29 lines
1004 B
JavaScript
29 lines
1004 B
JavaScript
const test = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const { createRateLimit } = require("../src/security/rateLimit");
|
|
|
|
function response() {
|
|
return {
|
|
headers: {},
|
|
set(name, value) { this.headers[name] = value; },
|
|
status(value) { this.statusCode = value; return this; },
|
|
send(value) { this.body = value; return this; },
|
|
};
|
|
}
|
|
|
|
test("rate limiter rejects requests beyond the configured window", () => {
|
|
const middleware = createRateLimit({ windowMs: 60000, max: 2, error: "limited" });
|
|
const req = { ip: "127.0.0.1", baseUrl: "/api/auth", path: "/signin/local" };
|
|
let allowed = 0;
|
|
|
|
middleware(req, response(), () => { allowed += 1; });
|
|
middleware(req, response(), () => { allowed += 1; });
|
|
const blocked = response();
|
|
middleware(req, blocked, () => { allowed += 1; });
|
|
|
|
assert.equal(allowed, 2);
|
|
assert.equal(blocked.statusCode, 429);
|
|
assert.deepEqual(blocked.body, { error: "limited" });
|
|
assert.ok(blocked.headers["Retry-After"]);
|
|
});
|