Initial curated CertScope source from fe2bbe3ca5c98bf64be26a09c6c58ee805a7f87e

lib/inspect/admission.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { checkRateLimit, clientKeyFromHeaders, MAX_IN_FLIGHT_INSPECTIONS, RATE_LIMIT_MAX_REQUESTS, RATE_LIMIT_WINDOW_MS, tryAcquireInspection } from "./admission";
+
+describe("inspection admission", () => {
+  it("rejects work beyond the bounded in-flight budget", () => {
+    const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());
+
+    expect(releases.every(Boolean)).toBe(true);
+    expect(tryAcquireInspection()).toBeNull();
+
+    releases.forEach((release) => release?.());
+    const release = tryAcquireInspection();
+    expect(release).not.toBeNull();
+    release?.();
+  });
+
+  it("releases capacity at most once", () => {
+    const release = tryAcquireInspection();
+    expect(release).not.toBeNull();
+    release?.();
+    release?.();
+
+    const releases = Array.from({ length: MAX_IN_FLIGHT_INSPECTIONS }, () => tryAcquireInspection());
+    expect(releases.every(Boolean)).toBe(true);
+    releases.forEach((item) => item?.());
+  });
+
+  it("applies a bounded per-client sliding-window limit", () => {
+    const key = "test-client-" + Math.random();
+    const now = 1_000_000;
+    for (let index = 0; index < RATE_LIMIT_MAX_REQUESTS; index += 1) {
+      expect(checkRateLimit(key, now + index)).toMatchObject({ allowed: true });
+    }
+    expect(checkRateLimit(key, now + RATE_LIMIT_MAX_REQUESTS)).toMatchObject({ allowed: false });
+    expect(checkRateLimit(key, now + RATE_LIMIT_WINDOW_MS + 1)).toMatchObject({ allowed: true });
+  });
+
+  it("does not trust forwarded client identity unless proxy trust is enabled", () => {
+    const headers = { get: (name: string) => name === "x-forwarded-for" ? "198.51.100.10, 10.0.0.1" : null };
+    const previous = process.env.CERTSCOPE_TRUST_PROXY;
+    delete process.env.CERTSCOPE_TRUST_PROXY;
+    expect(clientKeyFromHeaders(headers)).toBe("direct");
+    process.env.CERTSCOPE_TRUST_PROXY = "true";
+    expect(clientKeyFromHeaders(headers)).toBe("proxy:198.51.100.10");
+    if (previous === undefined) delete process.env.CERTSCOPE_TRUST_PROXY;
+    else process.env.CERTSCOPE_TRUST_PROXY = previous;
+  });
+});