arian/anubis-mirror
1
0
Fork 0
mirror of https://github.com/TecharoHQ/anubis.git synced 2026-04-14 20:48:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: raise checker to be a subpackage of lib

Browse Source 
Signed-off-by: Xe Iaso <me@xeiaso.net>
This commit is contained in:
Xe Iaso
2025-07-25 18:45:40 +00:00
parent ecbbf77498
commit 178c60cf72
17 changed files with 68 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/policy/bot.go
View File

@@ -4,12 +4,12 @@ import (
"fmt"
"github.com/TecharoHQ/anubis/internal"
"github.com/TecharoHQ/anubis/lib/policy/checker"
"github.com/TecharoHQ/anubis/lib/checker"
"github.com/TecharoHQ/anubis/lib/policy/config"
)
type Bot struct {
Rules checker.Impl
Rules checker.Interface
Challenge *config.ChallengeRules
Weight *config.Weight
Name string

14
lib/policy/checker.go
View File

@@ -10,7 +10,7 @@ import (
"github.com/TecharoHQ/anubis"
"github.com/TecharoHQ/anubis/internal"
"github.com/TecharoHQ/anubis/lib/policy/checker"
"github.com/TecharoHQ/anubis/lib/checker"
"github.com/gaissmai/bart"
)
@@ -19,7 +19,7 @@ type RemoteAddrChecker struct {
hash string
}
func NewRemoteAddrChecker(cidrs []string) (checker.Impl, error) {
func NewRemoteAddrChecker(cidrs []string) (checker.Interface, error) {
table := new(bart.Lite)
for _, cidr := range cidrs {
@@ -61,11 +61,11 @@ type HeaderMatchesChecker struct {
hash string
}
func NewUserAgentChecker(rexStr string) (checker.Impl, error) {
func NewUserAgentChecker(rexStr string) (checker.Interface, error) {
return NewHeaderMatchesChecker("User-Agent", rexStr)
}
func NewHeaderMatchesChecker(header, rexStr string) (checker.Impl, error) {
func NewHeaderMatchesChecker(header, rexStr string) (checker.Interface, error) {
rex, err := regexp.Compile(strings.TrimSpace(rexStr))
if err != nil {
return nil, fmt.Errorf("%w: regex %s failed parse: %w", anubis.ErrMisconfiguration, rexStr, err)
@@ -90,7 +90,7 @@ type PathChecker struct {
hash string
}
func NewPathChecker(rexStr string) (checker.Impl, error) {
func NewPathChecker(rexStr string) (checker.Interface, error) {
rex, err := regexp.Compile(strings.TrimSpace(rexStr))
if err != nil {
return nil, fmt.Errorf("%w: regex %s failed parse: %w", anubis.ErrMisconfiguration, rexStr, err)
@@ -110,7 +110,7 @@ func (pc *PathChecker) Hash() string {
return pc.hash
}
func NewHeaderExistsChecker(key string) checker.Impl {
func NewHeaderExistsChecker(key string) checker.Interface {
return headerExistsChecker{strings.TrimSpace(key)}
}
@@ -130,7 +130,7 @@ func (hec headerExistsChecker) Hash() string {
return internal.FastHash(hec.header)
}
func NewHeadersChecker(headermap map[string]string) (checker.Impl, error) {
func NewHeadersChecker(headermap map[string]string) (checker.Interface, error) {
var result checker.List
var errs []error

41
lib/policy/checker/checker.go
View File

@@ -1,41 +0,0 @@
// Package checker defines the Checker interface and a helper utility to avoid import cycles.
package checker
import (
"fmt"
"net/http"
"strings"
"github.com/TecharoHQ/anubis/internal"
)
type Impl interface {
Check(*http.Request) (matches bool, err error)
Hash() string
}
type List []Impl
func (l List) Check(r *http.Request) (bool, error) {
for _, c := range l {
ok, err := c.Check(r)
if err != nil {
return ok, err
}
if ok {
return ok, nil
}
}
return false, nil
}
func (l List) Hash() string {
var sb strings.Builder
for _, c := range l {
fmt.Fprintln(&sb, c.Hash())
}
return internal.FastHash(sb.String())
}

42
lib/policy/checker/registry.go
View File

@@ -1,42 +0,0 @@
package checker
import (
"encoding/json"
"sort"
"sync"
)
type Factory interface {
ValidateConfig(json.RawMessage) error
Create(json.RawMessage) (Impl, error)
}
var (
registry map[string]Factory = map[string]Factory{}
regLock sync.RWMutex
)
func Register(name string, factory Factory) {
regLock.Lock()
defer regLock.Unlock()
registry[name] = factory
}
func Get(name string) (Factory, bool) {
regLock.RLock()
defer regLock.RUnlock()
result, ok := registry[name]
return result, ok
}
func Methods() []string {
regLock.RLock()
defer regLock.RUnlock()
var result []string
for method := range registry {
result = append(result, method)
}
sort.Strings(result)
return result
}

104
lib/policy/checker/remoteaddress/remoteaddress.go
View File

@@ -1,104 +0,0 @@
package remoteaddress
import (
"encoding/json"
"errors"
"fmt"
"net/http"
"net/netip"
"github.com/TecharoHQ/anubis/internal"
"github.com/TecharoHQ/anubis/lib/policy"
"github.com/TecharoHQ/anubis/lib/policy/checker"
"github.com/TecharoHQ/anubis/lib/policy/config"
"github.com/gaissmai/bart"
)
var (
ErrNoRemoteAddresses = errors.New("remoteaddress: no remote addresses defined")
)
func init() {}
type Factory struct{}
func (Factory) ValidateConfig(inp json.RawMessage) error {
var fc fileConfig
if err := json.Unmarshal([]byte(inp), &fc); err != nil {
return fmt.Errorf("%w: %w", config.ErrUnparseableConfig, err)
}
if err := fc.Valid(); err != nil {
return err
}
return nil
}
func (Factory) Create(inp json.RawMessage) (checker.Impl, error) {
c := struct {
RemoteAddr []netip.Prefix `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
}{}
if err := json.Unmarshal([]byte(inp), &c); err != nil {
return nil, fmt.Errorf("%w: %w", config.ErrUnparseableConfig, err)
}
table := new(bart.Lite)
for _, cidr := range c.RemoteAddr {
table.Insert(cidr)
}
return &RemoteAddrChecker{
prefixTable: table,
hash: internal.FastHash(string(inp)),
}, nil
}
type fileConfig struct {
RemoteAddr []string `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
}
func (fc fileConfig) Valid() error {
var errs []error
if len(fc.RemoteAddr) == 0 {
errs = append(errs, ErrNoRemoteAddresses)
}
for _, cidr := range fc.RemoteAddr {
if _, err := netip.ParsePrefix(cidr); err != nil {
errs = append(errs, fmt.Errorf("%w: cidr %q is invalid: %w", config.ErrInvalidCIDR, cidr, err))
}
}
if len(errs) != 0 {
return fmt.Errorf("%w: %w", policy.ErrMisconfiguration, errors.Join(errs...))
}
return nil
}
type RemoteAddrChecker struct {
prefixTable *bart.Lite
hash string
}
func (rac *RemoteAddrChecker) Check(r *http.Request) (bool, error) {
host := r.Header.Get("X-Real-Ip")
if host == "" {
return false, fmt.Errorf("%w: header X-Real-Ip is not set", policy.ErrMisconfiguration)
}
addr, err := netip.ParseAddr(host)
if err != nil {
return false, fmt.Errorf("%w: %s is not an IP address: %w", policy.ErrMisconfiguration, host, err)
}
return rac.prefixTable.Contains(addr), nil
}
func (rac *RemoteAddrChecker) Hash() string {
return rac.hash
}

216
lib/policy/checker/remoteaddress/remoteaddress_test.go
View File

@@ -1,216 +0,0 @@
package remoteaddress
import (
_ "embed"
"encoding/json"
"errors"
"net/http"
"testing"
"github.com/TecharoHQ/anubis/lib/policy/checker"
"github.com/TecharoHQ/anubis/lib/policy/config"
)
func TestFactoryIsCheckerFactory(t *testing.T) {
if _, ok := (any(Factory{})).(checker.Factory); !ok {
t.Fatal("Factory is not an instance of checker.Factory")
}
}
func TestFactoryValidateConfig(t *testing.T) {
f := Factory{}
for _, tt := range []struct {
name string
data []byte
err error
}{
{
name: "basic valid",
data: []byte(`{
"remote_addresses": [
"1.1.1.1/32"
]
}`),
},
{
name: "not json",
data: []byte(`]`),
err: config.ErrUnparseableConfig,
},
{
name: "no cidr",
data: []byte(`{
"remote_addresses": []
}`),
err: ErrNoRemoteAddresses,
},
{
name: "bad cidr",
data: []byte(`{
"remote_addresses": [
"according to all laws of aviation"
]
}`),
err: config.ErrInvalidCIDR,
},
} {
t.Run(tt.name, func(t *testing.T) {
data := json.RawMessage(tt.data)
if err := f.ValidateConfig(data); !errors.Is(err, tt.err) {
t.Logf("want: %v", tt.err)
t.Logf("got: %v", err)
t.Fatal("validation didn't do what was expected")
}
})
}
}
func TestFactoryCreate(t *testing.T) {
f := Factory{}
for _, tt := range []struct {
name string
data []byte
err error
ip string
match bool
}{
{
name: "basic valid",
data: []byte(`{
"remote_addresses": [
"1.1.1.1/32"
]
}`),
ip: "1.1.1.1",
match: true,
},
{
name: "bad cidr",
data: []byte(`{
"remote_addresses": [
"according to all laws of aviation"
]
}`),
err: config.ErrUnparseableConfig,
},
} {
t.Run(tt.name, func(t *testing.T) {
data := json.RawMessage(tt.data)
impl, err := f.Create(data)
if !errors.Is(err, tt.err) {
t.Logf("want: %v", tt.err)
t.Logf("got: %v", err)
t.Fatal("creation didn't do what was expected")
}
if tt.err != nil {
return
}
r, err := http.NewRequest(http.MethodGet, "/", nil)
if err != nil {
t.Fatalf("can't make request: %v", err)
}
if tt.ip != "" {
r.Header.Add("X-Real-Ip", tt.ip)
}
match, err := impl.Check(r)
if tt.match != match {
t.Errorf("match: %v, wanted: %v", match, tt.match)
}
if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
t.Errorf("err: %v, wanted: %v", err, tt.err)
}
if impl.Hash() == "" {
t.Error("hash method returns empty string")
}
})
}
}
// func TestRemoteAddrChecker(t *testing.T) {
// for _, tt := range []struct {
// err error
// name string
// ip string
// cidrs []string
// ok bool
// }{
// {
// name: "match_ipv4",
// cidrs: []string{"0.0.0.0/0"},
// ip: "1.1.1.1",
// ok: true,
// err: nil,
// },
// {
// name: "match_ipv6",
// cidrs: []string{"::/0"},
// ip: "cafe:babe::",
// ok: true,
// err: nil,
// },
// {
// name: "not_match_ipv4",
// cidrs: []string{"1.1.1.1/32"},
// ip: "1.1.1.2",
// ok: false,
// err: nil,
// },
// {
// name: "not_match_ipv6",
// cidrs: []string{"cafe:babe::/128"},
// ip: "cafe:babe:4::/128",
// ok: false,
// err: nil,
// },
// {
// name: "no_ip_set",
// cidrs: []string{"::/0"},
// ok: false,
// err: policy.ErrMisconfiguration,
// },
// {
// name: "invalid_ip",
// cidrs: []string{"::/0"},
// ip: "According to all natural laws of aviation",
// ok: false,
// err: policy.ErrMisconfiguration,
// },
// } {
// t.Run(tt.name, func(t *testing.T) {
// rac, err := NewRemoteAddrChecker(tt.cidrs)
// if err != nil && !errors.Is(err, tt.err) {
// t.Fatalf("creating RemoteAddrChecker failed: %v", err)
// }
// r, err := http.NewRequest(http.MethodGet, "/", nil)
// if err != nil {
// t.Fatalf("can't make request: %v", err)
// }
// if tt.ip != "" {
// r.Header.Add("X-Real-Ip", tt.ip)
// }
// ok, err := rac.Check(r)
// if tt.ok != ok {
// t.Errorf("ok: %v, wanted: %v", ok, tt.ok)
// }
// if err != nil && tt.err != nil && !errors.Is(err, tt.err) {
// t.Errorf("err: %v, wanted: %v", err, tt.err)
// }
// })
// }
// }

5
lib/policy/checker/remoteaddress/testdata/invalid_bad_cidr.json vendored
View File

@@ -1,5 +0,0 @@
{
"remote_addresses": [
"according to all laws of aviation"
]
}

3
lib/policy/checker/remoteaddress/testdata/invalid_no_cidr.json vendored
View File

@@ -1,3 +0,0 @@
{
"remote_addresses": []
}

1
lib/policy/checker/remoteaddress/testdata/invalid_not_json.json vendored
View File

@@ -1 +0,0 @@
]

5
lib/policy/checker/remoteaddress/testdata/valid_addresses.json vendored
View File

@@ -1,5 +0,0 @@
{
"remote_addresses": [
"1.1.1.1/32"
]
}

8
lib/policy/checker_test.go
View File

@@ -4,6 +4,8 @@ import (
"errors"
"net/http"
"testing"
"github.com/TecharoHQ/anubis"
)
func TestRemoteAddrChecker(t *testing.T) {
@@ -46,14 +48,14 @@ func TestRemoteAddrChecker(t *testing.T) {
name: "no_ip_set",
cidrs: []string{"::/0"},
ok: false,
err: ErrMisconfiguration,
err: anubis.ErrMisconfiguration,
},
{
name: "invalid_ip",
cidrs: []string{"::/0"},
ip: "According to all natural laws of aviation",
ok: false,
err: ErrMisconfiguration,
err: anubis.ErrMisconfiguration,
},
} {
t.Run(tt.name, func(t *testing.T) {
@@ -124,7 +126,7 @@ func TestHeaderMatchesChecker(t *testing.T) {
{
name: "invalid_regex",
rexStr: "a(b",
err: ErrMisconfiguration,
err: anubis.ErrMisconfiguration,
},
} {
t.Run(tt.name, func(t *testing.T) {

2
lib/policy/policy.go
View File

@@ -8,7 +8,7 @@ import (
"log/slog"
"sync/atomic"
"github.com/TecharoHQ/anubis/lib/policy/checker"
"github.com/TecharoHQ/anubis/lib/checker"
"github.com/TecharoHQ/anubis/lib/policy/config"
"github.com/TecharoHQ/anubis/lib/store"
"github.com/TecharoHQ/anubis/lib/thoth"