init

2026-09-10 12:30:42 +02:00
commit 9843fe0c50
79 changed files with 16318 additions and 0 deletions
@@ -0,0 +1,63 @@
+package server
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	"finance-duck/internal/app"
+)
+
+func TestOriginAndHostGuardProtectNoLoginService(t *testing.T) {
+	t.Setenv("OPENROUTER_API_KEY", "")
+	t.Setenv("ENABLEBANKING_APP_ID", "")
+	t.Setenv("ENABLEBANKING_KEY_FILE", "")
+	t.Setenv("ENABLEBANKING_REDIRECT_URL", "")
+	a, err := app.Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer a.Close()
+	h, err := New(a, fstest.MapFS{"index.html": &fstest.MapFile{Data: []byte("<!doctype html><title>Finance</title>")}}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	cases := []struct {
+		name, host, origin, content string
+		want                        int
+	}{{"rebound host", "attacker.example", "", "application/json", 403}, {"cross origin", "localhost:8080", "https://attacker.example", "application/json", 403}, {"simple form CSRF", "localhost:8080", "", "text/plain", 415}, {"valid local mutation", "localhost:8080", "http://localhost:8080", "application/json", 200}}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPost, "http://localhost:8080/api/settings", strings.NewReader(`{"model":"example/model","include_amount":false}`))
+			r.Host = tt.host
+			r.Header.Set("Content-Type", tt.content)
+			r.Header.Set("Origin", tt.origin)
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tt.want {
+				t.Fatalf("got %d: %s", w.Code, w.Body.String())
+			}
+		})
+	}
+	r := httptest.NewRequest(http.MethodGet, "http://localhost:8080/api/state", nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	var s app.State
+	if err = json.NewDecoder(w.Body).Decode(&s); err != nil {
+		t.Fatal(err)
+	}
+	if s.Settings.Model != "example/model" {
+		t.Fatal("same-origin edit not persisted")
+	}
+	r = httptest.NewRequest(http.MethodGet, "http://localhost:8080/", nil)
+	w = httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	b, _ := io.ReadAll(w.Body)
+	if w.Code != 200 || !strings.Contains(string(b), "<!doctype html>") {
+		t.Fatalf("UI not served: %d %s", w.Code, b)
+	}
+}