Security in production

const spider = @import("spider");

pub const config = spider.Config{
    .views_dir = "./src",
    // The proxy in front of the app: its X-Forwarded-For is believed, and
    // nobody else's. The tests talk to the server from this address.
    .trusted_proxies = &.{"127.0.0.1"},
    // A payment provider posts to /hooks/... from its own site, in the
    // visitor's browser: the one place a cross-site POST is expected.
    .origin_check = .{ .exempt_paths = &.{"/hooks/"} },
    // Nothing larger than this is read: an upload over it gets a 413.
    .max_body_bytes = 1024 * 1024,
};

/// What a main() would do to serve. The tests start it once
/// (`spider.testing.start(run)`) and share it.
pub fn run() !void {
    // One client for the bucket, made once. In an app the values come from
    // the environment: `spider.r2.R2.initFromEnv(io)`.
    // (`io` is the one main() received; this package has no main.)
    const io = std.Options.debug_io;
    store = try spider.r2.R2.init(io, .{
        .account_id = "0a1b2c3d4e5f",
        .access_key = "an-access-key-id",
        .secret_key = "a-secret-access-key",
        .bucket = "guide-files",
        .pub_url = "https://files.guide.example",
    });
    defer store.deinit();

    var server = spider.app(.{});
    defer server.deinit();

    try server
        .use(spider.loggerWith(.{ .quiet_paths = &.{ "/up", "/assets/**" } }))
        .use(spider.forceHttps(.{ .default_base_url = "https://guide.example" }))
        .use(spider.varyHtmx)
        .get("/whoami", whoami, .{ .public = true })
        .post("/notes", addNote, .{ .public = true })
        .post("/hooks/payments", paymentHook, .{ .public = true, .allow_http = true })
        .post("/photos", addPhoto, .{ .public = true })
        .get("/photos/report", photoReport, .{ .public = true })
        .sseWith("/ticks", ticks, .{ .public = true })
        .wsWith("/rooms/:room/chat", chat, .{ .public = true })
        .wsWith("/staff/feed", staffFeed, .{ .authenticated = true })
        .get("/orders.xlsx", exportOrders, .{ .public = true })
        .post("/orders/import", importOrders, .{ .public = true })
        .get("/tickets/:code/qr.svg", ticketQr, .{ .public = true })
        .post("/avatars/sign", signAvatarUpload, .{ .public = true })
        .get("/invoices/:number", invoice, .{ .public = true })
        .post("/reports", keepReport, .{ .public = true })
        .get("/auth/google", googleLogin, .{ .public = true })
        .get("/auth/google/callback", googleCallback, .{ .public = true })
        .get("/shop", shop, .{ .public = true })
        .get("/shop/typo", shopTypo, .{ .public = true })
        .get("/shop/receipt", receipt, .{ .public = true })
        .get("/tasks", tasks, .{ .public = true })
        .post("/tasks", addTask, .{ .public = true })
        .post("/tasks/:id/archive", archiveTask, .{ .public = true })
        .onError(spider.errorHandler(.{}))
        .listen(.{});
}

test "cross-site: a form on another site cannot post here; the app's own pages and other programs can" {
    const app = try spider.testing.start(run);

    // A browser says where a request comes from. Another site: refused
    // before any route is looked at.
    var forged = try app.request(.{ .method = "POST", .target = "/notes", .body = "", .headers = &.{ "Sec-Fetch-Site: cross-site", "Origin: https://evil.example" } });
    defer forged.deinit();
    try forged.expectStatus(403);

    // The app's own page.
    var own = try app.request(.{ .method = "POST", .target = "/notes", .body = "", .headers = &.{"Sec-Fetch-Site: same-origin"} });
    defer own.deinit();
    try own.expectStatus(201);

    // Not a browser (a script, another server): it carries nobody's
    // cookies, so there is nothing to forge.
    var program = try app.request(.{ .method = "POST", .target = "/notes", .body = "" });
    defer program.deinit();
    try program.expectStatus(201);
}

test "cross-site: a path the config exempts takes posts from anywhere" {
    const app = try spider.testing.start(run);
    var res = try app.request(.{ .method = "POST", .target = "/hooks/payments", .body = "", .headers = &.{ "Sec-Fetch-Site: cross-site", "Origin: https://pay.example" } });
    defer res.deinit();
    try res.expectStatus(200);
}

test "https: a request that came over plain HTTP is sent to the HTTPS address" {
    const app = try spider.testing.start(run);

    // The proxy says which one the visitor used.
    var plain = try app.with(&.{"X-Forwarded-Proto: http"}).get("/whoami?x=1");
    defer plain.deinit();
    try plain.expectRedirect("https://guide.example/whoami?x=1");

    var secure = try app.with(&.{"X-Forwarded-Proto: https"}).get("/whoami");
    defer secure.deinit();
    try secure.expectStatus(200);

    // A route that says `.allow_http` answers either way.
    var hook = try app.request(.{ .method = "POST", .target = "/hooks/payments", .body = "", .headers = &.{"X-Forwarded-Proto: http"} });
    defer hook.deinit();
    try hook.expectStatus(200);
}

/// The address of the visitor and the id of the request, as the app sees them.
fn whoami(c: *spider.Ctx) !spider.Response {
    return c.json(.{
        .ip = c.clientIp() orelse "unknown",
        .peer = c.peerAddress() orelse "unknown",
        .request_id = c.requestId(),
    }, .{});
}

test "the visitor's address: what the trusted proxy wrote, not what the visitor claims" {
    const app = try spider.testing.start(run);

    // The proxy appends the address it saw to whatever came in the header,
    // so the last entry is the one to believe: a visitor who sends
    // "X-Forwarded-For: 6.6.6.6" does not become 6.6.6.6.
    var res = try app.with(&.{"X-Forwarded-For: 6.6.6.6, 203.0.113.7"}).get("/whoami");
    defer res.deinit();
    try res.expectContains("\"ip\":\"203.0.113.7\"");
    try res.expectContains("\"peer\":\"127.0.0.1\"");
}

test "request id: the proxy's is kept, and comes back in the answer" {
    const app = try spider.testing.start(run);

    var given = try app.with(&.{"X-Request-Id: edge-7f3a"}).get("/whoami");
    defer given.deinit();
    try given.expectHeader("X-Request-Id", "edge-7f3a");
    try given.expectContains("\"request_id\":\"edge-7f3a\"");

    // Without one, Spider makes it up: 16 hex digits.
    var made = try app.get("/whoami");
    defer made.deinit();
    try std.testing.expectEqual(@as(usize, 16), made.header("X-Request-Id").?.len);
}