Issue/190 rate limit config and feature tests

shared/config/rate_limit.php

@@ -0,0 +1,27 @@
+<?php
+
+return [
+    /**
+     * ---------------------------------------------------------
+     * Default rate limit adapter
+     * ---------------------------------------------------------
+     */
+    'default' => env('RATE_LIMIT_ADAPTER', 'file'),
+
+    /**
+     * ---------------------------------------------------------
+     * Rate limit connections
+     * ---------------------------------------------------------
+     */
+    'file' => [
+        'prefix' => str_replace(' ', '', env('APP_NAME') ?? ''),
+        'path' => base_dir() . DS . 'cache' . DS . 'data',
+        'ttl' => 60,
+    ],
+    'redis' => [
+        'prefix' => str_replace(' ', '', env('APP_NAME') ?? ''),
+        'host' => env('REDIS_HOST', '127.0.0.1'),
+        'port' => env('REDIS_PORT', 6379),
+        'ttl' => 60,
+    ],
+];

tests/Feature/AppTestCase.php

@@ -25,10 +25,12 @@ public function setUp(): void
         ob_start();
 
         self::$app = createApp(AppType::WEB, PROJECT_ROOT);
+        $this->clearRateLimitStorage();
     }
 
     public function tearDown(): void
     {
+        $this->clearRateLimitStorage();
         parent::tearDown();
         ob_end_clean();
     }
@@ -54,4 +56,21 @@ protected function signInAndGetTokens(): array
 
         return $response->get('tokens');
     }
+
+    private function clearRateLimitStorage(): void
+    {
+        $rateLimitDir = PROJECT_ROOT . DS . 'cache' . DS . 'data';
+
+        if (!is_dir($rateLimitDir)) {
+            return;
+        }
+
+        foreach (glob($rateLimitDir . DS . '*.rate') ?: [] as $file) {
+            @unlink($file);
+        }
+
+        foreach (glob($rateLimitDir . DS . '*.lock') ?: [] as $file) {
+            @unlink($file);
+        }
+    }
 }

tests/Feature/modules/Api/RateLimitTest.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Quantum\Tests\Feature\modules\Api;
+
+use Quantum\Tests\Feature\AppTestCase;
+use Quantum\Http\Response;
+
+class RateLimitTest extends AppTestCase
+{
+    public function setUp(): void
+    {
+        parent::setUp();
+        $this->ensureRateLimitStorageExists();
+        $this->clearRateLimitStorage();
+    }
+
+    public function tearDown(): void
+    {
+        $this->clearRateLimitStorage();
+        parent::tearDown();
+    }
+
+    public function testSignInEndpointReturns429WhenLimitExceeded(): void
+    {
+        for ($i = 0; $i < 10; $i++) {
+            $response = $this->attemptFailedSignin();
+            $this->assertNotSame(429, $response->getStatusCode());
+        }
+
+        $blocked = $this->attemptFailedSignin();
+
+        $this->assertSame(429, $blocked->getStatusCode());
+        $this->assertSame('10', $blocked->getHeader('X-RateLimit-Limit'));
+        $this->assertSame('0', $blocked->getHeader('X-RateLimit-Remaining'));
+        $this->assertNotNull($blocked->getHeader('Retry-After'));
+        $this->assertSame('Too Many Requests', $blocked->get('message'));
+    }
+
+    public function testRateLimitBucketIsRouteSpecific(): void
+    {
+        for ($i = 0; $i < 10; $i++) {
+            $this->attemptFailedSignin();
+        }
+
+        $blocked = $this->attemptFailedSignin();
+        $this->assertSame(429, $blocked->getStatusCode());
+
+        response()->flush();
+
+        $postsResponse = $this->request('get', '/api/en/posts');
+        $this->assertNotSame(429, $postsResponse->getStatusCode());
+    }
+
+    private function attemptFailedSignin(): Response
+    {
+        response()->flush();
+
+        return $this->request('post', '/api/en/signin', [
+            'email' => 'non-existing-user@example.com',
+            'password' => 'invalid-password',
+        ]);
+    }
+
+    private function clearRateLimitStorage(): void
+    {
+        $rateLimitDir = PROJECT_ROOT . DS . 'cache' . DS . 'data';
+
+        foreach (glob($rateLimitDir . DS . '*.rate') ?: [] as $file) {
+            @unlink($file);
+        }
+
+        foreach (glob($rateLimitDir . DS . '*.lock') ?: [] as $file) {
+            @unlink($file);
+        }
+    }
+
+    private function ensureRateLimitStorageExists(): void
+    {
+        $rateLimitDir = PROJECT_ROOT . DS . 'cache' . DS . 'data';
+
+        if (!is_dir($rateLimitDir)) {
+            mkdir($rateLimitDir, 0777, true);
+        }
+    }
+}