@@ -177,10 +177,6 @@ export type MachineAuthTestAdapter = {
177177 callbackPath : string ;
178178 addRoutes : RouteBuilder ;
179179 } ;
180- rateLimit ?: {
181- path : string ;
182- addRoutes : RouteBuilder ;
183- } ;
184180} ;
185181
186182const createApiKeysEnv = ( ) : EnvironmentConfig => appConfigs . envs . withAPIKeys . clone ( ) ;
@@ -449,95 +445,3 @@ export const registerOAuthAuthTests = (adapter: MachineAuthTestAdapter): void =>
449445 }
450446 } ) ;
451447} ;
452-
453- export const registerRateLimitTests = ( adapter : MachineAuthTestAdapter ) : void => {
454- if ( ! adapter . rateLimit ) {
455- return ;
456- }
457-
458- test . describe ( 'Machine token rate limiting' , ( ) => {
459- test . describe . configure ( { mode : 'serial' } ) ;
460- let app : Application ;
461- let fakeUser : FakeUser ;
462- let fakeBapiUser : User ;
463- let fakeAPIKey : FakeAPIKey ;
464-
465- test . beforeAll ( async ( ) => {
466- test . setTimeout ( 120_000 ) ;
467-
468- app = await buildApp ( adapter , adapter . rateLimit ! . addRoutes ) ;
469- await app . setup ( ) ;
470- await app . withEnv ( createApiKeysEnv ( ) ) ;
471- await app . dev ( ) ;
472-
473- const u = createTestUtils ( { app } ) ;
474- fakeUser = u . services . users . createFakeUser ( ) ;
475- fakeBapiUser = await u . services . users . createBapiUser ( fakeUser ) ;
476- fakeAPIKey = await u . services . users . createFakeAPIKey ( fakeBapiUser . id ) ;
477- } ) ;
478-
479- test . afterAll ( async ( ) => {
480- await fakeAPIKey ?. revoke ( ) ;
481- await fakeUser ?. deleteIfExists ( ) ;
482- await app ?. teardown ( ) ;
483- } ) ;
484-
485- test ( 'rate-limits opaque machine tokens after burst exhaustion' , async ( { request } ) => {
486- const url = new URL ( adapter . rateLimit ! . path , app . serverUrl ) . toString ( ) ;
487- // Use a dedicated test IP so this test's bucket is isolated from others
488- const testIp = '203.0.113.42' ;
489-
490- for ( let i = 0 ; i < 20 ; i ++ ) {
491- await request . get ( url , {
492- headers : {
493- Authorization : `Bearer ${ fakeAPIKey . secret } ` ,
494- 'x-forwarded-for' : testIp ,
495- } ,
496- } ) ;
497- }
498-
499- const res = await request . get ( url , {
500- headers : {
501- Authorization : `Bearer ${ fakeAPIKey . secret } ` ,
502- 'x-forwarded-for' : testIp ,
503- } ,
504- } ) ;
505- expect ( res . status ( ) ) . toBe ( 401 ) ;
506- const body = await res . json ( ) ;
507- expect ( body . reason ) . toBe ( 'machine-token-rate-limit' ) ;
508- } ) ;
509-
510- test ( 'tracks different source IPs independently' , async ( { request } ) => {
511- const url = new URL ( adapter . rateLimit ! . path , app . serverUrl ) . toString ( ) ;
512- const ipA = '203.0.113.1' ;
513- const ipB = '203.0.113.2' ;
514-
515- for ( let i = 0 ; i < 20 ; i ++ ) {
516- await request . get ( url , {
517- headers : {
518- Authorization : `Bearer ${ fakeAPIKey . secret } ` ,
519- 'x-forwarded-for' : ipA ,
520- } ,
521- } ) ;
522- }
523-
524- const resA = await request . get ( url , {
525- headers : {
526- Authorization : `Bearer ${ fakeAPIKey . secret } ` ,
527- 'x-forwarded-for' : ipA ,
528- } ,
529- } ) ;
530- expect ( resA . status ( ) ) . toBe ( 401 ) ;
531- const bodyA = await resA . json ( ) ;
532- expect ( bodyA . reason ) . toBe ( 'machine-token-rate-limit' ) ;
533-
534- const resB = await request . get ( url , {
535- headers : {
536- Authorization : `Bearer ${ fakeAPIKey . secret } ` ,
537- 'x-forwarded-for' : ipB ,
538- } ,
539- } ) ;
540- expect ( resB . status ( ) ) . toBe ( 200 ) ;
541- } ) ;
542- } ) ;
543- } ;
0 commit comments