--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Node / ReticulumProjects / MeshChatX.git / files / tests / backend / test_access_attempts_enforcement.py
Displaying Raw • Download
tests/backend/test_access_attempts_enforcement.py 3f7ef731b5effd9aa3a81eceea66fd6c2b56498c (3f7ef731) Text, 11.61 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""Tests for login/setup rate limiting, lockout, and HTTP smoke paths."""
Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations
Tff7b72import T7ee787json
Tff7b72import T7ee787secrets
Tff7b72import T7ee787time
Tff7b72from T7ee787types Tff7b72import Te6edf3SimpleNamespace
Tff7b72from T7ee787unittestT7ee787.T7ee787mock Tff7b72import Te6edf3patch
Tff7b72import T7ee787bcrypt
Tff7b72import T7ee787pytest
Tff7b72from T7ee787aiohttp Tff7b72import Te6edf3web
Tff7b72from T7ee787aiohttpT7ee787.T7ee787test_utils Tff7b72import Te6edf3TestClientTb4b4b4, Te6edf3TestServer
Tff7b72from T7ee787aiohttp_session Tff7b72import Te6edf3setup Tff7b72as Te6edf3setup_session
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3HealthCheckTb4b4b4, Te6edf3givenTb4b4b4, Te6edf3settings
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3strategies Tff7b72as Te6edf3st
Tff7b72from T7ee787meshchatxT7ee787.T7ee787meshchat Tff7b72import Te6edf3_request_client_ip
Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787databaseT7ee787.T7ee787access_attempts Tff7b72import Tb4b4b4(
Te6edf3LOGIN_PATHTb4b4b4,
Te6edf3MAX_FAILED_BEFORE_LOCKOUTTb4b4b4,
Te6edf3MAX_TRUSTED_LOGIN_PER_WINDOWTb4b4b4,
Te6edf3MAX_UNTRUSTED_LOGIN_PER_WINDOWTb4b4b4,
Te6edf3WINDOW_LOCKOUT_STb4b4b4,
Te6edf3WINDOW_RATE_TRUSTED_STb4b4b4,
Te6edf3WINDOW_RATE_UNTRUSTED_STb4b4b4,
Te6edf3user_agent_hashTb4b4b4,
Tb4b4b4)
Tff7b72def Td2a8ff_make_reqTb4b4b4(
Te6edf3ipTb4b4b4: Tffa657strTb4b4b4,
Te6edf3uaTb4b4b4: Tffa657strTb4b4b4,
Te6edf3methodTb4b4b4: Tffa657str Tff7b72= Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Te6edf3xffTb4b4b4: Tffa657str Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,
Tb4b4b4) Tff7b72-Tff7b72> Te6edf3SimpleNamespaceTb4b4b4:
Te6edf3h Tff7b72= Tb4b4b4{Ta5d6ff"Ta5d6ffUser-AgentTa5d6ff"Tb4b4b4: Te6edf3uaTb4b4b4}
Tff7b72if Te6edf3xff Tff7b72is Tff7b72not Tff7b72NoneTb4b4b4:
Te6edf3hTb4b4b4[Ta5d6ff"Ta5d6ffX-Forwarded-ForTa5d6ff"Tb4b4b4] Tff7b72= Te6edf3xff
Tff7b72return Te6edf3SimpleNamespaceTb4b4b4(Te6edf3headersTff7b72=Te6edf3hTb4b4b4, Te6edf3remoteTff7b72=Te6edf3ipTb4b4b4, Te6edf3methodTff7b72=Te6edf3methodTb4b4b4)
Tff7b72def Td2a8ff_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4) Tff7b72-Tff7b72> Tffa657strTb4b4b4:
Tff7b72return Te6edf3mock_appTff7b72.Td2a8ffidentityTff7b72.Td2a8ffhashTff7b72.Td2a8ffhexTb4b4b4(Tb4b4b4)
Tff7b72def Td2a8fftest_request_client_ip_prefers_x_forwarded_for_only_from_trusted_proxyTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Ta5d6ff"Ta5d6ff127.0.0.1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffuaTa5d6ff"Tb4b4b4, Te6edf3xffTff7b72=Ta5d6ff"Ta5d6ff203.0.113.5, 10.0.0.2Ta5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3_request_client_ipTb4b4b4(Te6edf3rTb4b4b4, Te6edf3trusted_proxy_cidrsTff7b72=Ta5d6ff"Ta5d6ff127.0.0.1/32Ta5d6ff"Tb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ff203.0.113.5Ta5d6ff"
Tff7b72def Td2a8fftest_request_client_ip_ignores_xff_by_defaultTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Ta5d6ff"Ta5d6ff10.0.0.1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffuaTa5d6ff"Tb4b4b4, Te6edf3xffTff7b72=Ta5d6ff"Ta5d6ff203.0.113.5, 10.0.0.2Ta5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3_request_client_ipTb4b4b4(Te6edf3rTb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ff10.0.0.1Ta5d6ff"
Tff7b72def Td2a8fftest_request_client_ip_falls_back_to_remoteTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Ta5d6ff"Ta5d6ff198.51.100.2Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffuaTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3_request_client_ipTb4b4b4(Te6edf3rTb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ff198.51.100.2Ta5d6ff"
Tff7b72def Td2a8fftest_enforce_returns_none_when_no_databaseTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3db Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabase
Tff7b72tryTb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffdatabase Tff7b72= Tff7b72None
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Ta5d6ff"Ta5d6ff127.0.0.1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffMozilla/5.0Ta5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4) Tff7b72is Tff7b72None
Tff7b72finallyTb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffdatabase Tff7b72= Te6edf3db
Tff7b72def Td2a8fftest_untrusted_rate_limit_after_max_per_windowTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.10Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffRateTest/1Ta5d6ff"
Te6edf3now Tff7b72= Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4)
Te6edf3ts Tff7b72= Te6edf3now Tff7b72- Tb4b4b4(Te6edf3WINDOW_RATE_UNTRUSTED_S Tff7b72/ T79c0ff2Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3MAX_UNTRUSTED_LOGIN_PER_WINDOWTb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(
T8b949e"""
INSERT INTO access_attempts (
created_at, identity_hash, client_ip, user_agent, user_agent_hash,
path, method, outcome, detail
)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
"""Tb4b4b4,
Tb4b4b4(
Te6edf3tsTb4b4b4,
Te6edf3ihTb4b4b4,
Te6edf3ipTb4b4b4,
Te6edf3uaTb4b4b4,
Te6edf3user_agent_hashTb4b4b4(Te6edf3uaTb4b4b4)Tb4b4b4,
Te6edf3LOGIN_PATHTb4b4b4,
Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffsuccessTa5d6ff"Tb4b4b4,
Tff7b72NoneTb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4)
Te6edf3resp Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4)
Tff7b72assert Te6edf3resp Tff7b72is Tff7b72not Tff7b72None
Tff7b72assert Te6edf3respTff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Tff7b72def Td2a8fftest_lockout_when_enough_untrusted_failuresTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.20Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffAttacker/1Ta5d6ff"
Te6edf3now Tff7b72= Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4)
Te6edf3ts Tff7b72= Te6edf3now Tff7b72- Tb4b4b4(Te6edf3WINDOW_LOCKOUT_S Tff7b72/ T79c0ff2Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3MAX_FAILED_BEFORE_LOCKOUTTb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(
T8b949e"""
INSERT INTO access_attempts (
created_at, identity_hash, client_ip, user_agent, user_agent_hash,
path, method, outcome, detail
)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
"""Tb4b4b4,
Tb4b4b4(
Te6edf3tsTb4b4b4,
Te6edf3ihTb4b4b4,
Te6edf3ipTb4b4b4,
Te6edf3uaTb4b4b4,
Te6edf3user_agent_hashTb4b4b4(Te6edf3uaTb4b4b4)Tb4b4b4,
Te6edf3LOGIN_PATHTb4b4b4,
Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffailed_passwordTa5d6ff"Tb4b4b4,
Tff7b72NoneTb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4)
Te6edf3resp Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4)
Tff7b72assert Te6edf3resp Tff7b72is Tff7b72not Tff7b72None
Tff7b72assert Te6edf3respTff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Te6edf3body Tff7b72= Te6edf3jsonTff7b72.Td2a8ffloadsTb4b4b4(Te6edf3respTff7b72.Td2a8ffbodyTff7b72.Td2a8ffdecodeTb4b4b4(Tb4b4b4)Tb4b4b4)
Te6edf3err Tff7b72= Te6edf3bodyTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6fferrorTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff"Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6fffailedTa5d6ff" Tff7b72in Te6edf3errTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4) Tff7b72or Ta5d6ff"Ta5d6fflaterTa5d6ff" Tff7b72in Te6edf3errTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)
Tff7b72def Td2a8fftest_trusted_client_not_locked_out_by_own_failed_rowsTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.30Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffGoodUser/1Ta5d6ff"
Te6edf3h Tff7b72= Te6edf3user_agent_hashTb4b4b4(Te6edf3uaTb4b4b4)
Te6edf3daoTff7b72.Td2a8ffupsert_trustedTb4b4b4(Te6edf3ihTb4b4b4, Te6edf3ipTb4b4b4, Te6edf3hTb4b4b4)
Te6edf3ts Tff7b72= Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4) Tff7b72- Tb4b4b4(Te6edf3WINDOW_LOCKOUT_S Tff7b72/ T79c0ff2Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(T79c0ff10Tb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(
T8b949e"""
INSERT INTO access_attempts (
created_at, identity_hash, client_ip, user_agent, user_agent_hash,
path, method, outcome, detail
)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
"""Tb4b4b4,
Tb4b4b4(
Te6edf3tsTb4b4b4,
Te6edf3ihTb4b4b4,
Te6edf3ipTb4b4b4,
Te6edf3uaTb4b4b4,
Te6edf3hTb4b4b4,
Te6edf3LOGIN_PATHTb4b4b4,
Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffailed_passwordTa5d6ff"Tb4b4b4,
Tff7b72NoneTb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4)
Tff7b72assert Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4) Tff7b72is Tff7b72None
Tff7b72def Td2a8fftest_trusted_rate_limit_after_max_trusted_windowTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.40Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffHeavyTrusted/1Ta5d6ff"
Te6edf3h Tff7b72= Te6edf3user_agent_hashTb4b4b4(Te6edf3uaTb4b4b4)
Te6edf3daoTff7b72.Td2a8ffupsert_trustedTb4b4b4(Te6edf3ihTb4b4b4, Te6edf3ipTb4b4b4, Te6edf3hTb4b4b4)
Te6edf3now Tff7b72= Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4)
Te6edf3ts Tff7b72= Te6edf3now Tff7b72- Tb4b4b4(Te6edf3WINDOW_RATE_TRUSTED_S Tff7b72/ T79c0ff2Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3MAX_TRUSTED_LOGIN_PER_WINDOWTb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(
T8b949e"""
INSERT INTO access_attempts (
created_at, identity_hash, client_ip, user_agent, user_agent_hash,
path, method, outcome, detail
)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
"""Tb4b4b4,
Tb4b4b4(
Te6edf3tsTb4b4b4,
Te6edf3ihTb4b4b4,
Te6edf3ipTb4b4b4,
Te6edf3uaTb4b4b4,
Te6edf3hTb4b4b4,
Te6edf3LOGIN_PATHTb4b4b4,
Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffsuccessTa5d6ff"Tb4b4b4,
Tff7b72NoneTb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4)
Te6edf3resp Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4)
Tff7b72assert Te6edf3resp Tff7b72is Tff7b72not Tff7b72None
Tff7b72assert Te6edf3respTff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Tf0883e@settingsTb4b4b4(Te6edf3max_examplesTff7b72=T79c0ff25Tb4b4b4, Te6edf3suppress_health_checkTff7b72=Tb4b4b4[Te6edf3HealthCheckTff7b72.Td2a8fffunction_scoped_fixtureTb4b4b4]Tb4b4b4)
Tf0883e@givenTb4b4b4(
Te6edf3nTff7b72=Te6edf3stTff7b72.Td2a8ffintegersTb4b4b4(Te6edf3min_valueTff7b72=T79c0ff0Tb4b4b4, Te6edf3max_valueTff7b72=Te6edf3MAX_UNTRUSTED_LOGIN_PER_WINDOW Tff7b72+ T79c0ff3Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Tff7b72def Td2a8fftest_enforce_untrusted_monotone_hypothesisTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3nTb4b4b4)Tb4b4b4:
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff198.18.0.1Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffHyp/1Ta5d6ff"
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(Ta5d6ff"Ta5d6ffDELETE FROM access_attemptsTa5d6ff"Tb4b4b4, Tb4b4b4(Tb4b4b4)Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3nTb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffinsertTb4b4b4(Te6edf3ihTb4b4b4, Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4, Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffsuccessTa5d6ff"Tb4b4b4, Tff7b72NoneTb4b4b4)
Te6edf3r Tff7b72= Te6edf3_make_reqTb4b4b4(Te6edf3ipTb4b4b4, Te6edf3uaTb4b4b4)
Te6edf3out Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_enforce_login_accessTb4b4b4(Te6edf3rTb4b4b4, Te6edf3LOGIN_PATHTb4b4b4)
Tff7b72if Te6edf3n Tff7b72>Tff7b72= Te6edf3MAX_UNTRUSTED_LOGIN_PER_WINDOWTb4b4b4:
Tff7b72assert Te6edf3out Tff7b72is Tff7b72not Tff7b72None
Tff7b72assert Te6edf3outTff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Tff7b72elseTb4b4b4:
Tff7b72assert Te6edf3out Tff7b72is Tff7b72None
Tff7b72def Td2a8ff_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTb4b4b4: Tffa657boolTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffsession_secret_key Tff7b72= Te6edf3secretsTff7b72.Td2a8fftoken_urlsafeTb4b4b4(T79c0ff32Tb4b4b4)
Te6edf3routes Tff7b72= Te6edf3webTff7b72.Td2a8ffRouteTableDefTb4b4b4(Tb4b4b4)
Te6edf3auth_mwTb4b4b4, Te6edf3mime_mwTb4b4b4, Te6edf3sec_mwTb4b4b4, Te6edf3csrf_mwTb4b4b4, Te6edf3ip_mw Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_define_routesTb4b4b4(Te6edf3routesTb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3webTff7b72.Td2a8ffApplicationTb4b4b4(Tb4b4b4)
Te6edf3setup_sessionTb4b4b4(Te6edf3aio_appTb4b4b4, Te6edf3mock_appTff7b72.Td2a8ff_encrypted_cookie_storageTb4b4b4(Te6edf3use_httpsTb4b4b4)Tb4b4b4)
Te6edf3aio_appTff7b72.Td2a8ffmiddlewaresTff7b72.Td2a8ffextendTb4b4b4(Tb4b4b4[Te6edf3auth_mwTb4b4b4, Te6edf3mime_mwTb4b4b4, Te6edf3sec_mwTb4b4b4, Te6edf3csrf_mwTb4b4b4, Te6edf3ip_mwTb4b4b4]Tb4b4b4)
Te6edf3aio_appTff7b72.Td2a8ffadd_routesTb4b4b4(Te6edf3routesTb4b4b4)
Tff7b72return Te6edf3aio_app
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_login_records_access_attempt_and_debug_listTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6ffsmoke-access-attempt-pw-okTa5d6ff"
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3bad Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4, Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffwrongTa5d6ff"Tb4b4b4}Tb4b4b4)
Tff7b72assert Te6edf3badTff7b72.Td2a8ffstatus Tff7b72== T79c0ff401
Te6edf3good Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Te6edf3pwTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3goodTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3rows Tff7b72= Te6edf3daoTff7b72.Td2a8fflist_attemptsTb4b4b4(Te6edf3limitTff7b72=T79c0ff20Tb4b4b4, Te6edf3outcomeTff7b72=Ta5d6ff"Ta5d6fffailed_passwordTa5d6ff"Tb4b4b4)
Tff7b72assert Tffa657anyTb4b4b4(Te6edf3rTb4b4b4[Ta5d6ff"Ta5d6ffoutcomeTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6fffailed_passwordTa5d6ff" Tff7b72for Te6edf3r Tff7b72in Te6edf3rowsTb4b4b4)
Te6edf3rows_ok Tff7b72= Te6edf3daoTff7b72.Td2a8fflist_attemptsTb4b4b4(Te6edf3limitTff7b72=T79c0ff20Tb4b4b4, Te6edf3outcomeTff7b72=Ta5d6ff"Ta5d6ffsuccessTa5d6ff"Tb4b4b4)
Tff7b72assert Tffa657anyTb4b4b4(Te6edf3rTb4b4b4[Ta5d6ff"Ta5d6ffoutcomeTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6ffsuccessTa5d6ff" Tff7b72for Te6edf3r Tff7b72in Te6edf3rows_okTb4b4b4)
Te6edf3total Tff7b72= Te6edf3daoTff7b72.Td2a8ffcount_attemptsTb4b4b4(Tb4b4b4)
Tff7b72assert Te6edf3total Tff7b72>Tff7b72= T79c0ff2
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_lockout_login_returns_429_smokeTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6fflockout-smoke-pwTa5d6ff"
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.88Ta5d6ff"
Tff7b72with Te6edf3patchTb4b4b4(
Ta5d6ff"Ta5d6ffmeshchatx.meshchat._request_client_ipTa5d6ff"Tb4b4b4,
Te6edf3return_valueTff7b72=Te6edf3ipTb4b4b4,
Tb4b4b4)Tb4b4b4:
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3MAX_FAILED_BEFORE_LOCKOUTTb4b4b4)Tb4b4b4:
Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffnopeTa5d6ff"Tb4b4b4}Tb4b4b4,
Te6edf3headersTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffUser-AgentTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffSmokeLock/1Ta5d6ff"Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff401
Te6edf3r429 Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffnopeTa5d6ff"Tb4b4b4}Tb4b4b4,
Te6edf3headersTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffUser-AgentTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffSmokeLock/1Ta5d6ff"Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3r429Tff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_rate_limited_login_returns_429_smokeTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6ffrl-smoke-pwTa5d6ff"
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3dao Tff7b72= Te6edf3mock_appTff7b72.Td2a8ffdatabaseTff7b72.Td2a8ffaccess_attempts
Te6edf3ih Tff7b72= Te6edf3_id_hexTb4b4b4(Te6edf3mock_appTb4b4b4)
Te6edf3ip Tff7b72= Ta5d6ff"Ta5d6ff192.0.2.99Ta5d6ff"
Te6edf3ua Tff7b72= Ta5d6ff"Ta5d6ffSmokeRL/1Ta5d6ff"
Te6edf3now Tff7b72= Te6edf3timeTff7b72.Td2a8fftimeTb4b4b4(Tb4b4b4)
Te6edf3ts Tff7b72= Te6edf3now Tff7b72- Tb4b4b4(Te6edf3WINDOW_RATE_UNTRUSTED_S Tff7b72/ T79c0ff2Tb4b4b4)
Tff7b72for Te6edf3_ Tff7b72in Tffa657rangeTb4b4b4(Te6edf3MAX_UNTRUSTED_LOGIN_PER_WINDOWTb4b4b4)Tb4b4b4:
Te6edf3daoTff7b72.Td2a8ffproviderTff7b72.Td2a8ffexecuteTb4b4b4(
T8b949e"""
INSERT INTO access_attempts (
created_at, identity_hash, client_ip, user_agent, user_agent_hash,
path, method, outcome, detail
)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
"""Tb4b4b4,
Tb4b4b4(
Te6edf3tsTb4b4b4,
Te6edf3ihTb4b4b4,
Te6edf3ipTb4b4b4,
Te6edf3uaTb4b4b4,
Te6edf3user_agent_hashTb4b4b4(Te6edf3uaTb4b4b4)Tb4b4b4,
Te6edf3LOGIN_PATHTb4b4b4,
Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffsuccessTa5d6ff"Tb4b4b4,
Tff7b72NoneTb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Tff7b72with Te6edf3patchTb4b4b4(
Ta5d6ff"Ta5d6ffmeshchatx.meshchat._request_client_ipTa5d6ff"Tb4b4b4,
Te6edf3return_valueTff7b72=Te6edf3ipTb4b4b4,
Tb4b4b4)Tb4b4b4:
Te6edf3r429 Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffnopeTa5d6ff"Tb4b4b4}Tb4b4b4,
Te6edf3headersTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffUser-AgentTa5d6ff"Tb4b4b4: Te6edf3uaTb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3r429Tff7b72.Td2a8ffstatus Tff7b72== T79c0ff429
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_debug_access_attempts_endpoint_returns_shapeTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72FalseTb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/debug/access-attempts?limit=5&offset=0Ta5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Te6edf3data Tff7b72= Tff7b72await Te6edf3rTff7b72.Td2a8ffjsonTb4b4b4(Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6ffattemptsTa5d6ff" Tff7b72in Te6edf3data
Tff7b72assert Ta5d6ff"Ta5d6fftotalTa5d6ff" Tff7b72in Te6edf3data
Tff7b72assert Ta5d6ff"Ta5d6fflimitTa5d6ff" Tff7b72in Te6edf3data
Tff7b72assert Ta5d6ff"Ta5d6ffoffsetTa5d6ff" Tff7b72in Te6edf3data
Tff7b72assert Tffa657isinstanceTb4b4b4(Te6edf3dataTb4b4b4[Ta5d6ff"Ta5d6ffattemptsTa5d6ff"Tb4b4b4]Tb4b4b4, Tffa657listTb4b4b4)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────