toHaveBeenCalled();
991+expect(limiter.recordFailure).not.toHaveBeenCalled();
992992expect(limiter.reset).not.toHaveBeenCalled();
993993});
994994995-it("enforces rate-limit lockout before local-direct password fallback", async () => {
995+it("does not apply shared-secret rate limits to trusted-proxy failures", async () => {
996996const limiter = createLimiterSpy();
997997limiter.check.mockReturnValueOnce({
998998allowed: false,
@@ -1006,12 +1006,8 @@ describe("trusted-proxy auth", () => {
10061006rateLimiter: limiter,
10071007});
100810081009-expect(res).toEqual({
1010-ok: false,
1011-reason: "rate_limited",
1012-rateLimited: true,
1013-retryAfterMs: 2500,
1014-});
1009+expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
1010+expect(limiter.check).not.toHaveBeenCalled();
10151011expect(limiter.recordFailure).not.toHaveBeenCalled();
10161012expect(limiter.reset).not.toHaveBeenCalled();
10171013});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。