more

internal/honeypot/honeypot_test.go

@@ -39,3 +39,20 @@ func TestHandleIPsRequiresToken(t *testing.T) {
 		t.Fatalf("got %d and %q", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestRecordTelemetryPromotesTheObservedSourceIP(t *testing.T) {
+	tracker := New(Config{Threshold: 2, TTL: time.Minute})
+	if tracker.RecordTelemetry("203.0.113.20", "/mail.php") {
+		t.Fatal("must not promote before threshold")
+	}
+	if !tracker.RecordTelemetry("203.0.113.20", "/settings.php") {
+		t.Fatal("must promote at threshold")
+	}
+	if tracker.RecordTelemetry("203.0.113.20", "/index.html") {
+		t.Fatal("normal paths must not be tracked")
+	}
+	ips := tracker.PromotedIPs()
+	if len(ips) != 1 || ips[0].Address != "203.0.113.20" {
+		t.Fatalf("unexpected promoted IPs: %+v", ips)
+	}
+}