admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub R-435: each clean-up window explains one fall only; a window stuck open past its deadline explains nothing (security review)

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-08 14:38:24 +02:00
parent b15061efb2
commit e1ff3210eb
4 changed files with 110 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/store/r435_windows_between_test.go
+25 -8
View File
@@ -5,12 +5,20 @@ import (
"time"
)
// R-435: RemovedByWindowsBetween sums only windows closed inside the interval (or still open), and each
// R-435: WindowCreditsBetween lists only windows closed inside the interval (or still open), and each
// window explains at most its hub-set max_remove — a box's count_after cannot widen it, and a window with
// no usable count_after explains exactly its cap. Only a window with no cap makes the answer unknown.
// RED-PROOF (security review 2026-10-08): drop the max_remove cap → „lying box" returns 69, not 34 → FAILS.
func TestR435_RemovedByWindowsBetween(t *testing.T) {
s := newTestStore(t)
sum := func(cust string, from, to time.Time) (int, bool) {
cs, unk := s.WindowCreditsBetween(cust, from, to)
n := 0
for _, c := range cs {
n += c.Explains
}
return n, unk
}
at := func(ts string) time.Time { v, _ := time.Parse("2006-01-02 15:04:05", ts); return v }
ins := func(cust, opened, closed string, before, after, maxRemove any) {
t.Helper()
@@ -18,8 +26,9 @@ func TestR435_RemovedByWindowsBetween(t *testing.T) {
if closed != "" {
c = closed
}
closesBy := "2026-10-01 23:00:00" // a window's deadline; an open one past it before `from` is stale
if _, err := s.db.Exec(`INSERT INTO offsite_windows (customer_id, opened_at, closes_by, closed_at, count_before, count_after, max_remove) VALUES (?, ?, ?, ?, ?, ?, ?)`,
cust, opened, opened, c, before, after, maxRemove); err != nil {
cust, opened, closesBy, c, before, after, maxRemove); err != nil {
t.Fatal(err)
}
}
@@ -29,30 +38,38 @@ func TestR435_RemovedByWindowsBetween(t *testing.T) {
ins("b", "2026-10-01 03:00:00", "2026-10-01 03:10:00", 50, 40, 25) // another customer
from, to := at("2026-09-30 00:00:00"), at("2026-10-02 00:00:00")
if n, unk := s.RemovedByWindowsBetween("a", from, to); n != 9 || unk {
if n, unk := sum("a", from, to); n != 9 || unk {
t.Fatalf("a: want 9 known, got %d unknown=%v", n, unk)
}
if n, unk := s.RemovedByWindowsBetween("c", from, to); n != 0 || unk {
if n, unk := sum("c", from, to); n != 0 || unk {
t.Fatalf("no window: want 0 known, got %d unknown=%v", n, unk)
}
// a box that claims it removed everything explains only the cap the hub granted
ins("l", "2026-10-01 03:00:00", "2026-10-01 03:10:00", 69, 0, 34)
if n, unk := s.RemovedByWindowsBetween("l", from, to); n != 34 || unk {
if n, unk := sum("l", from, to); n != 34 || unk {
t.Fatalf("lying box: want the cap 34, got %d unknown=%v", n, unk)
}
// a timeout close (count_after −1) inside the interval → explains its cap
ins("d", "2026-10-01 03:00:00", "2026-10-01 03:40:00", 69, -1, 10)
if n, unk := s.RemovedByWindowsBetween("d", from, to); n != 10 || unk {
if n, unk := sum("d", from, to); n != 10 || unk {
t.Fatalf("timeout-closed window: want its cap 10, got %d unknown=%v", n, unk)
}
// a window still open → explains its cap
ins("e", "2026-10-01 03:00:00", "", 69, nil, 10)
if n, unk := s.RemovedByWindowsBetween("e", from, to); n != 10 || unk {
if n, unk := sum("e", from, to); n != 10 || unk {
t.Fatalf("open window: want its cap 10, got %d unknown=%v", n, unk)
}
// a window stuck open past its deadline before the interval explains nothing
ins("g", "2026-09-01 03:00:00", "", 69, nil, 10)
if _, err := s.db.Exec(`UPDATE offsite_windows SET closes_by = '2026-09-01 04:00:00' WHERE customer_id = 'g'`); err != nil {
t.Fatal(err)
}
if n, unk := sum("g", from, to); n != 0 || unk {
t.Fatalf("stale open window: want 0, got %d unknown=%v", n, unk)
}
// a window with no cap → unknown (the caller falls back to the half-rule)
ins("f", "2026-10-01 03:00:00", "2026-10-01 03:10:00", 69, 60, nil)
if _, unk := s.RemovedByWindowsBetween("f", from, to); !unk {
if _, unk := sum("f", from, to); !unk {
t.Fatal("a window with no cap must make the interval unknown")
}
}