137 lines
4.3 KiB
Go
137 lines
4.3 KiB
Go
package ratelimit
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/apiserver"
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
|
)
|
|
|
|
func setupMiddlewareTest(t *testing.T) (*apiserver.Server, *auth.TokenIssuer, *Store, func()) {
|
|
t.Helper()
|
|
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
if adminDSN == "" {
|
|
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
}
|
|
ctx := context.Background()
|
|
|
|
pool, err := pgxpool.New(ctx, adminDSN)
|
|
if err != nil {
|
|
t.Fatalf("pool: %v", err)
|
|
}
|
|
if _, err := pool.Exec(ctx, `
|
|
CREATE TABLE IF NOT EXISTS rate_limit_configs (
|
|
key TEXT PRIMARY KEY, limit_value INT NOT NULL, window_seconds INT NOT NULL
|
|
);
|
|
CREATE TABLE IF NOT EXISTS rate_limit_counters (
|
|
key TEXT NOT NULL, window_start TIMESTAMPTZ NOT NULL, count INT NOT NULL DEFAULT 0,
|
|
PRIMARY KEY (key, window_start)
|
|
);
|
|
`); err != nil {
|
|
t.Fatalf("schema: %v", err)
|
|
}
|
|
|
|
issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
srv := apiserver.NewServer(issuer)
|
|
store := NewStore(pool)
|
|
|
|
cleanup := func() { pool.Close() }
|
|
return srv, issuer, store, cleanup
|
|
}
|
|
|
|
// Akzeptanzkriterium 3 + Pruefung 2: Ueberschreitung liefert 429 mit
|
|
// Retry-After-Header, ueber die vollstaendige Middleware-Kette (Auth ->
|
|
// Tenant-Kontext -> Rate-Limit -> Handler) hinweg.
|
|
func TestMiddleware_Returns429WithRetryAfterOnExceeded(t *testing.T) {
|
|
srv, issuer, store, cleanup := setupMiddlewareTest(t)
|
|
defer cleanup()
|
|
ctx := context.Background()
|
|
|
|
tenantSlug := newTestKey()
|
|
if err := store.SetLimit(ctx, tenantSlug, 1, time.Minute); err != nil {
|
|
t.Fatalf("setlimit: %v", err)
|
|
}
|
|
|
|
called := 0
|
|
srv.HandleV1("/limited", Middleware(store, KeyByTenant, func(w http.ResponseWriter, r *http.Request) {
|
|
called++
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
token, err := issuer.Issue("user-1", tenantSlug)
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
|
|
req1 := httptest.NewRequest(http.MethodGet, "/api/v1/limited", nil)
|
|
req1.AddCookie(&http.Cookie{Name: auth.CookieName, Value: token})
|
|
rec1 := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec1, req1)
|
|
if rec1.Code != http.StatusOK {
|
|
t.Fatalf("1. anfrage: status = %d, want 200", rec1.Code)
|
|
}
|
|
|
|
req2 := httptest.NewRequest(http.MethodGet, "/api/v1/limited", nil)
|
|
req2.AddCookie(&http.Cookie{Name: auth.CookieName, Value: token})
|
|
rec2 := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec2, req2)
|
|
if rec2.Code != http.StatusTooManyRequests {
|
|
t.Fatalf("2. anfrage: status = %d, want 429", rec2.Code)
|
|
}
|
|
if rec2.Header().Get("Retry-After") == "" {
|
|
t.Fatal("erwartet gesetzten Retry-After-Header bei 429")
|
|
}
|
|
if called != 1 {
|
|
t.Fatalf("handler wurde %d mal aufgerufen, want genau 1 (2. anfrage haette nicht durchgereicht werden duerfen)", called)
|
|
}
|
|
}
|
|
|
|
// Akzeptanzkriterium 1: das Limit ist pro Tenant konfigurierbar — ein
|
|
// anderer Tenant (anderer Key) bleibt von der Ausschoepfung unberuehrt.
|
|
func TestMiddleware_DifferentTenantsHaveIndependentLimits(t *testing.T) {
|
|
srv, issuer, store, cleanup := setupMiddlewareTest(t)
|
|
defer cleanup()
|
|
ctx := context.Background()
|
|
|
|
tenantA := newTestKey()
|
|
tenantB := newTestKey()
|
|
if err := store.SetLimit(ctx, tenantA, 1, time.Minute); err != nil {
|
|
t.Fatalf("setlimit a: %v", err)
|
|
}
|
|
if err := store.SetLimit(ctx, tenantB, 1, time.Minute); err != nil {
|
|
t.Fatalf("setlimit b: %v", err)
|
|
}
|
|
|
|
srv.HandleV1("/limited2", Middleware(store, KeyByTenant, func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
tokenA, _ := issuer.Issue("user-a", tenantA)
|
|
tokenB, _ := issuer.Issue("user-b", tenantB)
|
|
|
|
// Tenant A schoepft sein Limit aus.
|
|
reqA := httptest.NewRequest(http.MethodGet, "/api/v1/limited2", nil)
|
|
reqA.AddCookie(&http.Cookie{Name: auth.CookieName, Value: tokenA})
|
|
recA := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(recA, reqA)
|
|
if recA.Code != http.StatusOK {
|
|
t.Fatalf("tenant a, 1. anfrage: status = %d, want 200", recA.Code)
|
|
}
|
|
|
|
// Tenant B ist von der Ausschoepfung bei A unberuehrt.
|
|
reqB := httptest.NewRequest(http.MethodGet, "/api/v1/limited2", nil)
|
|
reqB.AddCookie(&http.Cookie{Name: auth.CookieName, Value: tokenB})
|
|
recB := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(recB, reqB)
|
|
if recB.Code != http.StatusOK {
|
|
t.Fatalf("tenant b haette trotz ausgeschoepftem limit von tenant a erlaubt sein muessen, status = %d", recB.Code)
|
|
}
|
|
}
|