mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 11:12:29 +00:00
ff8ba36ff0
Some checks are pending
License Headers / check (push) Waiting to run
* docs(spec): secubox-proxypac WPAD/PAC mesh-service routing design (ref #784) * docs(plan): secubox-proxypac 11-task TDD implementation plan (ref #784) * feat(annuaire): optional byte-stable pac descriptor on ServiceOffer (ref #784) * feat(proxypac): PAC template + fail-open directive builder (ref #784) * feat(proxypac): rules.d parsing + precedence compose (ref #784) * feat(proxypac): p2p /services catalog reader → routing rules (ref #784) * feat(proxypac): generator + atomic fail-safe write + CLI (ref #784) * fix(proxypac): shadow file is <pac>.shadow not <base>.shadow (ref #784) * feat(proxypac): WebUI API override CRUD + candidates + audit (ref #784) * fix(proxypac): regen honors RULES_DIR + reject whitespace in override host (ref #784) * feat(proxypac): nginx PAC/WPAD serving (LAN-only) + seed rule (ref #784) * fix(proxypac): gate /proxy.pac to LAN/mesh (never public) (ref #784) * feat(proxypac): regen path+timer units + DHCP 252 WPAD advertise (ref #784) * feat(proxypac): WebUI override panel + menu entry (ref #784) * fix(proxypac): correct menu schema (name/category) + escape panel output (ref #784) * feat(proxypac): debian packaging (ref #784) * fix(proxypac): drop duplicate debian/compat + correct secubox user creation (ref #784) * docs(proxypac): README + deploy notes (ref #784) * fix(proxypac): apply final-review follow-ups (ref #784) - compose: overrides now last-file-wins per host, so an operator's later 50-webui.rules override beats a shipped 00-onion.rules seed for the same glob (explicit policy > defaults); cross-source override>service>toolbox unchanged. New test test_compose_override_last_file_wins. - packaging: declare Depends: secubox-hub — the /proxy.pac allow/deny gate matches $remote_addr, which behind HAProxy is 127.0.0.1 unless secubox-hub's real_ip (X-Forwarded-For) rewrite is loaded; without it the PAC would be world-readable. nginx/proxypac.conf comments the dependency; test asserts it in control. - README: document last-file-wins precedence + the real_ip/secubox-hub dependency. --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
35 lines
1.6 KiB
Python
35 lines
1.6 KiB
Python
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
|
|
# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
|
|
# Source-Disclosed License — All rights reserved except as expressly granted.
|
|
# See LICENCE-CMSD-1.0.md for terms.
|
|
import importlib, json
|
|
from fastapi.testclient import TestClient
|
|
|
|
def _client(tmp_path, monkeypatch):
|
|
monkeypatch.setenv("PROXYPAC_RULES_DIR", str(tmp_path / "rules.d"))
|
|
monkeypatch.setenv("PROXYPAC_AUDIT", str(tmp_path / "audit.log"))
|
|
import api.main as m
|
|
importlib.reload(m)
|
|
monkeypatch.setattr(m, "run_once", lambda *a, **k: True) # no live regen in tests
|
|
m.app.dependency_overrides[m.require_jwt] = lambda: {"sub": "admin"}
|
|
return TestClient(m.app), tmp_path
|
|
|
|
def test_add_and_list_override(tmp_path, monkeypatch):
|
|
c, tp = _client(tmp_path, monkeypatch)
|
|
r = c.post("/override", json={"host": "bank.example", "proxy": "direct", "address": ""})
|
|
assert r.status_code == 200
|
|
rules = c.get("/rules").json()["rules"]
|
|
assert {"host": "bank.example", "directive": "DIRECT"} in rules
|
|
assert "bank.example" in (tp / "audit.log").read_text()
|
|
|
|
def test_delete_override(tmp_path, monkeypatch):
|
|
c, tp = _client(tmp_path, monkeypatch)
|
|
c.post("/override", json={"host": "x.com", "proxy": "socks5", "address": "10.10.0.1:9050"})
|
|
assert c.delete("/override/x.com").status_code == 200
|
|
assert all(r["host"] != "x.com" for r in c.get("/rules").json()["rules"])
|
|
|
|
def test_reject_host_with_whitespace(tmp_path, monkeypatch):
|
|
c, _ = _client(tmp_path, monkeypatch)
|
|
r = c.post("/override", json={"host": "bad host\ninject", "proxy": "direct", "address": ""})
|
|
assert r.status_code == 422
|