Nodarx/server
1
0
Fork 0
Code Issues 1 Pull Requests 5 Actions Projects Releases Activity

perf(firewall): use BSON dates and add query indexes

Browse Source 
Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
This commit is contained in:
Sebastian Krupinski
2026-07-30 23:13:37 -04:00
parent ad6443bff3
commit 90d847ffae
4 changed files with 173 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Integration/Stores/FirewallStoreTest.php
+41 -2
View File
@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace KTXT\Integration\Stores;
use KTXC\Db\DataStore;
use KTXC\Db\UTCDateTime;
use KTXC\Models\Firewall\FirewallRuleObject;
use KTXC\Models\Firewall\FirewallLogObject;
use KTXC\Service\FirewallRuleCache;
@@ -254,17 +255,55 @@ class FirewallStoreTest extends TestCase
$claimId = hash('sha256', "tenant-a\0"."203.0.113.10");
$this->dataStore->selectCollection('firewall_brute_force_claims')->updateOne(
['_id' => $claimId],
['$set' => ['expiresAt' => (new \DateTimeImmutable('-1 minute'))->format(\DateTimeInterface::ATOM)]]
['$set' => ['expiresAt' => UTCDateTime::fromDateTime(new \DateTimeImmutable('-1 minute'))]]
);
self::assertTrue($this->store->claimBruteForce('tenant-a', '203.0.113.10', 3600));
$this->dataStore->selectCollection('firewall_brute_force_claims')->updateOne(
['_id' => $claimId],
['$set' => ['expiresAt' => (new \DateTimeImmutable('-1 minute'))->format(\DateTimeInterface::ATOM)]]
['$set' => ['expiresAt' => UTCDateTime::fromDateTime(new \DateTimeImmutable('-1 minute'))]]
);
self::assertSame(1, $this->store->cleanupExpiredBruteForceClaims());
}
#[TestDox('Firewall dates use BSON date storage and indexes are installed idempotently')]
public function testBsonDatesAndIndexes(): void
{
$rule = $this->rule('bson-date', FirewallRuleObject::SCOPE_TENANT, 'tenant-a')
->setExpiresAt(new \DateTimeImmutable('+1 hour'));
$this->store->depositRule($rule);
$log = (new FirewallLogObject())
->setTenantId('tenant-a')
->setEventType(FirewallLogObject::EVENT_ACCESS_CHECK)
->setResult(FirewallLogObject::RESULT_ALLOWED)
->setTimestamp(new \DateTimeImmutable());
$this->store->createLog($log);
$storedRule = $this->dataStore->selectCollection('firewall_rules')
->getMongoCollection()
->findOne(['_id' => new \MongoDB\BSON\ObjectId($rule->getId())]);
$storedLog = $this->dataStore->selectCollection('firewall_logs')
->getMongoCollection()
->findOne(['_id' => new \MongoDB\BSON\ObjectId($log->getId())]);
self::assertInstanceOf(\MongoDB\BSON\UTCDateTime::class, $storedRule['createdAt']);
self::assertInstanceOf(\MongoDB\BSON\UTCDateTime::class, $storedRule['expiresAt']);
self::assertInstanceOf(\MongoDB\BSON\UTCDateTime::class, $storedLog['timestamp']);
$expected = $this->store->ensureIndexes();
self::assertSame($expected, $this->store->ensureIndexes());
$claimIndex = null;
foreach ($this->dataStore->selectCollection('firewall_brute_force_claims')->getMongoCollection()->listIndexes() as $index) {
if ($index->getName() === 'claims_expiry') {
$claimIndex = $index;
}
}
self::assertNotNull($claimIndex);
self::assertSame(0, $claimIndex['expireAfterSeconds']);
}
private function rule(
string $reason,
string $scope,