ahp/pargar
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

fix(backend): disable one-registration-per-IP by default

Browse Source 
Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
This commit is contained in:
ahp
2026-10-07 23:13:22 +03:30
parent 92b1681241
commit 3cce2158e9
15 changed files with 103 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/api/register_test.go
+21
View File
@@ -261,6 +261,7 @@ func TestRegisterDuplicatePhone(t *testing.T) {
}
func TestRegisterSameIPRejected(t *testing.T) {
t.Setenv("REGISTRATION_ENFORCE_IP", "true")
e := setup(t)
enableRegistration(t, e)
whitelistPhones(t, e, "09121110007", "09121110008")
@@ -278,7 +279,27 @@ func TestRegisterSameIPRejected(t *testing.T) {
}
}
func TestRegisterSameIPAllowedWhenEnforcementOff(t *testing.T) {
t.Setenv("REGISTRATION_ENFORCE_IP", "false")
e := setup(t)
enableRegistration(t, e)
whitelistPhones(t, e, "09121110007", "09121110008")
headers := map[string]string{"X-Forwarded-For": "203.0.113.40"}
code, body := e.doHeaders(t, "POST", "/api/auth/register", "", headers,
registerBody(t, e, "09121110007", "reg-ipoff1@test.dev", "regipoff1"))
if code != http.StatusCreated {
t.Fatalf("first: %d %v", code, body)
}
code, body = e.doHeaders(t, "POST", "/api/auth/register", "", headers,
registerBody(t, e, "09121110008", "reg-ipoff2@test.dev", "regipoff2"))
if code != http.StatusCreated {
t.Fatalf("same IP must be allowed when REGISTRATION_ENFORCE_IP=false: %d %v", code, body)
}
}
func TestRegisterUsesForwardedIP(t *testing.T) {
t.Setenv("REGISTRATION_ENFORCE_IP", "true")
e := setup(t)
enableRegistration(t, e)
whitelistPhones(t, e, "09121110009", "09121110010", "09121110011")