fix(geoip): ограничить изменение баз правами записи трафика

backend/src/lib/permissions.ts

@@ -42,6 +42,8 @@ type Rule = {
 }
 
 const RULES: Rule[] = [
+  { methods: ["GET"], match: path => path === "/api/geoip", permission: "mm:traffic:read" },
+  { methods: ["PUT", "POST"], match: path => path === "/api/geoip" || path === "/api/geoip/update", permission: "mm:traffic:write" },
   {
     methods: ["GET"],
     match: p => /^\/api\/servers\/\d+\/ospf(?:\/|$)/.test(p),

backend/src/plugins/auth.geoip.test.ts

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict"
+import Fastify from "fastify"
+import { SignJWT } from "jose"
+process.env.AUTH_REQUIRED = "true"
+process.env.AUTH_JWT_SECRET = "geoip-test-secret"
+process.env.AUTH_ISSUER = "https://auth.test.local"
+process.env.NODE_ENV = "test"
+const { default: authPlugin, requireAuth } = await import("./auth.js")
+const { permissionForRequest } = await import("../lib/permissions.js")
+assert.equal(permissionForRequest("GET", "/api/geoip"), "mm:traffic:read")
+assert.equal(permissionForRequest("PUT", "/api/geoip"), "mm:traffic:write")
+assert.equal(permissionForRequest("POST", "/api/geoip/update?force=true"), "mm:traffic:write")
+const app = Fastify(); await app.register(authPlugin); app.addHook("preHandler", requireAuth)
+let applied = 0
+app.get("/api/geoip", async () => ({ known: true }))
+app.put("/api/geoip", async () => { applied++; return { ok: true } })
+app.post("/api/geoip/update", async () => { applied++; return { ok: true } })
+for (const permission of ["mm:dashboard:read", "mm:traffic:read", "mm:traffic:write", "mm:traffic:admin", "mm:settings:admin"]) {
+ const token = await new SignJWT({ sub: "fixture", apps: ["mm"], permissions: [permission] }).setProtectedHeader({ alg: "HS256" }).setIssuer("https://auth.test.local").setExpirationTime("1h").sign(new TextEncoder().encode("geoip-test-secret"))
+ for (const [method, url] of [["GET", "/api/geoip"], ["PUT", "/api/geoip"], ["POST", "/api/geoip/update"]] as const) {
+  const before = applied; const response = await app.inject({ method, url, headers: { authorization: "Bearer " + token } })
+  const allowed = permission === "mm:traffic:write" || permission === "mm:traffic:admin" || (method === "GET" && permission === "mm:traffic:read")
+  assert.equal(response.statusCode, allowed ? 200 : 403); assert.equal(applied, before + (allowed && method !== "GET" ? 1 : 0))
+ }
+}
+assert.equal((await app.inject({ method: "POST", url: "/api/geoip/update" })).statusCode, 401)
+await app.close(); console.log("GeoIP JWT gate: reader cannot mutate, writer/admin authorized before handler")