peter
e7f38396a2
Deep-review round 3 over main..improvement/watch-background-audio. Account boot - The notification history and settings, and the hints toggle, are read when their modules load, which in a new tab (bookmark, typed URL) is before BootGate pins the account: they read as nobody's, and the tab's first notice replaced the account's stored history (up to 100 entries) with a one-item list. They now read again when the tab is pinned (onAccountPinned, run by setActiveAccount); a notice raised before the pin stays, after the history. - A tab pinned to an account still in this browser's wallet but whose session ended (suspended, deleted, or revoked by "log out everywhere") got "signed out" from /api/me while the default account was still signed in, and signing in again as anyone else left it there. A refused per-tab account now leaves the wallet, and the probe answers as the default, so the tab reloads onto it. Share page (/watch) - The password unlock is limited per viewer (link + client IP), under a per-link ceiling that counts only wrong passwords. Keyed on the link alone, ten wrong guesses every five minutes locked out every viewer, the ones with the password included. client_ip moves to app.ratelimit so the public routes can key on it. - Its failure messages and the load-failure screen are announced (role=alert, the password input described by its error). The sign-in, passphrase, password-change and setup form errors get role=alert too. Comments that still described removed machinery are corrected: App's collapse flags, SettingsPanel's Save bar, ConfigPanel, authed_format_sig. Tests: the account's history and hints across the pin; a revoked and a suspended pinned account; the per-viewer limit and the ceiling; the limiter's exhausted(); the share page's announced failures; a share link's feed filters persisted. Each mutation-checked RED for its own reason.
79 lines
2.9 KiB
Python
79 lines
2.9 KiB
Python
"""The sliding-window limiter behind /auth/register, password-login, password-reset and demo.
|
|
|
|
Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
|
|
the module-level limiters between tests), so without a test here a refactor could turn it into a
|
|
no-op and nothing would notice until an unrelated test started failing with a 429.
|
|
"""
|
|
|
|
from app import ratelimit
|
|
from app.ratelimit import RateLimiter
|
|
|
|
|
|
def test_allow_trips_at_the_cap_and_stays_tripped():
|
|
lim = RateLimiter(max_events=2, window_seconds=300)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is False
|
|
assert lim.allow("ip") is False
|
|
|
|
|
|
def test_hammering_while_blocked_does_not_push_the_window_forward(monkeypatch):
|
|
# A blocked attempt must not be recorded, otherwise someone who keeps retrying holds their own
|
|
# window open forever — an indefinite lockout for anyone sharing that IP. Only observable across
|
|
# the window boundary, so drive the clock: two attempts fill the cap, ten blocked retries land
|
|
# just before it expires, and the caller must still be let back in on the far side.
|
|
clock = {"t": 1000.0}
|
|
monkeypatch.setattr(ratelimit.time, "monotonic", lambda: clock["t"])
|
|
lim = RateLimiter(max_events=2, window_seconds=60)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|
|
for _ in range(10):
|
|
clock["t"] += 5 # still inside the window; every one of these is refused
|
|
assert lim.allow("ip") is False
|
|
|
|
clock["t"] = 1000.0 + 61 # past the window of the two attempts that actually counted
|
|
assert lim.allow("ip") is True
|
|
|
|
|
|
def test_keys_are_independent():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("a") is False
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_reset_clears_every_key():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
lim.allow("a")
|
|
lim.allow("b")
|
|
assert lim.allow("a") is False
|
|
|
|
lim.reset()
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_exhausted_reports_a_full_window_without_counting_an_attempt():
|
|
# The asking half of a limit that counts only some outcomes (a share link's unlock counts only
|
|
# wrong passwords toward its ceiling): asking must never use up the window it asks about.
|
|
lim = RateLimiter(max_events=2, window_seconds=300)
|
|
|
|
for _ in range(5):
|
|
assert lim.exhausted("link") is False
|
|
assert lim.allow("link") is True
|
|
assert lim.exhausted("link") is False
|
|
assert lim.allow("link") is True
|
|
assert lim.exhausted("link") is True
|
|
|
|
|
|
def test_expired_attempts_fall_out_of_the_window():
|
|
# A zero-length window means every previous attempt is already outside it.
|
|
lim = RateLimiter(max_events=1, window_seconds=0)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|