Nick SzaunigandClaude Opus 5.5
886b4e75e1
Der Standard-ThrottlerGuard trackt die volle req.ip. Ein IPv6-Client kann innerhalb seines /64 beliebig Adressen rotieren und so die Login-/Refresh-/SSO-Limits umgehen. Neuer ClientIpThrottlerGuard liefert IPv4 unveraendert, IPv4-mapped als IPv4 und IPv6 als /64-Praefix. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
27 lines
854 B
TypeScript
27 lines
854 B
TypeScript
import { ClientIpThrottlerGuard } from './client-ip-throttler.guard';
|
|
|
|
describe('ClientIpThrottlerGuard.getTracker', () => {
|
|
// getTracker is protected and needs none of the guard's dependencies.
|
|
const guard = Object.create(
|
|
ClientIpThrottlerGuard.prototype,
|
|
) as ClientIpThrottlerGuard & {
|
|
getTracker(req: Record<string, any>): Promise<string>;
|
|
};
|
|
|
|
it('tracks IPv6 clients by their /64 prefix', async () => {
|
|
await expect(guard.getTracker({ ip: '2001:db8:1:2::9' })).resolves.toBe(
|
|
'2001:db8:1:2::/64',
|
|
);
|
|
});
|
|
|
|
it('tracks IPv4 clients by address', async () => {
|
|
await expect(guard.getTracker({ ip: '203.0.113.7' })).resolves.toBe(
|
|
'203.0.113.7',
|
|
);
|
|
});
|
|
|
|
it('falls back to a stable key when req.ip is missing', async () => {
|
|
await expect(guard.getTracker({})).resolves.toBe('unknown');
|
|
});
|
|
});
|