MFA fix, added IP blacklist, update webmail client

internal/abuseguard/abuseguard_test.go

@@ -0,0 +1,146 @@
+package abuseguard
+
+import (
+	"net"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"gopkg.in/ini.v1"
+
+	"mailgoserver/internal/db"
+)
+
+func testCfg(t *testing.T, threshold int) *ini.File {
+	t.Helper()
+	cfg := ini.Empty()
+	sec, _ := cfg.NewSection("Security")
+	sec.NewKey("abuse_detection_enabled", "true")
+	sec.NewKey("abuse_failure_threshold", strconv.Itoa(threshold))
+	sec.NewKey("abuse_detection_window_minutes", "10")
+	sec.NewKey("abuse_blacklist_base_hours", "12")
+	sec.NewKey("abuse_blacklist_max_hours", "168")
+	return cfg
+}
+
+func openTestDB(t *testing.T) *db.DB {
+	t.Helper()
+	database, err := db.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { database.Close() })
+	return database
+}
+
+func TestRecordFailureAndMaybeBlacklistTripsThreshold(t *testing.T) {
+	database := openTestDB(t)
+	cfg := testCfg(t, 3)
+	const ip = "203.0.113.50"
+
+	for i := 0; i < 2; i++ {
+		database.LogAuthAttempt("sender", "victim@example.com", ip, false, "bad password")
+		RecordFailureAndMaybeBlacklist(database, cfg, nil, ip)
+	}
+	if blocked, _ := database.IsIPBlacklisted(ip); blocked {
+		t.Fatal("should not be blacklisted before threshold")
+	}
+
+	database.LogAuthAttempt("sender", "victim@example.com", ip, false, "bad password")
+	RecordFailureAndMaybeBlacklist(database, cfg, nil, ip)
+
+	blocked, err := database.IsIPBlacklisted(ip)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !blocked {
+		t.Fatal("expected IP to be blacklisted after hitting the threshold")
+	}
+}
+
+func TestRecordFailureAndMaybeBlacklistSkipsWhitelisted(t *testing.T) {
+	database := openTestDB(t)
+	cfg := testCfg(t, 2)
+	const ip = "203.0.113.51"
+	if err := database.AddAbuseWhitelist(ip, "trusted"); err != nil {
+		t.Fatal(err)
+	}
+
+	for i := 0; i < 5; i++ {
+		database.LogAuthAttempt("sender", "victim@example.com", ip, false, "bad password")
+		RecordFailureAndMaybeBlacklist(database, cfg, nil, ip)
+	}
+
+	if blocked, _ := database.IsIPBlacklisted(ip); blocked {
+		t.Fatal("whitelisted IP should never be blacklisted")
+	}
+}
+
+// fakeListener yields exactly one already-open in-memory connection pair, then EOF-like
+// closed errors, letting GuardListener's Accept loop be tested without real sockets.
+type fakeListener struct {
+	conns chan net.Conn
+	done  chan struct{}
+}
+
+func newFakeListener(conns ...net.Conn) *fakeListener {
+	ch := make(chan net.Conn, len(conns))
+	for _, c := range conns {
+		ch <- c
+	}
+	return &fakeListener{conns: ch, done: make(chan struct{})}
+}
+
+func (f *fakeListener) Accept() (net.Conn, error) {
+	select {
+	case c := <-f.conns:
+		return c, nil
+	case <-f.done:
+		return nil, net.ErrClosed
+	}
+}
+func (f *fakeListener) Close() error   { close(f.done); return nil }
+func (f *fakeListener) Addr() net.Addr { return dummyAddr{} }
+
+type dummyAddr struct{}
+
+func (dummyAddr) Network() string { return "tcp" }
+func (dummyAddr) String() string  { return "0.0.0.0:0" }
+
+func TestGuardListenerRejectsBlacklistedIP(t *testing.T) {
+	database := openTestDB(t)
+	const blockedIP = "198.51.100.77"
+	if err := database.AddManualBlacklistEntry(blockedIP, "test", 1); err != nil {
+		t.Fatal(err)
+	}
+
+	blockedConn, blockedPeer := net.Pipe()
+	defer blockedPeer.Close()
+
+	inner := newFakeListener(&addrOverrideConn{Conn: blockedConn, remote: hostPortAddr(blockedIP)})
+	guarded := GuardListener(inner, database, nil)
+
+	go func() {
+		guarded.Accept()
+		inner.Close()
+	}()
+
+	// The blocked connection's peer end should observe the connection close rather
+	// than any protocol banner, since GuardListener closes it before returning it.
+	buf := make([]byte, 1)
+	if _, err := blockedPeer.Read(buf); err == nil {
+		t.Fatal("expected blocked connection to be closed by GuardListener, got readable data instead")
+	}
+}
+
+type addrOverrideConn struct {
+	net.Conn
+	remote net.Addr
+}
+
+func (c *addrOverrideConn) RemoteAddr() net.Addr { return c.remote }
+
+type hostPortAddr string
+
+func (hostPortAddr) Network() string  { return "tcp" }
+func (a hostPortAddr) String() string { return string(a) + ":12345" }