Pace provider traffic and identify genuine foreground bank requests

internal/server/server_test.go

@@ -9,11 +9,13 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 	"testing/fstest"
 
 	"finance-duck/internal/app"
+	"finance-duck/internal/banking"
 )
 
 func TestOriginAndHostGuardProtectNoLoginService(t *testing.T) {
@@ -213,3 +215,95 @@ func TestBankingConfigurationProtectsPrivateKeyAndCallbackOrigin(t *testing.T) {
 	configured(check("POST", endpoint, `{"remove":true}`, origin, http.StatusOK), false)
 	configured(check("GET", "/api/state", "", origin, http.StatusOK), false)
 }
+
+type psuRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f psuRoundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) {
+	return f(r)
+}
+
+func TestManualBankContextUsesOnlyTrustedPeerAndBrowserMetadata(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	origin, err := url.Parse("https://finance.internal")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tt := range []struct {
+		name      string
+		public    bool
+		peer      string
+		forwarded []string
+		wantIP    string
+		userAgent string
+	}{
+		{"direct rejects forwarding", false, "198.51.100.8:1234", []string{"192.0.2.99"}, "198.51.100.8", "real-browser"},
+		{"untrusted remote proxy", true, "198.51.100.8:1234", []string{"192.0.2.99"}, "198.51.100.8", "real-browser"},
+		{"unconfigured loopback", false, "127.0.0.1:1234", []string{"192.0.2.99"}, "127.0.0.1", "real-browser"},
+		{"trusted appended hop", true, "127.0.0.1:1234", []string{"192.0.2.99, 203.0.113.42"}, "203.0.113.42", "real-browser"},
+		{"last header appended hop", true, "[::1]:1234", []string{"192.0.2.99", "203.0.113.42"}, "203.0.113.42", "real-browser"},
+		{"IPv6 client", true, "[::1]:1234", []string{"192.0.2.99, 2001:db8::42"}, "2001:db8::42", "real-browser"},
+		{"missing trusted hop", true, "127.0.0.1:1234", nil, "", "real-browser"},
+		{"invalid appended hop not leading spoof", true, "127.0.0.1:1234", []string{"192.0.2.99, invalid"}, "", "real-browser"},
+		{"unknown peer and absent user agent", false, "invalid", []string{"192.0.2.99"}, "", ""},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &Server{}
+			if tt.public {
+				s.origin = origin
+			}
+			r := httptest.NewRequest(http.MethodPost, "https://finance.internal/api/backfill?secret=private", strings.NewReader(`{}`))
+			r.RemoteAddr = tt.peer
+			r.Header["X-Forwarded-For"] = tt.forwarded
+			r.Header.Set("User-Agent", tt.userAgent)
+			r.Header.Set("Accept", "application/json")
+			r.Header.Set("Accept-Charset", "utf-8")
+			r.Header.Set("Accept-Encoding", "gzip, br")
+			r.Header.Set("Accept-Language", "de-DE")
+			for _, name := range []string{"Cookie", "Authorization", "Referer", "Psu-Ip-Address", "Psu-User-Agent", "Psu-Referer", "Psu-Geo-Location", "Psu-Cookie"} {
+				r.Header.Set(name, "private-spoofed-value")
+			}
+			p, err := banking.NewEnableBanking("test-app", keyPEM, "https://finance.internal/api/banking/callback")
+			if err != nil {
+				t.Fatal(err)
+			}
+			called := false
+			p.HTTPClient = &http.Client{Transport: psuRoundTripFunc(func(out *http.Request) (*http.Response, error) {
+				called = true
+				want := map[string]string{
+					"Psu-Ip-Address": tt.wantIP, "Psu-User-Agent": tt.userAgent,
+					"Psu-Accept": "application/json", "Psu-Accept-Charset": "utf-8",
+					"Psu-Accept-Encoding": "gzip, br", "Psu-Accept-Language": "de-DE",
+				}
+				for name, value := range want {
+					if got := out.Header.Get(name); got != value {
+						t.Errorf("%s = %q, want %q", name, got, value)
+					}
+				}
+				for name, values := range out.Header {
+					if strings.HasPrefix(strings.ToLower(name), "psu-") {
+						if _, allowed := want[name]; !allowed {
+							t.Errorf("unexpected PSU header %s", name)
+						}
+					}
+					if strings.Contains(strings.Join(values, ","), "private") {
+						t.Errorf("secret request metadata leaked in %s", name)
+					}
+				}
+				if out.URL.RawQuery != "" || out.Header.Get("Cookie") != "" || out.Header.Get("Referer") != "" {
+					t.Error("request URL or secret headers copied to bank")
+				}
+				return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"balances":[]}`))}, nil
+			})}
+			if _, err := p.Balances(s.manualBankContext(r), "uid"); err != nil {
+				t.Fatal(err)
+			}
+			if !called {
+				t.Fatal("manual retrieval never reached bank transport")
+			}
+		})
+	}
+}