order_site/apps/backend/src/middleware/rate-limit.test.ts

import test from 'node:test'
import assert from 'node:assert/strict'
import type { NextFunction, Request, Response } from 'express'

import { createRateLimitMiddleware, resetRateLimitBucketsForTest } from './rate-limit.js'

test('createRateLimitMiddleware allows requests within the window', () => {
  resetRateLimitBucketsForTest()

  const limiter = createRateLimitMiddleware({
    scope: 'test:allow',
    windowMs: 60_000,
    max: 2,
  })
  const req = createMockRequest()
  const res = createMockResponse()
  let nextCount = 0
  const next: NextFunction = () => {
    nextCount += 1
  }

  limiter(req, res, next)
  limiter(req, res, next)

  assert.equal(nextCount, 2)
  assert.equal(res.statusCode, 200)
})

test('createRateLimitMiddleware blocks requests over the limit', () => {
  resetRateLimitBucketsForTest()

  const limiter = createRateLimitMiddleware({
    scope: 'test:block',
    windowMs: 60_000,
    max: 1,
  })
  const req = createMockRequest()
  const res = createMockResponse()
  let nextCount = 0
  const next: NextFunction = () => {
    nextCount += 1
  }

  limiter(req, res, next)
  limiter(req, res, next)

  assert.equal(nextCount, 1)
  assert.equal(res.statusCode, 429)
  assert.equal(res.headers['Retry-After'], '60')
  assert.equal(res.body.errorCode, 'rate_limited')
})

test('createRateLimitMiddleware supports custom limit responses', () => {
  resetRateLimitBucketsForTest()

  const limiter = createRateLimitMiddleware({
    scope: 'test:custom',
    windowMs: 60_000,
    max: 1,
    onLimit: (_req, res) => {
      res.status(200).json({ code: 429, message: 'limited' })
    },
  })
  const req = createMockRequest()
  const res = createMockResponse()

  limiter(req, res, () => {})
  limiter(req, res, () => {})

  assert.equal(res.statusCode, 200)
  assert.deepEqual(res.body, { code: 429, message: 'limited' })
})

test('createRateLimitMiddleware can cap an IP across different accounts', () => {
  resetRateLimitBucketsForTest()

  const limiter = createRateLimitMiddleware({
    scope: 'test:ip-wide',
    windowMs: 60_000,
    max: 2,
  })
  const first = createMockRequest()
  const second = createMockRequest()
  const third = createMockRequest()
  const response = createMockResponse()
  let nextCount = 0
  const next: NextFunction = () => {
    nextCount += 1
  }

  limiter(first, response, next)
  limiter(second, response, next)
  limiter(third, response, next)

  assert.equal(nextCount, 2)
  assert.equal(response.statusCode, 429)
})

function createMockRequest(): Request {
  return {
    ip: '127.0.0.1',
    originalUrl: '/test',
    headers: {},
    socket: {
      remoteAddress: '127.0.0.1',
    },
  } as Request
}

function createMockResponse(): Response & {
  statusCode: number
  headers: Record<string, string>
  body: any
} {
  const res = {
    statusCode: 200,
    headers: {} as Record<string, string>,
    body: null as any,
    setHeader(name: string, value: string) {
      this.headers[name] = value
      return this
    },
    status(statusCode: number) {
      this.statusCode = statusCode
      return this
    },
    json(body: any) {
      this.body = body
      return this
    },
  }

  return res as Response & {
    statusCode: number
    headers: Record<string, string>
    body: any
  }
}

test('限流桶有数量硬上限：key 含用户可控字段时不能无限膨胀', async () => {
  const { readFile } = await import('node:fs/promises')
  const src = await readFile(new URL('./rate-limit.ts', import.meta.url), 'utf8')
  // collect 路由的限流 key 里带请求体 orderNo（可被构造），只按过期清理挡不住高基数灌键
  assert.ok(src.includes('MAX_RATE_LIMIT_BUCKETS'), '缺少限流桶数量上限')
  assert.ok(src.includes('buckets.size > MAX_RATE_LIMIT_BUCKETS'), '必须在清理时按上限淘汰最老的桶')
})