lyra
5563999525
Sync GitHub / sync (push) Successful in 8s
Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.
43 lines
1.5 KiB
PHP
43 lines
1.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Tests;
|
|
|
|
use App\Kernel as AppKernel;
|
|
use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
|
|
use Symfony\Component\DependencyInjection\ContainerBuilder;
|
|
|
|
/**
|
|
* Kernel used by the functional test suite.
|
|
*
|
|
* In production the nonce cache is backed by APCu, which naturally persists
|
|
* across PHP requests. In the test environment the nonce cache is an
|
|
* in-memory ArrayAdapter; Symfony's ServicesResetter clears it between
|
|
* requests (even with KernelBrowser::disableReboot()), which would discard
|
|
* the nonce issued on the login-page request before the login-submission
|
|
* request can verify it.
|
|
*
|
|
* This kernel removes the kernel.reset tag from the nonceCache (and
|
|
* rateLimitCache) pools so their in-memory state survives across requests
|
|
* within a single test, mirroring the persistence behaviour of APCu.
|
|
*/
|
|
class TestKernel extends AppKernel
|
|
{
|
|
protected function build(ContainerBuilder $container): void
|
|
{
|
|
parent::build($container);
|
|
|
|
$container->addCompilerPass(new class () implements CompilerPassInterface {
|
|
public function process(ContainerBuilder $container): void
|
|
{
|
|
foreach (['nonceCache', 'rateLimitCache', 'sessionCache', 'sessionStorage', 'publicRateLimitCache'] as $poolId) {
|
|
if ($container->hasDefinition($poolId)) {
|
|
$container->getDefinition($poolId)->clearTag('kernel.reset');
|
|
}
|
|
}
|
|
}
|
|
});
|
|
}
|
|
}
|