X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/2479319b7859d9b271dc8900e5d530c77976025a..39b0d27bae7791b37498cfd4fa99a686a3bca525:/test/controllers/api/nodes_controller_test.rb
diff --git a/test/controllers/api/nodes_controller_test.rb b/test/controllers/api/nodes_controller_test.rb
index 339dd2af8..7becffddc 100644
--- a/test/controllers/api/nodes_controller_test.rb
+++ b/test/controllers/api/nodes_controller_test.rb
@@ -86,7 +86,7 @@ module Api
end
def test_create_invalid_xml
- ## Only test public user here, as test_create should cover what's the forbiddens
+ ## Only test public user here, as test_create should cover what's the forbidden
## that would occur here
user = create(:user)
@@ -138,7 +138,7 @@ module Api
xml = ""
put node_create_path, :params => xml, :headers => auth_header
assert_response :bad_request, "node upload did not return bad_request status"
- assert_equal ["NodeTag ", " v: is too long (maximum is 255 characters) (\"#{'x' * 256}\")"], @response.body.split(/[0-9]+,foo:/)
+ assert_match(/ v: is too long \(maximum is 255 characters\) /, @response.body)
end
def test_show
@@ -258,8 +258,7 @@ module Api
# valid delete should return the new version number, which should
# be greater than the old version number
- assert @response.body.to_i > node.version,
- "delete request should return a new version number for node"
+ assert_operator @response.body.to_i, :>, node.version, "delete request should return a new version number for node"
# deleting the same node twice doesn't work
xml = xml_for_node(node)
@@ -527,7 +526,7 @@ module Api
# try and put something into a string that the API might
# use unquoted and therefore allow code injection...
xml = "" \
- '' \
+ "" \
""
put node_create_path, :params => xml, :headers => auth_header
assert_require_public_data "Shouldn't be able to create with non-public user"
@@ -538,7 +537,7 @@ module Api
# try and put something into a string that the API might
# use unquoted and therefore allow code injection...
xml = "" \
- '' \
+ "" \
""
put node_create_path, :params => xml, :headers => auth_header
assert_response :success
@@ -559,6 +558,91 @@ module Api
assert_includes apinode.tags, "\#{@user.inspect}"
end
+ ##
+ # test initial rate limit
+ def test_initial_rate_limit
+ # create a user
+ user = create(:user)
+
+ # create a changeset that puts us near the initial rate limit
+ changeset = create(:changeset, :user => user,
+ :created_at => Time.now.utc - 5.minutes,
+ :num_changes => Settings.initial_changes_per_hour - 1)
+
+ # create authentication header
+ auth_header = basic_authorization_header user.email, "test"
+
+ # try creating a node
+ xml = ""
+ put node_create_path, :params => xml, :headers => auth_header
+ assert_response :success, "node create did not return success status"
+
+ # get the id of the node we created
+ nodeid = @response.body
+
+ # try updating the node, which should be rate limited
+ xml = ""
+ put api_node_path(nodeid), :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node update did not hit rate limit"
+
+ # try deleting the node, which should be rate limited
+ xml = ""
+ delete api_node_path(nodeid), :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node delete did not hit rate limit"
+
+ # try creating a node, which should be rate limited
+ xml = ""
+ put node_create_path, :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node create did not hit rate limit"
+ end
+
+ ##
+ # test maximum rate limit
+ def test_maximum_rate_limit
+ # create a user
+ user = create(:user)
+
+ # create a changeset to establish our initial edit time
+ changeset = create(:changeset, :user => user,
+ :created_at => Time.now.utc - 28.days)
+
+ # create changeset to put us near the maximum rate limit
+ total_changes = Settings.max_changes_per_hour - 1
+ while total_changes.positive?
+ changes = [total_changes, Changeset::MAX_ELEMENTS].min
+ changeset = create(:changeset, :user => user,
+ :created_at => Time.now.utc - 5.minutes,
+ :num_changes => changes)
+ total_changes -= changes
+ end
+
+ # create authentication header
+ auth_header = basic_authorization_header user.email, "test"
+
+ # try creating a node
+ xml = ""
+ put node_create_path, :params => xml, :headers => auth_header
+ assert_response :success, "node create did not return success status"
+
+ # get the id of the node we created
+ nodeid = @response.body
+
+ # try updating the node, which should be rate limited
+ xml = ""
+ put api_node_path(nodeid), :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node update did not hit rate limit"
+
+ # try deleting the node, which should be rate limited
+ xml = ""
+ delete api_node_path(nodeid), :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node delete did not hit rate limit"
+
+ # try creating a node, which should be rate limited
+ xml = ""
+ put node_create_path, :params => xml, :headers => auth_header
+ assert_response :too_many_requests, "node create did not hit rate limit"
+ end
+
private
##