peter
6d8b7be6d8
The demo account — one shared user that whitelisted emails entered from the login page, reset on a schedule — goes end to end (owner decision, E34): demo.py and the reset job, users.is_demo and demo_whitelist (migration 0098 deletes the demo user, its audit rows, the reset job's override and notices, then drops the column and table; the downgrade restores the empty schema), the /auth/demo entry, the admin whitelist and reset, the Demo tab, the banner, the login page's "Try the demo", and every is_demo branch in routes, userscope, scheduler and the UI. require_human only ever refused the demo account, so its 87 uses become current_user (owner-approved); require_write_scope keeps its own check. The login page's "or" divider now shows only beside the Google button: without the demo entry under it, an instance without Google would have said "or" to nothing. A contract test (removedFeatures) fails on the word anywhere in the backend, frontend, e2e or scripts — seen red on a planted hit. Size ceilings tightened for the modules that shrank; admin.py is back under the limit.
79 lines
2.8 KiB
Python
79 lines
2.8 KiB
Python
"""The sliding-window limiter behind /auth/register, password-login and password-reset.
|
|
|
|
Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
|
|
the module-level limiters between tests), so without a test here a refactor could turn it into a
|
|
no-op and nothing would notice until an unrelated test started failing with a 429.
|
|
"""
|
|
|
|
from app import ratelimit
|
|
from app.ratelimit import RateLimiter
|
|
|
|
|
|
def test_allow_trips_at_the_cap_and_stays_tripped():
|
|
lim = RateLimiter(max_events=2, window_seconds=300)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is False
|
|
assert lim.allow("ip") is False
|
|
|
|
|
|
def test_hammering_while_blocked_does_not_push_the_window_forward(monkeypatch):
|
|
# A blocked attempt must not be recorded, otherwise someone who keeps retrying holds their own
|
|
# window open forever — an indefinite lockout for anyone sharing that IP. Only observable across
|
|
# the window boundary, so drive the clock: two attempts fill the cap, ten blocked retries land
|
|
# just before it expires, and the caller must still be let back in on the far side.
|
|
clock = {"t": 1000.0}
|
|
monkeypatch.setattr(ratelimit.time, "monotonic", lambda: clock["t"])
|
|
lim = RateLimiter(max_events=2, window_seconds=60)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|
|
for _ in range(10):
|
|
clock["t"] += 5 # still inside the window; every one of these is refused
|
|
assert lim.allow("ip") is False
|
|
|
|
clock["t"] = 1000.0 + 61 # past the window of the two attempts that actually counted
|
|
assert lim.allow("ip") is True
|
|
|
|
|
|
def test_keys_are_independent():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("a") is False
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_reset_clears_every_key():
|
|
lim = RateLimiter(max_events=1, window_seconds=300)
|
|
lim.allow("a")
|
|
lim.allow("b")
|
|
assert lim.allow("a") is False
|
|
|
|
lim.reset()
|
|
|
|
assert lim.allow("a") is True
|
|
assert lim.allow("b") is True
|
|
|
|
|
|
def test_exhausted_reports_a_full_window_without_counting_an_attempt():
|
|
# The asking half of a limit that counts only some outcomes (a share link's unlock counts only
|
|
# wrong passwords toward its ceiling): asking must never use up the window it asks about.
|
|
lim = RateLimiter(max_events=2, window_seconds=300)
|
|
|
|
for _ in range(5):
|
|
assert lim.exhausted("link") is False
|
|
assert lim.allow("link") is True
|
|
assert lim.exhausted("link") is False
|
|
assert lim.allow("link") is True
|
|
assert lim.exhausted("link") is True
|
|
|
|
|
|
def test_expired_attempts_fall_out_of_the_window():
|
|
# A zero-length window means every previous attempt is already outside it.
|
|
lim = RateLimiter(max_events=1, window_seconds=0)
|
|
|
|
assert lim.allow("ip") is True
|
|
assert lim.allow("ip") is True
|