server/tests/api/server/reverse-proxy.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import 'mocha'
   4 import * as chai from 'chai'
   5 import { cleanupTests, getVideo, registerUser, uploadVideo, userLogin, viewVideo, wait } from '../../../../shared/extra-utils'
   6 import { flushAndRunServer, setAccessTokensToServers } from '../../../../shared/extra-utils/index'
   7
   8 const expect = chai.expect
   9
  10 describe('Test application behind a reverse proxy', function () {
  11   let server = null
  12   let videoId
  13
  14   before(async function () {
  15     this.timeout(30000)
  16
  17     const config = {
  18       rates_limit: {
  19         api: {
  20           max: 50,
  21           window: 5000
  22         },
  23         signup: {
  24           max: 3,
  25           window: 5000
  26         },
  27         login: {
  28           max: 20
  29         }
  30       },
  31       signup: {
  32         limit: 20
  33       }
  34     }
  35
  36     server = await flushAndRunServer(1, config)
  37     await setAccessTokensToServers([ server ])
  38
  39     const { body } = await uploadVideo(server.url, server.accessToken, {})
  40     videoId = body.video.uuid
  41   })
  42
  43   it('Should view a video only once with the same IP by default', async function () {
  44     this.timeout(20000)
  45
  46     await viewVideo(server.url, videoId)
  47     await viewVideo(server.url, videoId)
  48
  49     // Wait the repeatable job
  50     await wait(8000)
  51
  52     const { body } = await getVideo(server.url, videoId)
  53     expect(body.views).to.equal(1)
  54   })
  55
  56   it('Should view a video 2 times with the X-Forwarded-For header set', async function () {
  57     this.timeout(20000)
  58
  59     await viewVideo(server.url, videoId, 204, '0.0.0.1,127.0.0.1')
  60     await viewVideo(server.url, videoId, 204, '0.0.0.2,127.0.0.1')
  61
  62     // Wait the repeatable job
  63     await wait(8000)
  64
  65     const { body } = await getVideo(server.url, videoId)
  66     expect(body.views).to.equal(3)
  67   })
  68
  69   it('Should view a video only once with the same client IP in the X-Forwarded-For header', async function () {
  70     this.timeout(20000)
  71
  72     await viewVideo(server.url, videoId, 204, '0.0.0.4,0.0.0.3,::ffff:127.0.0.1')
  73     await viewVideo(server.url, videoId, 204, '0.0.0.5,0.0.0.3,127.0.0.1')
  74
  75     // Wait the repeatable job
  76     await wait(8000)
  77
  78     const { body } = await getVideo(server.url, videoId)
  79     expect(body.views).to.equal(4)
  80   })
  81
  82   it('Should view a video two times with a different client IP in the X-Forwarded-For header', async function () {
  83     this.timeout(20000)
  84
  85     await viewVideo(server.url, videoId, 204, '0.0.0.8,0.0.0.6,127.0.0.1')
  86     await viewVideo(server.url, videoId, 204, '0.0.0.8,0.0.0.7,127.0.0.1')
  87
  88     // Wait the repeatable job
  89     await wait(8000)
  90
  91     const { body } = await getVideo(server.url, videoId)
  92     expect(body.views).to.equal(6)
  93   })
  94
  95   it('Should rate limit logins', async function () {
  96     const user = { username: 'root', password: 'fail' }
  97
  98     for (let i = 0; i < 19; i++) {
  99       await userLogin(server, user, 400)
 100     }
 101
 102     await userLogin(server, user, 429)
 103   })
 104
 105   it('Should rate limit signup', async function () {
 106     for (let i = 0; i < 10; i++) {
 107       try {
 108         await registerUser(server.url, 'test' + i, 'password')
 109       } catch {
 110         // empty
 111       }
 112     }
 113
 114     await registerUser(server.url, 'test42', 'password', 429)
 115   })
 116
 117   it('Should not rate limit failed signup', async function () {
 118     this.timeout(30000)
 119
 120     await wait(7000)
 121
 122     for (let i = 0; i < 3; i++) {
 123       await registerUser(server.url, 'test' + i, 'password', 409)
 124     }
 125
 126     await registerUser(server.url, 'test43', 'password', 204)
 127
 128   })
 129
 130   it('Should rate limit API calls', async function () {
 131     this.timeout(30000)
 132
 133     await wait(7000)
 134
 135     for (let i = 0; i < 100; i++) {
 136       try {
 137         await getVideo(server.url, videoId)
 138       } catch {
 139         // don't care if it fails
 140       }
 141     }
 142
 143     await getVideo(server.url, videoId, 429)
 144   })
 145
 146   after(async function () {
 147     await cleanupTests([ server ])
 148   })
 149 })