Ben Stull
9e1b7ce34f
Add RATELIMIT_OTC_REQUEST_MAX / RATELIMIT_VERIFY_MAX / RATELIMIT_CHECK_MAX (default to the existing secure values; non-positive/unparseable → default). Lets a test/PPE stack that drives the auth endpoints repeatedly from one IP lift the budget; production leaves them unset. Mirrors the existing OTC_REQUEST_COOLDOWN_SECONDS knob. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
45 lines
1.5 KiB
Python
45 lines
1.5 KiB
Python
"""The per-IP limiter budgets are env-overridable (test/PPE stacks drive the
|
|
auth endpoints repeatedly from one IP); production leaves them unset and keeps
|
|
the secure defaults. A non-positive / unparseable value falls back."""
|
|
from __future__ import annotations
|
|
|
|
import importlib
|
|
|
|
import pytest
|
|
|
|
|
|
def _reload_with(monkeypatch, **env):
|
|
for k, v in env.items():
|
|
if v is None:
|
|
monkeypatch.delenv(k, raising=False)
|
|
else:
|
|
monkeypatch.setenv(k, v)
|
|
import app.ratelimit as ratelimit
|
|
return importlib.reload(ratelimit)
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _restore():
|
|
yield
|
|
# Leave the module in its default state for other tests.
|
|
import app.ratelimit as ratelimit
|
|
importlib.reload(ratelimit)
|
|
|
|
|
|
def test_defaults_when_unset(monkeypatch):
|
|
rl = _reload_with(monkeypatch, RATELIMIT_OTC_REQUEST_MAX=None, RATELIMIT_VERIFY_MAX=None)
|
|
assert rl.otc_request_limiter.max_events == 5
|
|
assert rl.verify_limiter.max_events == 10
|
|
|
|
|
|
def test_env_override(monkeypatch):
|
|
rl = _reload_with(monkeypatch, RATELIMIT_OTC_REQUEST_MAX="1000", RATELIMIT_VERIFY_MAX="250")
|
|
assert rl.otc_request_limiter.max_events == 1000
|
|
assert rl.verify_limiter.max_events == 250
|
|
|
|
|
|
def test_bad_value_falls_back_to_default(monkeypatch):
|
|
rl = _reload_with(monkeypatch, RATELIMIT_OTC_REQUEST_MAX="nope", RATELIMIT_VERIFY_MAX="0")
|
|
assert rl.otc_request_limiter.max_events == 5 # unparseable → default
|
|
assert rl.verify_limiter.max_events == 10 # non-positive → default
|