codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Address production-readiness review: clearer errors, safer votes, and ops hardening.

Browse Source 
Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
This commit is contained in:
codegirl007
2026-08-22 12:16:59 -07:00
parent 5bdaa8977f
commit 29b0536215
26 changed files with 612 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/throttle_test.go
+11 -6
View File
@@ -1,6 +1,7 @@
package web
import (
"net"
"net/http"
"net/http/httptest"
"sync"
@@ -33,8 +34,8 @@ func TestThrottleMaxKeys(t *testing.T) {
if !th.allow("one") || !th.allow("two") {
t.Fatal("first keys should pass")
}
if th.allow("three") {
t.Fatal("over maxKeys should reject new key")
if !th.allow("three") {
t.Fatal("over maxKeys should LRU-evict and accept new key")
}
if th.lenKeys() != 2 {
t.Fatalf("keys=%d want 2", th.lenKeys())
@@ -90,7 +91,11 @@ func TestFailureTrackerEvictsExpired(t *testing.T) {
}
func TestClientIPTrustProxy(t *testing.T) {
srv := &Server{cfg: Config{TrustProxy: true}}
_, proxyNet, err := net.ParseCIDR("10.0.0.0/8")
if err != nil {
t.Fatal(err)
}
srv := &Server{cfg: Config{TrustedProxies: []*net.IPNet{proxyNet}}}
req := httptest.NewRequest(http.MethodGet, "/", nil)
req.RemoteAddr = "10.0.0.1:1234"
req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.1")
@@ -98,9 +103,9 @@ func TestClientIPTrustProxy(t *testing.T) {
t.Fatalf("trusted xff got %q", got)
}
srv.cfg.TrustProxy = false
if got := srv.clientIP(req); got != "10.0.0.1" {
t.Fatalf("untrusted should use RemoteAddr host, got %q", got)
req.RemoteAddr = "203.0.113.50:9"
if got := srv.clientIP(req); got != "203.0.113.50" {
t.Fatalf("untrusted peer should ignore xff, got %q", got)
}
}