release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application. Added: - Per-application **client IP allow-list** on the domain page: when enabled, - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs Changed: - Application level-2 rate limit **overrides** the domain limit for that login - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics - [guide.md](docs/guide.md): full-backup section documents all four capture Full detail: CHANGELOG.md (1.9.0).
2026-09-22 15:24:53 +03:00
parent 9d8b19d14a
commit 7b8685d038
26 changed files with 561 additions and 278 deletions
@@ -187,3 +187,43 @@ func TestListLoginsByDomain(t *testing.T) {
 		t.Fatalf("logins = %v, want [a b]", logins)
 	}
 }
+
+func TestApplicationAuthIPs(t *testing.T) {
+	st := openTestStore(t)
+	d := addTestDomain(t, st, "example.com")
+	a, err := st.AddApplication(d.ID, "app1", AddressModeWildcard, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.AuthIPRestrict || len(a.AuthAllowedIPs) != 0 {
+		t.Fatalf("new app should have no IP restriction: %+v", a)
+	}
+
+	if err := st.UpdateApplicationAuthIPs(a.ID, true, []string{"203.0.113.1", "2001:db8::1"}); err != nil {
+		t.Fatalf("UpdateApplicationAuthIPs: %v", err)
+	}
+	got, err := st.GetApplication(a.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.AuthIPRestrict || len(got.AuthAllowedIPs) != 2 {
+		t.Fatalf("after update: %+v", got)
+	}
+	if !got.AllowsAuthFromIP("203.0.113.1") || !got.AllowsAuthFromIP("2001:0db8:0000:0000:0000:0000:0000:0001") {
+		t.Fatal("listed IPs should match")
+	}
+	if got.AllowsAuthFromIP("198.51.100.7") {
+		t.Fatal("unlisted IP must not match")
+	}
+
+	if err := st.UpdateApplicationAuthIPs(a.ID, false, nil); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = st.GetApplication(a.ID)
+	if got.AuthIPRestrict || len(got.AuthAllowedIPs) != 0 {
+		t.Fatalf("cleared restriction: %+v", got)
+	}
+	if !got.AllowsAuthFromIP("198.51.100.7") {
+		t.Fatal("restriction off should allow any IP")
+	}
+}