Return restricted for authenticated nonmembers while preserving auth-required for anonymous readers. Cover anonymous, outsider and member access in a table-driven regression test.
- commit
- c91c272509779699fc2738c1bec749807d856f12
- parent
- f73361630e811be4c3d810e3e25bdb9b5c2e1d67
- author
- Dami <dami.etoile@gmail.com>
| A | internal/ | 26 | ++++++++++++++++++++++++++ |
| M | internal/ | 5 | ++++- |
@@ -0,0 +1,26 @@
1+package gates2+3+import (4+ "context"5+ "testing"6+7+ "github.com/FelineStateMachine/tinyrelay/internal/event"8+ "github.com/FelineStateMachine/tinyrelay/internal/policy"9+ "github.com/FelineStateMachine/tinyrelay/internal/relay"10+)11+12+func TestMembersOnlyReadDistinguishesAnonymousAndAuthenticatedOutsider(t *testing.T) {13+ p := policy.Defaults("owner")14+ p.Reads = "members"15+ g, err := New(Config{Policy: func() policy.Policy { return p }})16+ if err != nil {17+ t.Fatal(err)18+ }19+ filter := []event.Filter{{Kinds: []int{1}}}20+ if _, err := g.Read(context.Background(), filter, relay.Session{}); err == nil || err.Error() != "auth-required: this relay is members-only" {21+ t.Fatalf("anonymous read error = %v", err)22+ }23+ if _, err := g.Read(context.Background(), filter, relay.Session{PubKeys: []string{"outsider"}}); err == nil || err.Error() != "restricted: this relay is members-only" {24+ t.Fatalf("authenticated outsider read error = %v", err)25+ }26+}@@ -663,7 +663,10 @@ func (g *Gate) Read(ctx context.Context, filters []event.Filter, s relay.Session
663663 return false, errors.New("auth-required: this relay requires AUTH")664664 }665665 if p.Reads == "members" && !a.Member && !a.Owner {666- return false, errors.New("auth-required: this relay is members-only")666+ if len(a.PubKeys) == 0 {667+ return false, errors.New("auth-required: this relay is members-only")668+ }669+ return false, errors.New("restricted: this relay is members-only")667670 }668671 privateOnly := true669672 authHint := false