Merge pull request #99 from jaredwray/feat-making-rate-limiting-enabled-by-default

feat: making rate limiting enabled by default

Author: jaredwray

README.md

@@ -249,11 +249,25 @@ const tap = mock.taps.inject(
 
 # Rate Limiting
 
-MockHttp supports rate limiting using [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit). Rate limiting is **disabled by default** and can be enabled by providing configuration options.
+MockHttp supports rate limiting using [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit). Rate limiting is **enabled by default** at **1000 requests per minute** with **localhost (127.0.0.1 and ::1) excluded** from rate limiting.
 
-## Enabling Rate Limiting
+## Default Rate Limiting
 
-To enable rate limiting, pass a `rateLimit` configuration object when creating your MockHttp instance:
+By default, MockHttp applies the following rate limit:
+- **1000 requests per minute** per IP address
+- **Localhost is excluded** - requests from 127.0.0.1 and ::1 bypass rate limiting (ideal for local development and testing)
+
+```javascript
+import { MockHttp } from '@jaredwray/mockhttp';
+
+const mock = new MockHttp();
+await mock.start();
+// Rate limiting is active (1000 req/min) except for localhost
+```
+
+## Customizing Rate Limiting
+
+To customize rate limiting, pass a `rateLimit` configuration object when creating your MockHttp instance:
 
 ```javascript
 import { MockHttp } from '@jaredwray/mockhttp';
@@ -351,15 +365,27 @@ const mock = new MockHttp({
 
 ## Disabling Rate Limiting
 
-Rate limiting is disabled by default. To explicitly disable it (or disable it after it was enabled):
+To disable rate limiting completely, set the `rateLimit` option to `false`:
 
 ```javascript
-const mock = new MockHttp(); // No rateLimit option = disabled
-
-// Or explicitly set to undefined
-const mock2 = new MockHttp({
-  rateLimit: undefined
+const mock = new MockHttp({
+  rateLimit: false // Completely disable rate limiting
 });
+
+await mock.start();
+// No rate limiting is applied to any requests
+```
+
+**Note:** To change rate limiting settings after the server has started, you must restart the server:
+
+```javascript
+const mock = new MockHttp();
+await mock.start(); // Starts with default rate limiting
+
+// To change or disable rate limiting:
+await mock.close();
+mock.rateLimit = undefined; // or set new options
+await mock.start(); // Restarts with new settings
 ```
 
 ## Available Options
@@ -396,7 +422,7 @@ new MockHttp(options?)
   - `autoDetectPort?`: boolean - Auto-detect next available port if in use (default: true)
   - `helmet?`: boolean - Use Helmet for security headers (default: true)
   - `apiDocs?`: boolean - Enable Swagger API documentation (default: true)
-  - `rateLimit?`: RateLimitPluginOptions - Enable and configure rate limiting (default: undefined/disabled)
+  - `rateLimit?`: RateLimitPluginOptions - Configure rate limiting (default: 1000 req/min, localhost excluded)
   - `httpBin?`: HttpBinOptions - Configure which httpbin routes to enable
     - `httpMethods?`: boolean - Enable HTTP method routes (default: true)
     - `redirects?`: boolean - Enable redirect routes (default: true)

src/mock-http.ts

@@ -92,10 +92,10 @@ export type MockHttpOptions = {
 	 */
 	httpBin?: HttpBinOptions;
 	/**
-	 * Rate limiting options. When undefined, rate limiting is disabled.
-	 * When set with options, rate limiting is enabled with those options.
+	 * Rate limiting options. Defaults to 1000 requests per minute (localhost excluded).
+	 * Set to undefined to disable rate limiting, or provide custom options to configure.
 	 */
-	rateLimit?: RateLimitPluginOptions;
+	rateLimit?: boolean | RateLimitPluginOptions;
 	/**
 	 * Hookified options.
 	 */
@@ -121,7 +121,11 @@ export class MockHttp extends Hookified {
 		images: true,
 	};
 
-	private _rateLimit?: RateLimitPluginOptions;
+	private _rateLimit?: RateLimitPluginOptions = {
+		max: 1000,
+		timeWindow: "1 minute",
+		allowList: ["127.0.0.1", "::1"],
+	};
 
 	private _server: FastifyInstance = Fastify();
 	private _taps: TapManager = new TapManager();
@@ -150,7 +154,11 @@ export class MockHttp extends Hookified {
 		}
 
 		if (options?.rateLimit !== undefined) {
-			this._rateLimit = options.rateLimit;
+			if (options.rateLimit === false) {
+				this._rateLimit = undefined;
+			} else {
+				this._rateLimit = options.rateLimit as RateLimitPluginOptions;
+			}
 		}
 	}
 
@@ -251,18 +259,20 @@ export class MockHttp extends Hookified {
 	}
 
 	/**
-	 * Rate limiting options. When undefined, rate limiting is disabled.
-	 * When set with options, rate limiting is enabled with those options.
-	 * @default undefined
+	 * Rate limiting options. Defaults to 1000 requests per minute (localhost excluded).
+	 * Set to undefined to disable rate limiting, or provide custom options to configure.
+	 * @default { max: 1000, timeWindow: "1 minute", allowList: ["127.0.0.1", "::1"] }
 	 */
 	public get rateLimit(): RateLimitPluginOptions | undefined {
 		return this._rateLimit;
 	}
 
 	/**
-	 * Rate limiting options. When undefined, rate limiting is disabled.
-	 * When set with options, rate limiting is enabled with those options.
-	 * @default undefined
+	 * Rate limiting options. Defaults to 1000 requests per minute (localhost excluded).
+	 * Set to undefined to disable rate limiting, or provide custom options to configure.
+	 *
+	 * Note: Changing this property requires restarting the server (close() then start()) for changes to take effect.
+	 * @default { max: 1000, timeWindow: "1 minute", allowList: ["127.0.0.1", "::1"] }
 	 */
 	public set rateLimit(rateLimit: RateLimitPluginOptions | undefined) {
 		this._rateLimit = rateLimit;

test/mock-http.test.ts

@@ -435,13 +435,23 @@ describe("MockHttp", () => {
 	});
 
 	describe("rate limiting", () => {
-		test("should be disabled by default", async () => {
+		test("should be enabled by default with 1000 requests per minute and localhost excluded", () => {
 			const mock = new MockHttp();
+			expect(mock.rateLimit).toBeDefined();
+			expect(mock.rateLimit?.max).toBe(1000);
+			expect(mock.rateLimit?.timeWindow).toBe("1 minute");
+			expect(mock.rateLimit?.allowList).toEqual(["127.0.0.1", "::1"]);
+		});
+
+		test("should be able to disable rate limiting", async () => {
+			const mock = new MockHttp({
+				rateLimit: false,
+			});
 			expect(mock.rateLimit).toBeUndefined();
 
 			await mock.start();
 
-			// Make multiple requests quickly - should all succeed
+			// Make many requests quickly - all should succeed without rate limiting
 			const responses = await Promise.all([
 				mock.server.inject({ method: "GET", url: "/get" }),
 				mock.server.inject({ method: "GET", url: "/get" }),
@@ -473,7 +483,7 @@ describe("MockHttp", () => {
 
 		test("should be able to modify rate limit options via setter", () => {
 			const mock = new MockHttp();
-			expect(mock.rateLimit).toBeUndefined();
+			expect(mock.rateLimit).toBeDefined();
 
 			const rateLimitOptions = {
 				max: 50,