Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

tests/security/test_proxy_trust.py

@@ -0,0 +1,52 @@
+"""The reverse-proxy boundary must reject client-supplied forwarding metadata."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
+
+
+def _resolved_client(*, peer: str, trusted: tuple[str, ...]) -> tuple[str, int]:
+    seen: dict[str, tuple[str, int]] = {}
+
+    async def app(scope: dict[str, Any], receive: Any, send: Any) -> None:
+        seen["client"] = scope["client"]
+
+    async def receive() -> dict[str, str]:
+        return {"type": "http.disconnect"}
+
+    async def send(message: dict[str, Any]) -> None:
+        return None
+
+    middleware = ProxyHeadersMiddleware(app, trusted_hosts=list(trusted))
+    scope: dict[str, Any] = {
+        "type": "http",
+        "scheme": "http",
+        "client": (peer, 50000),
+        "headers": [(b"x-forwarded-for", b"203.0.113.25")],
+    }
+    asyncio.run(middleware(scope, receive, send))
+    return seen["client"]
+
+
+def test_untrusted_peer_cannot_spoof_the_rate_limit_client_identity() -> None:
+    assert _resolved_client(peer="192.168.10.55", trusted=("172.30.50.2",)) == (
+        "192.168.10.55",
+        50000,
+    )
+
+
+def test_docker_gateway_cannot_spoof_client_identity() -> None:
+    assert _resolved_client(peer="172.30.50.1", trusted=("172.30.50.2",)) == (
+        "172.30.50.1",
+        50000,
+    )
+
+
+def test_trusted_proxy_can_forward_the_real_client_identity() -> None:
+    assert _resolved_client(peer="172.30.50.2", trusted=("172.30.50.2",)) == (
+        "203.0.113.25",
+        0,
+    )