/** * 指示書I 段階1 の期待値表をそのまま固定したテスト。 * ★表を先に確定させてから書いている（CLAUDE.md §6-2）。行を削らないこと★ */ import { describe, expect, it } from "vitest"; import { clientIp, isAllowedIp } from "@/lib/auth/client-ip"; import { ALLOW_ALL_WHEN_EMPTY, ALLOW_DIRECT_ACCESS, TRUSTED_PROXY_HOPS, } from "@/lib/config/allowed-ips"; describe("clientIp() — X-Forwarded-For から接続元を取る", () => { const cases: Array<{ name: string; header: string | null; hops: number; expected: string | null; }> = [ { name: "正常系のメインケース: nginx が末尾に追記する（D-077 項5）。先頭の自称は信じない", header: "1.2.3.4, 203.0.113.10", hops: 1, expected: "203.0.113.10", }, { name: "単一要素（クライアントが XFF を送らず nginx が1個足した正常系でもあり得る）", header: "203.0.113.10", hops: 1, expected: "203.0.113.10", }, { name: "多段でも末尾", header: "1.2.3.4, 5.6.7.8, 203.0.113.10", hops: 1, expected: "203.0.113.10", }, { name: "★将来2段構成になった場合★: 末尾から2番目が本当のクライアント（10.0.0.5 は LB の内部IP）", header: "1.2.3.4, 203.0.113.10, 10.0.0.5", hops: 2, expected: "203.0.113.10", }, { name: "★要素数が hops に満たない → null。先頭で埋めないこと★", header: "1.2.3.4, 203.0.113.10", hops: 3, expected: null, }, { name: "前後の空白を落とす", header: " 203.0.113.10 ", hops: 1, expected: "203.0.113.10", }, { name: "末尾が空 → 取れない扱い", header: "1.2.3.4,", hops: 1, expected: null, }, { name: "空文字", header: "", hops: 1, expected: null }, { name: "ヘッダ無し ＝ nginx を通っていない（直接アクセス）", header: null, hops: 1, expected: null, }, { name: "★同名ヘッダが複数行来ても Headers.get() が ', ' で連結するので分割で足りる★", header: "1.2.3.4, 5.6.7.8, 203.0.113.10", hops: 1, expected: "203.0.113.10", }, { name: "★IPv6。正規化しない★", header: "1.2.3.4, ::1", hops: 1, expected: "::1", }, { name: "★IPv4射影アドレス。203.0.113.10 に展開しない★", header: "1.2.3.4, ::ffff:203.0.113.10", hops: 1, expected: "::ffff:203.0.113.10", }, { name: "★ポート付き。ポートを剥がさない★", header: "1.2.3.4, [2001:db8::1]:54321", hops: 1, expected: "[2001:db8::1]:54321", }, ]; for (const { name, header, hops, expected } of cases) { it(`${name}（header=${JSON.stringify(header)} / hops=${hops}）`, () => { expect(clientIp(header, hops)).toBe(expected); }); } it("undefined（ヘッダ未取得）も null 扱い", () => { expect(clientIp(undefined, 1)).toBeNull(); }); it("★先頭の自称IPを絶対に返さないこと★（IP制限の素通りを防ぐ最重要の性質）", () => { // 攻撃者が許可IPを先頭に詐称したケース expect(clientIp("203.0.113.10, 198.51.100.9", 1)).toBe("198.51.100.9"); expect(clientIp("203.0.113.10, 198.51.100.9", 1)).not.toBe("203.0.113.10"); }); }); describe("isAllowedIp() — 3軸（ip が null か / allowlist が空か / 直接アクセスを許すか）", () => { const cases: Array<{ row: number; ip: string | null; allowedIps: readonly string[]; allowAllWhenEmpty: boolean; allowDirectAccess: boolean; expected: boolean; note: string; }> = [ { row: 1, ip: "203.0.113.10", allowedIps: ["203.0.113.10"], allowAllWhenEmpty: false, allowDirectAccess: false, expected: true, note: "一致", }, { row: 2, ip: "203.0.113.11", allowedIps: ["203.0.113.10"], allowAllWhenEmpty: false, allowDirectAccess: false, expected: false, note: "不一致", }, { row: 3, ip: "203.0.113.10", allowedIps: ["203.0.113.10"], allowAllWhenEmpty: true, allowDirectAccess: false, expected: true, note: "一致（allowAllWhenEmpty は空でないので無関係）", }, { row: 4, ip: "203.0.113.11", allowedIps: ["203.0.113.10"], allowAllWhenEmpty: true, allowDirectAccess: false, expected: false, note: "★allowlist が空でなければ allowAllWhenEmpty は効かない★", }, { row: 5, ip: "203.0.113.10", allowedIps: [], allowAllWhenEmpty: true, allowDirectAccess: false, expected: true, note: "制限なし（開発時の既定）", }, { row: 6, ip: "203.0.113.10", allowedIps: [], allowAllWhenEmpty: false, allowDirectAccess: false, expected: false, note: "★全拒否（本番想定の設定ミス検知）★", }, { row: 7, ip: null, allowedIps: ["203.0.113.10"], allowAllWhenEmpty: false, allowDirectAccess: false, expected: false, note: "直接アクセスは拒否", }, { row: 8, ip: null, allowedIps: ["203.0.113.10"], allowAllWhenEmpty: true, allowDirectAccess: false, expected: false, note: "同上", }, { row: 9, ip: null, allowedIps: [], allowAllWhenEmpty: true, allowDirectAccess: false, expected: false, note: "★既定状態（allowlist 空）でも直接アクセスは通さない★", }, { row: 10, ip: null, allowedIps: [], allowAllWhenEmpty: false, allowDirectAccess: false, expected: false, note: "同上", }, { row: 11, ip: null, allowedIps: [], allowAllWhenEmpty: true, allowDirectAccess: true, expected: true, note: "★ローカル開発。ALLOW_DIRECT_ACCESS=true を明示したときだけ通る★", }, { row: 12, ip: null, allowedIps: ["203.0.113.10"], allowAllWhenEmpty: false, allowDirectAccess: true, expected: true, note: "★直接アクセスを許した以上、照合すべきIPが無いので通す★", }, ]; for (const c of cases) { it(`行${c.row}: ip=${JSON.stringify(c.ip)} / allowedIps=${JSON.stringify( c.allowedIps )} / allowAllWhenEmpty=${c.allowAllWhenEmpty} / allowDirectAccess=${ c.allowDirectAccess } → ${c.expected}（${c.note}）`, () => { expect( isAllowedIp( c.ip, c.allowedIps, c.allowAllWhenEmpty, c.allowDirectAccess ) ).toBe(c.expected); }); } it("★ip が null のとき allowAllWhenEmpty は結果を一切変えない★（行7〜10 の性質を明示）", () => { for (const allowAllWhenEmpty of [true, false]) { for (const allowedIps of [[], ["203.0.113.10"]]) { expect(isAllowedIp(null, allowedIps, allowAllWhenEmpty, false)).toBe( false ); expect(isAllowedIp(null, allowedIps, allowAllWhenEmpty, true)).toBe( true ); } } }); it("★CIDR は解釈しない（完全一致のみ）★ — P1 の割り切り", () => { expect(isAllowedIp("192.0.2.5", ["192.0.2.0/24"], false, false)).toBe( false ); // 書いた文字列そのものとしてなら一致する（＝ CIDR として動いてはいない証拠） expect(isAllowedIp("192.0.2.0/24", ["192.0.2.0/24"], false, false)).toBe( true ); }); it("★表記ゆれは正規化しないので拒否になる★", () => { expect( isAllowedIp("::ffff:203.0.113.10", ["203.0.113.10"], false, false) ).toBe(false); expect( isAllowedIp("[2001:db8::1]:54321", ["2001:db8::1"], false, false) ).toBe(false); }); }); describe("lib/config/allowed-ips.ts の既定値", () => { it("TRUSTED_PROXY_HOPS は 1（LB と nginx は同一＝1段。D-079 項1）", () => { expect(TRUSTED_PROXY_HOPS).toBe(1); }); it("ALLOW_ALL_WHEN_EMPTY の既定は true（開発を止めないため。★本番では false にする★）", () => { expect(ALLOW_ALL_WHEN_EMPTY).toBe(true); }); it("★ALLOW_DIRECT_ACCESS は環境変数由来で、テスト実行時（未設定）は false になること★", () => { // `=== "true"` なので未設定は false。`!== "false"` にすると ここが true になって落ちる expect(ALLOW_DIRECT_ACCESS).toBe(process.env.ALLOW_DIRECT_ACCESS === "true"); if (process.env.ALLOW_DIRECT_ACCESS === undefined) { expect(ALLOW_DIRECT_ACCESS).toBe(false); } }); });