peter
b64c3f514d
Round 3 of the review killed the reopen from b5a1002: flipping an approved
invite back to pending let an unauthenticated POST /auth/register REVOKE a
standing approval for any whitelisted-but-unclaimed address, which then fails
is_allowed() and locks the real owner out of Google sign-in — the primary way
people get in here. It also re-armed the pre-emption window it was meant to
close, because with no SMTP email_verified is set True and the SEC-10 guard the
design leaned on never fires.
Two attempts at fixing the stranded-account UX in the same change both came back
worse than the wart. What remains is the narrow, real bug: the account was
silently rolled back and is now committed. An admin still binds the approval to
the account, exactly as before this branch. UX-25 in the roadmap records the
follow-up and both dead ends so they are not retried.
Also from round 3: the upsert docstring no longer claims the admin UI cannot
reach these accounts (re-entering the address in the same panel's whitelist box
does, and a test now pins it), the release notes are scoped to what the diff
actually changes with the operator note moved where the dialog renders it, and
RateLimiter has unit tests so reset() is not production code only a fixture
calls.
47 lines
1.4 KiB
Python
47 lines
1.4 KiB
Python
"""The sliding-window limiter behind /auth/register, password-login, password-reset and demo.
|
|
|
|
Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
|
|
the module-level limiters between tests), so without a test here a refactor could turn it into a
|
|
no-op and nothing would notice until an unrelated test started failing with a 429.
|
|
"""
|
|
|
|
from app.ratelimit import RateLimiter
|
|
|
|
|
|
def test_allow_trips_at_the_cap_and_stays_tripped():
|
|
lim = RateLimiter(max_events=2, window_seconds=300)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is False
|
|
# A blocked attempt is not counted, so a caller cannot push the window forward by hammering.
|
|
assert lim.allow("ip") is False
|
|
|
|
|
|
def test_keys_are_independent():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("a") is False
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_reset_clears_every_key():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
lim.allow("a")
|
|
lim.allow("b")
|
|
assert lim.allow("a") is False
|
|
|
|
lim.reset()
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_expired_attempts_fall_out_of_the_window():
|
|
# A zero-length window means every previous attempt is already outside it.
|
|
lim = RateLimiter(max_events=1, window_seconds=0)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|