Merge GitHub dev into GitLab dev

tests/test_admin_settings_manifest_i18n.py

@@ -24,6 +24,7 @@ SUBSCRIPTION_PURCHASE_DESCRIPTION_SETTINGS = (
     "SUBSCRIPTION_PURCHASE_DESCRIPTION_ENABLED",
     "SUBSCRIPTION_PURCHASE_DESCRIPTION_RU",
     "SUBSCRIPTION_PURCHASE_DESCRIPTION_EN",
+    "PAYMENT_REQUEST_TIMEOUT_SECONDS",
 )
 
 SUBSCRIPTION_GUIDE_SETTINGS = (
@@ -177,6 +178,11 @@ def test_support_settings_i18n_keys_exist_in_admin_locales():
 def test_subscription_purchase_description_settings_i18n_keys_exist():
     manifest = _manifest_by_key()
 
+    timeout_field = manifest["PAYMENT_REQUEST_TIMEOUT_SECONDS"]
+    assert timeout_field["type"] == "float"
+    assert timeout_field["optional"] is False
+    assert timeout_field["min"] == 1
+
     for language in ("ru", "en"):
         messages = _locale(language)
         for setting_key in SUBSCRIPTION_PURCHASE_DESCRIPTION_SETTINGS:

tests/test_payment_http_client.py

@@ -0,0 +1,30 @@
+import unittest
+
+from bot.payment_providers.shared.http_client import (
+    HttpClientMixin,
+    _should_retry_transport_error,
+)
+
+
+class _DummyHttpClient(HttpClientMixin):
+    def __init__(self):
+        self._init_http_client(total_timeout=20)
+
+
+class PaymentHttpClientTests(unittest.IsolatedAsyncioTestCase):
+    async def test_http_client_tracks_sent_headers_for_safe_retries(self):
+        client = _DummyHttpClient()
+        try:
+            session = await client._get_session()
+            self.assertFalse(session.connector.force_close)
+            self.assertTrue(session.trace_configs)
+        finally:
+            await client.close()
+
+    async def test_http_client_retries_only_before_headers_are_sent(self):
+        self.assertTrue(
+            _should_retry_transport_error(TimeoutError(), {"headers_sent": False})
+        )
+        self.assertFalse(
+            _should_retry_transport_error(TimeoutError(), {"headers_sent": True})
+        )

tests/test_security.py

@@ -12,6 +12,7 @@ from aiohttp import web
 
 from bot.app.web import admin_api, subscription_webapp
 from bot.app.web.admin_api_impl import settings as admin_settings_routes
+from bot.app.web.web_server import TrustedProxyAccessLogger
 from bot.app.web.webapp import account as account_routes
 from bot.app.web.webapp_auth import (
     create_telegram_oauth_nonce,
@@ -95,6 +96,38 @@ class RequestSecurityTests(unittest.IsolatedAsyncioTestCase):
             "198.51.100.7",
         )
 
+    async def test_request_client_ip_skips_trusted_forwarded_proxy_chain(self):
+        request = SimpleNamespace(
+            remote="172.19.0.6",
+            headers={"X-Forwarded-For": "203.0.113.10, 172.19.0.7"},
+        )
+
+        self.assertEqual(
+            request_client_ip(request, trusted_proxies=["172.19.0.0/16"]),
+            "203.0.113.10",
+        )
+
+    async def test_access_logger_uses_forwarded_ip_only_for_trusted_proxy(self):
+        trusted_request = SimpleNamespace(
+            remote="172.19.0.6",
+            headers={"X-Forwarded-For": "203.0.113.10, 172.19.0.7"},
+            app={"settings": SimpleNamespace(trusted_proxies=["172.19.0.0/16"])},
+        )
+        untrusted_request = SimpleNamespace(
+            remote="172.19.0.6",
+            headers={"X-Forwarded-For": "203.0.113.10, 172.19.0.7"},
+            app={"settings": SimpleNamespace(trusted_proxies=["127.0.0.1"])},
+        )
+
+        self.assertEqual(
+            TrustedProxyAccessLogger._format_a(trusted_request, object(), 0),
+            "203.0.113.10",
+        )
+        self.assertEqual(
+            TrustedProxyAccessLogger._format_a(untrusted_request, object(), 0),
+            "172.19.0.6",
+        )
+
     async def test_yookassa_webhook_rejects_untrusted_ip_before_reading_body(self):
         request = SimpleNamespace(
             app={