mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 18:34:02 +00:00
Said TurkseverandClaude Fable 5.1
55f979c128
Address gekh's review of 69a87fe2:
- P1: /api/overpass now uses admitSameSiteKeyless, like /api/terrain/heights,
so an instance behind the README's reverse proxy keeps its Overpass-backed
layers; cross-site shapes are still refused and forwarding headers no
longer launder them. SECURITY.md, the gate header and CURRENT-STATE say so.
- P2: admission keys IPv6 peers by /64 and folds IPv4-mapped peers
(clientNetworkKey), and loopback has its own 300/min window outside the
900/min global, so a few LAN peers cannot lock the owner's browser out.
- P2 (track): the settle and reveal frames each get their own 500 ms budget,
measured from moveEnd and from the settle frame respectively, so a ~300 ms
SwiftShader frame no longer trips the reveal deadline while both stay
inside the 1 s idle refresh.
- Smaller: drop the dead settings-block check and stale probe comment in
query.js, clamp whitespace-tolerant [ timeout : N ], and add tests for the
global window, the /64 keying, loopback headroom, proxied admission and
cache hits spending admission but not upstream budget.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
38 lines
1.4 KiB
JavaScript
38 lines
1.4 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { clientNetworkKey, isLoopbackPeer } from './rate-limit.js';
|
|
|
|
const req = (remoteAddress) => ({ socket: { remoteAddress } });
|
|
|
|
test('clientNetworkKey keys IPv6 peers by /64 and folds IPv4-mapped peers', () => {
|
|
assert.equal(clientNetworkKey(req('2001:db8:1:2::1')), '2001:db8:1:2::/64');
|
|
assert.equal(
|
|
clientNetworkKey(req('2001:0db8:0001:0002:abcd:ef01:2345:6789')),
|
|
'2001:db8:1:2::/64',
|
|
);
|
|
assert.equal(clientNetworkKey(req('2001:DB8::1')), '2001:db8:0:0::/64');
|
|
assert.equal(clientNetworkKey(req('fe80::1%en0')), 'fe80:0:0:0::/64');
|
|
assert.equal(clientNetworkKey(req('::1')), '0:0:0:0::/64');
|
|
assert.equal(clientNetworkKey(req('::ffff:10.0.0.5')), '10.0.0.5');
|
|
assert.equal(clientNetworkKey(req('10.0.0.5')), '10.0.0.5');
|
|
assert.equal(clientNetworkKey(req(undefined)), 'local');
|
|
assert.equal(clientNetworkKey(req('not-an-address')), 'not-an-address');
|
|
});
|
|
|
|
test('isLoopbackPeer recognizes every loopback form and nothing else', () => {
|
|
for (const address of ['127.0.0.1', '127.9.9.9', '::1', '::ffff:127.0.0.1']) {
|
|
assert.equal(isLoopbackPeer(address), true, address);
|
|
}
|
|
for (const address of [
|
|
'10.0.0.1',
|
|
'::ffff:10.0.0.1',
|
|
'2001:db8::1',
|
|
'::2',
|
|
'local',
|
|
'',
|
|
undefined,
|
|
]) {
|
|
assert.equal(isLoopbackPeer(address), false, String(address));
|
|
}
|
|
});
|