Jesse_Chen
c38f11dbd3
Stop accepting client-supplied birth data on those paths, and cap session writes plus location lookups so a logged-in caller cannot farm compute. Co-authored-by: Cursor <cursoragent@cursor.com>
49 lines
1.2 KiB
TypeScript
49 lines
1.2 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { consumeRequestRateLimit } from "../src/lib/request-rate-limit.ts";
|
|
|
|
test("a user is allowed up to the window limit and then must wait", () => {
|
|
const store = new Map<string, number[]>();
|
|
const first = consumeRequestRateLimit({
|
|
key: "search:user-1",
|
|
limit: 2,
|
|
windowMs: 60_000,
|
|
now: 1_000,
|
|
store,
|
|
});
|
|
const second = consumeRequestRateLimit({
|
|
key: "search:user-1",
|
|
limit: 2,
|
|
windowMs: 60_000,
|
|
now: 2_000,
|
|
store,
|
|
});
|
|
const blocked = consumeRequestRateLimit({
|
|
key: "search:user-1",
|
|
limit: 2,
|
|
windowMs: 60_000,
|
|
now: 3_000,
|
|
store,
|
|
});
|
|
const otherUser = consumeRequestRateLimit({
|
|
key: "search:user-2",
|
|
limit: 2,
|
|
windowMs: 60_000,
|
|
now: 3_000,
|
|
store,
|
|
});
|
|
const afterWindow = consumeRequestRateLimit({
|
|
key: "search:user-1",
|
|
limit: 2,
|
|
windowMs: 60_000,
|
|
now: 61_500,
|
|
store,
|
|
});
|
|
|
|
assert.deepEqual(first, { ok: true });
|
|
assert.deepEqual(second, { ok: true });
|
|
assert.deepEqual(blocked, { ok: false, retryAfterSeconds: 58 });
|
|
assert.deepEqual(otherUser, { ok: true });
|
|
assert.deepEqual(afterWindow, { ok: true });
|
|
});
|