Xtimms/psu-schedule
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Implement rate limiting, request timeouts, and security headers for improved server protection

Browse Source
This commit is contained in:
Zakhar Timoshenko
2026-10-19 23:15:05 +03:00
parent 7206bf9c4a
commit 85c5baa3e5
8 changed files with 291 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
test/api.test.js
View File

@@ -1,79 +1,15 @@
import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import { createServer } from "node:http";
import { readFileSync, mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { academicStartYear, todayIso } from "../shared/weeks.js";
import { startApi, fixture } from "./support/nextcloud.js";
// The API over HTTP, as the Android and iOS clients see it: the real server against a stand-in
// for the university's Nextcloud that serves the fixtures as a small catalog.
const SHARE = "/public.php/dav/files/no5zKbMrns6j5jQ/";
const fixture = (name) => readFileSync(new URL(`./fixtures/${name}`, import.meta.url));
const year = academicStartYear(todayIso());
const YEAR = `${year}-${year + 1}`;
const FOLDER = `${SHARE}${YEAR}/Финансово-экономический факультет/Дневная форма/`;
const MODIFIED = "Mon, 14 Sep 2026 13:05:15 GMT";
const files = {
[`${SHARE}Расписание белых и зеленых недель.docx`]: fixture("weeks.docx"),
[`${SHARE}Расписание звонков.docx`]: fixture("bells.docx"),
[`${FOLDER}23-ЛГ_23-БА.docx`]: fixture("fef-23-ba.docx"),
[`${FOLDER}24-ИТ.docx`]: fixture("fit-daily.docx"),
// The university fails on one document and is too slow on another.
[`${FOLDER}Сломанный.docx`]: 500,
[`${FOLDER}Медленный.docx`]: "slow",
};
const folders = [SHARE, `${SHARE}${YEAR}/`, `${SHARE}${YEAR}/Финансово-экономический факультет/`, FOLDER];
const encode = (path) => path.split("/").map(encodeURIComponent).join("/");
const listing = (folder) => {
const children = [...folders.filter((f) => f !== folder && f.startsWith(folder) && !f.slice(folder.length, -1).includes("/")),
...Object.keys(files).filter((f) => f.startsWith(folder) && !f.slice(folder.length).includes("/"))];
const entry = (path) => {
const folder = path.endsWith("/");
const size = Buffer.isBuffer(files[path]) ? files[path].length : 1000;
return `<d:response><d:href>${encode(path)}</d:href><d:propstat><d:prop>${
folder ? "<d:resourcetype><d:collection/></d:resourcetype>" : `<d:resourcetype/><d:getcontentlength>${size}</d:getcontentlength>`
}<d:getlastmodified>${MODIFIED}</d:getlastmodified></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>`;
};
return `<?xml version="1.0"?><d:multistatus xmlns:d="DAV:">${[folder, ...children].map(entry).join("")}</d:multistatus>`;
};
let source, server, base, data;
const stats = { requests: 0, connections: 0 };
let api, base, stats;
before(async () => {
source = createServer((req, res) => {
stats.requests++;
const path = decodeURIComponent(req.url);
if (req.method === "PROPFIND" && folders.includes(path)) {
res.writeHead(207, { "Content-Type": "application/xml" });
return res.end(listing(path));
}
const body = files[path];
if (body === "slow") return setTimeout(() => res.end("late"), 2000);
if (typeof body === "number" || !body) return res.writeHead(body || 404).end();
res.end(body);
});
source.on("connection", () => stats.connections++);
await new Promise((resolve) => source.listen(0, "127.0.0.1", resolve));
data = mkdtempSync(join(tmpdir(), "psu-api-"));
process.env.PSU_SOURCE_ORIGIN = `http://127.0.0.1:${source.address().port}`;
process.env.PSU_DATA_DIR = data;
process.env.PSU_SOURCE_TIMEOUT_MS = "500";
const { app } = await import("../server/index.js");
server = app.listen(0, "127.0.0.1");
await new Promise((resolve) => server.on("listening", resolve));
base = `http://127.0.0.1:${server.address().port}`;
});
after(() => {
server?.close();
server?.closeAllConnections();
source?.closeAllConnections();
source?.close();
rmSync(data, { recursive: true, force: true });
api = await startApi();
({ base, stats } = api);
});
after(() => api?.stop());
const get = (path, headers = {}) => fetch(base + path, { headers });
const json = async (path) => {
@@ -88,6 +24,7 @@ test("API: до загрузки индекса сервер жив, но не
assert.equal(health.status, 200);
assert.equal(health.body.ok, true);
assert.equal(health.body.ready, false);
assert.equal(health.body.client, "127.0.0.1");
assert.equal(typeof health.body.apiVersion, "number");
const ready = await json("/api/ready");
assert.equal(ready.status, 503);