Premiere commit - Omika

2026-10-23 18:46:50 +02:00
commit 8ea76c1b24
2155 changed files with 984301 additions and 0 deletions
@@ -0,0 +1,83 @@
+using System.Net;
+using Microsoft.AspNetCore.HttpOverrides;
+using Omika.Api;
+
+namespace Omika.Tests.Api;
+
+/// <summary>
+/// Tests de la configuration ForwardedHeaders (reverse proxy Apache local).
+/// Vérifient le contenu exact des options (en-têtes, ForwardLimit, KnownProxies)
+/// et l'absence de toute configuration « trust-all » (symétrie conservée,
+/// KnownNetworks jamais vidé, aucun proxy non-loopback).
+/// </summary>
+public class ForwardedHeadersConfigurationTests
+{
+    [Fact]
+    public void CreateOptions_ConfiguresForwardedHeaders()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        Assert.Equal(
+            ForwardedHeaders.XForwardedFor
+                | ForwardedHeaders.XForwardedProto
+                | ForwardedHeaders.XForwardedHost,
+            options.ForwardedHeaders);
+    }
+
+    [Fact]
+    public void CreateOptions_SetsForwardLimitToOne()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        Assert.Equal(1, options.ForwardLimit);
+    }
+
+    [Fact]
+    public void CreateOptions_AddsIpv4LoopbackAsKnownProxy()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        Assert.Contains(IPAddress.Loopback, options.KnownProxies);
+    }
+
+    [Fact]
+    public void CreateOptions_AddsIpv6LoopbackAsKnownProxy()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        Assert.Contains(IPAddress.IPv6Loopback, options.KnownProxies);
+    }
+
+    [Fact]
+    public void CreateOptions_OnlyTrustsLoopbackProxies()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        // Aucun wildcard (0.0.0.0 / [::]) : uniquement le proxy Apache local.
+        Assert.DoesNotContain(IPAddress.Any, options.KnownProxies);
+        Assert.DoesNotContain(IPAddress.IPv6Any, options.KnownProxies);
+        Assert.All(options.KnownProxies, ip => Assert.True(IPAddress.IsLoopback(ip)));
+    }
+
+    [Fact]
+    public void CreateOptions_KeepsRequireHeaderSymmetryEnabled()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        // La symétrie des en-têtes reste activée (défaut sécurisé) : jamais
+        // désactivée pour une configuration permissive globale.
+        Assert.True(options.RequireHeaderSymmetry);
+    }
+
+    [Fact]
+    public void CreateOptions_DoesNotClearKnownNetworks()
+    {
+        var options = ForwardedHeadersConfiguration.CreateOptions();
+
+        // KnownIPNetworks (anciennement KnownNetworks) conserve ses réseaux par
+        // défaut (loopback) : jamais vidé.
+        Assert.NotEmpty(options.KnownIPNetworks);
+        // La confiance réseau reste bornée au loopback (127.0.0.1/8 et ::1/128).
+        Assert.All(options.KnownIPNetworks, network => Assert.True(IPAddress.IsLoopback(network.BaseAddress)));
+    }
+}