ip_protection_token_cache_manager_impl_unittest.cc

// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "services/network/ip_protection/ip_protection_token_cache_manager_impl.h"

#include <deque>
#include <map>
#include <memory>
#include <optional>
#include <string>
#include <utility>
#include <vector>

#include "base/strings/stringprintf.h"
#include "base/test/metrics/histogram_tester.h"
#include "base/test/scoped_feature_list.h"
#include "base/test/task_environment.h"
#include "components/ip_protection/common/ip_protection_data_types.h"
#include "components/ip_protection/common/ip_protection_telemetry.h"
#include "net/base/features.h"
#include "services/network/ip_protection/ip_protection_config_cache.h"
#include "services/network/ip_protection/ip_protection_geo_utils.h"
#include "services/network/ip_protection/ip_protection_token_cache_manager.h"
#include "testing/gtest/include/gtest/gtest.h"

namespace network {

namespace {

constexpr char kGeoChangeTokenPresence[] = …;
BlindSignedAuthToken;

constexpr char kGetAuthTokenResultHistogram[] = …;
constexpr char kProxyATokenSpendRateHistogram[] = …;
constexpr char kProxyATokenExpirationRateHistogram[] = …;
constexpr char kProxyBTokenSpendRateHistogram[] = …;
constexpr char kProxyBTokenExpirationRateHistogram[] = …;
constexpr char kTokenBatchGenerationTimeHistogram[] = …;
constexpr char kGetAuthTokenResultForGeoHistogram[] = …;

constexpr base::TimeDelta kTokenLimitExceededDelay = …;
constexpr base::TimeDelta kTokenRateMeasurementInterval = …;

const bool kEnableTokenCacheByGeo = …;
const bool kDisableTokenCacheByGeo = …;

const ip_protection::GeoHint kMountainViewGeo = …;
const std::string kMountainViewGeoId = …;

const ip_protection::GeoHint kSunnyvaleGeo = …;
const std::string kSunnyvaleGeoId = …;

struct ExpectedTryGetAuthTokensCall { … };

class MockIpProtectionConfigGetter : public IpProtectionConfigGetter { … };

class MockIpProtectionConfigCache : public IpProtectionConfigCache { … };

struct HistogramState { … };

class IpProtectionTokenCacheManagerImplTest : public testing::Test { … };

// `IsAuthTokenAvailable()` returns false on an empty cache. Geo Caching
// disabled.
TEST_F(IpProtectionTokenCacheManagerImplTest, IsAuthTokenAvailableFalseEmpty) { … }

// `IsAuthTokenAvailable()` returns false on an empty cache. Geo Caching
// enabled.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       IsAuthTokenAvailableFalseEmptyGeoCachingEnabled) { … }

// `IsAuthTokenAvailable()` returns true on a cache containing unexpired
// tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest, IsAuthTokenAvailableTrue) { … }

// `IsAuthTokenAvailable()` returns true on a cache containing unexpired
// tokens. Geo caching is enabled.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       IsAuthTokenAvailableTrueGeoCachingEnabled) { … }

// `IsAuthTokenAvailable()` returns false on a cache containing expired
// tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       IsAuthTokenAvailableFalseExpired) { … }

// `IsAuthTokenAvailable()` returns false on a geo's cache containing expired
// tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       IsAuthTokenAvailableGeoCachingExpiration) { … }

// `GetAuthToken()` returns nullopt on an empty cache.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenEmpty) { … }

// `GetAuthToken()` returns nullopt on an empty cache for specified geo.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenEmptyForGeo) { … }

// `GetAuthToken()` returns a token on a cache containing unexpired tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenSuccessful) { … }

// `GetAuthToken()` returns a token cached by geo.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenForGeoSuccessful) { … }

// `GetAuthToken()` requested for geo not available while other tokens are
// available.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenForUnavailableGeo) { … }

// `GetAuthToken()` returns nullopt on a cache containing expired tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenFalseExpired) { … }

// `GetAuthToken()` returns nullopt for particular geo where tokens are
// expired.
TEST_F(IpProtectionTokenCacheManagerImplTest, GetAuthTokenForGeoFalseExpired) { … }

// `CurrentGeo()` returns "EARTH" when token caching by geo is disabled.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       CurrentGeoNoGeoCachingReturnsEarth) { … }

// `CurrentGeo()` should return empty if no tokens have been requested yet and
// token caching by geo is enabled.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       CurrentGeoTokensNotRequestedGeoCachingEnabledReturnsEmpty) { … }

// `CurrentGeo()` should return the current geo of the most recently returned
// tokens.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       CurrentGeoTokensFilledGeoCachingEnabledReturnsGeo) { … }

// If `TryGetAuthTokens()` returns a batch smaller than the low-water mark,
// the cache does not immediately refill.
TEST_F(IpProtectionTokenCacheManagerImplTest, SmallBatch) { … }

// If `TryGetAuthTokens()` returns an backoff due to an error, the cache
// remains empty.
TEST_F(IpProtectionTokenCacheManagerImplTest, ErrorBatch) { … }

// `GetAuthToken()` skips expired tokens and returns a non-expired token, if
// one is found in the cache.
TEST_F(IpProtectionTokenCacheManagerImplTest, SkipExpiredTokens) { … }

TEST_F(IpProtectionTokenCacheManagerImplTest, TokenExpirationFuzzed) { … }

// If the `IpProtectionConfigGetter` is nullptr, no tokens are gotten, but
// things don't crash.
TEST_F(IpProtectionTokenCacheManagerImplTest, NullGetter) { … }

// Verify that the token spend rate for ProxyA is measured correctly.
TEST_F(IpProtectionTokenCacheManagerImplTest, ProxyATokenSpendRate) { … }

// Verify that the token expiration rate for ProxyA is measured correctly.
TEST_F(IpProtectionTokenCacheManagerImplTest, ProxyATokenExpirationRate) { … }

// Verify that the token spend rate for ProxyB is measured correctly.
TEST_F(IpProtectionTokenCacheManagerImplTest, ProxyBTokenSpendRate) { … }

// Verify that the token expiration rate for ProxyB is measured correctly.
TEST_F(IpProtectionTokenCacheManagerImplTest, ProxyBTokenExpirationRate) { … }

// The cache will pre-fill itself with a batch of tokens after a startup delay
TEST_F(IpProtectionTokenCacheManagerImplTest, Prefill) { … }

// The cache will initiate a refill when it reaches the low-water mark.
TEST_F(IpProtectionTokenCacheManagerImplTest, RefillLowWaterMark) { … }

// If a fill results in a backoff request, the cache will try again after that
// time.
TEST_F(IpProtectionTokenCacheManagerImplTest, RefillAfterBackoff) { … }

// When enough tokens expire to bring the cache size below the low water mark,
// it will automatically refill.
TEST_F(IpProtectionTokenCacheManagerImplTest, RefillAfterExpiration) { … }

// Once a geo changes, the new geo will have a key in the cache map meaning
// tokens are now available to be retrieved for new geo.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       GeoChangeNewGeoAvailableForGetToken) { … }

// Once a geo changes, the map will contain multiple geo's. Tokens from a
// prior geo are still valid to use as long as they are not expired.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       GeoChangeOldGeoTokensStillUsable) { … }

// Existing state with valid non-expired tokens. `SetCurrentGeo` is called
// with geo not in current cache. cache should attempt to refill and will
// contain tokens from the new geo.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       SetCurrentGeoDifferentGeoRetrievesNewTokens) { … }

// If setting new geo causes overflow of tokens in cache for certain geo,
// an extended backoff timer should stop more refills until the system can
// stabilize.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       SetCurrentGeoNewTokensHaveSameGeo) { … }

// When the feature for geo caching is disabled, setting the current geo does
// not change the underlying current geo.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       GeoCachingFeatureDisabledSetCurrentGeoShortCircuits) { … }

// Testing the existence of tokens in the cache when a new geo matches a
// previous geo that was cached. This test mimics a geo change introduced from
// a token refill from within the class.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       GeoChangeFromWithinTokenManagerNewGeoAlreadyHasTokensPresent) { … }

// Testing the existence of tokens in the cache when a new geo matches a
// previous geo that was cached. This test mimics a geo change introduced from
// outside of this class.
TEST_F(IpProtectionTokenCacheManagerImplTest,
       GeoChangeFromOutsideTokenManagerNewGeoAlreadyHasTokensPresent) { … }
}  // namespace
}  // namespace network
chromium/services/network/ip_protection/ip_protection_token_cache_manager_impl_unittest.cc
