mirror of
https://git.anonymousland.org/anonymousland/synapse-product.git
synced 2025-05-08 13:04:59 -04:00
Add an admin API to manage ratelimit for a specific user (#9648)
This commit is contained in:
Dirk Klimpel
GitHub
parent
a7044e5c0f
commit
1fc97ee876
6 changed files with 573 additions and 6 deletions
|
|
@ -3011,3 +3011,287 @@ class ShadowBanRestTestCase(unittest.HomeserverTestCase):
|
|||
# Ensure the user is shadow-banned (and the cache was cleared).
|
||||
result = self.get_success(self.store.get_user_by_access_token(other_user_token))
|
||||
self.assertTrue(result.shadow_banned)
|
||||
|
||||
|
||||
class RateLimitTestCase(unittest.HomeserverTestCase):
|
||||
|
||||
servlets = [
|
||||
synapse.rest.admin.register_servlets,
|
||||
login.register_servlets,
|
||||
]
|
||||
|
||||
def prepare(self, reactor, clock, hs):
|
||||
self.store = hs.get_datastore()
|
||||
|
||||
self.admin_user = self.register_user("admin", "pass", admin=True)
|
||||
self.admin_user_tok = self.login("admin", "pass")
|
||||
|
||||
self.other_user = self.register_user("user", "pass")
|
||||
self.url = (
|
||||
"/_synapse/admin/v1/users/%s/override_ratelimit"
|
||||
% urllib.parse.quote(self.other_user)
|
||||
)
|
||||
|
||||
def test_no_auth(self):
|
||||
"""
|
||||
Try to get information of a user without authentication.
|
||||
"""
|
||||
channel = self.make_request("GET", self.url, b"{}")
|
||||
|
||||
self.assertEqual(401, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request("POST", self.url, b"{}")
|
||||
|
||||
self.assertEqual(401, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request("DELETE", self.url, b"{}")
|
||||
|
||||
self.assertEqual(401, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
|
||||
|
||||
def test_requester_is_no_admin(self):
|
||||
"""
|
||||
If the user is not a server admin, an error is returned.
|
||||
"""
|
||||
other_user_token = self.login("user", "pass")
|
||||
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
self.url,
|
||||
access_token=other_user_token,
|
||||
)
|
||||
|
||||
self.assertEqual(403, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=other_user_token,
|
||||
)
|
||||
|
||||
self.assertEqual(403, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request(
|
||||
"DELETE",
|
||||
self.url,
|
||||
access_token=other_user_token,
|
||||
)
|
||||
|
||||
self.assertEqual(403, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
|
||||
|
||||
def test_user_does_not_exist(self):
|
||||
"""
|
||||
Tests that a lookup for a user that does not exist returns a 404
|
||||
"""
|
||||
url = "/_synapse/admin/v1/users/@unknown_person:test/override_ratelimit"
|
||||
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(404, channel.code, msg=channel.json_body)
|
||||
self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(404, channel.code, msg=channel.json_body)
|
||||
self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
|
||||
|
||||
channel = self.make_request(
|
||||
"DELETE",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(404, channel.code, msg=channel.json_body)
|
||||
self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
|
||||
|
||||
def test_user_is_not_local(self):
|
||||
"""
|
||||
Tests that a lookup for a user that is not a local returns a 400
|
||||
"""
|
||||
url = (
|
||||
"/_synapse/admin/v1/users/@unknown_person:unknown_domain/override_ratelimit"
|
||||
)
|
||||
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(400, channel.code, msg=channel.json_body)
|
||||
self.assertEqual("Can only lookup local users", channel.json_body["error"])
|
||||
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(400, channel.code, msg=channel.json_body)
|
||||
self.assertEqual(
|
||||
"Only local users can be ratelimited", channel.json_body["error"]
|
||||
)
|
||||
|
||||
channel = self.make_request(
|
||||
"DELETE",
|
||||
url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
|
||||
self.assertEqual(400, channel.code, msg=channel.json_body)
|
||||
self.assertEqual(
|
||||
"Only local users can be ratelimited", channel.json_body["error"]
|
||||
)
|
||||
|
||||
def test_invalid_parameter(self):
|
||||
"""
|
||||
If parameters are invalid, an error is returned.
|
||||
"""
|
||||
# messages_per_second is a string
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"messages_per_second": "string"},
|
||||
)
|
||||
|
||||
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
|
||||
|
||||
# messages_per_second is negative
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"messages_per_second": -1},
|
||||
)
|
||||
|
||||
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
|
||||
|
||||
# burst_count is a string
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"burst_count": "string"},
|
||||
)
|
||||
|
||||
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
|
||||
|
||||
# burst_count is negative
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"burst_count": -1},
|
||||
)
|
||||
|
||||
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
|
||||
|
||||
def test_return_zero_when_null(self):
|
||||
"""
|
||||
If values in database are `null` API should return an int `0`
|
||||
"""
|
||||
|
||||
self.get_success(
|
||||
self.store.db_pool.simple_upsert(
|
||||
table="ratelimit_override",
|
||||
keyvalues={"user_id": self.other_user},
|
||||
values={
|
||||
"messages_per_second": None,
|
||||
"burst_count": None,
|
||||
},
|
||||
)
|
||||
)
|
||||
|
||||
# request status
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(0, channel.json_body["messages_per_second"])
|
||||
self.assertEqual(0, channel.json_body["burst_count"])
|
||||
|
||||
def test_success(self):
|
||||
"""
|
||||
Rate-limiting (set/update/delete) should succeed for an admin.
|
||||
"""
|
||||
# request status
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertNotIn("messages_per_second", channel.json_body)
|
||||
self.assertNotIn("burst_count", channel.json_body)
|
||||
|
||||
# set ratelimit
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"messages_per_second": 10, "burst_count": 11},
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(10, channel.json_body["messages_per_second"])
|
||||
self.assertEqual(11, channel.json_body["burst_count"])
|
||||
|
||||
# update ratelimit
|
||||
channel = self.make_request(
|
||||
"POST",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
content={"messages_per_second": 20, "burst_count": 21},
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(20, channel.json_body["messages_per_second"])
|
||||
self.assertEqual(21, channel.json_body["burst_count"])
|
||||
|
||||
# request status
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertEqual(20, channel.json_body["messages_per_second"])
|
||||
self.assertEqual(21, channel.json_body["burst_count"])
|
||||
|
||||
# delete ratelimit
|
||||
channel = self.make_request(
|
||||
"DELETE",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertNotIn("messages_per_second", channel.json_body)
|
||||
self.assertNotIn("burst_count", channel.json_body)
|
||||
|
||||
# request status
|
||||
channel = self.make_request(
|
||||
"GET",
|
||||
self.url,
|
||||
access_token=self.admin_user_tok,
|
||||
)
|
||||
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
||||
self.assertNotIn("messages_per_second", channel.json_body)
|
||||
self.assertNotIn("burst_count", channel.json_body)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue