X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/46cd08b1c866162cafa92fb0aa2b38ca6fe1f353..927cc9f45e6626e2a82403d1263b4a16d601e30b:/test/controllers/api/nodes_controller_test.rb?ds=inline diff --git a/test/controllers/api/nodes_controller_test.rb b/test/controllers/api/nodes_controller_test.rb index 2d827a077..7becffddc 100644 --- a/test/controllers/api/nodes_controller_test.rb +++ b/test/controllers/api/nodes_controller_test.rb @@ -558,6 +558,91 @@ module Api assert_includes apinode.tags, "\#{@user.inspect}" end + ## + # test initial rate limit + def test_initial_rate_limit + # create a user + user = create(:user) + + # create a changeset that puts us near the initial rate limit + changeset = create(:changeset, :user => user, + :created_at => Time.now.utc - 5.minutes, + :num_changes => Settings.initial_changes_per_hour - 1) + + # create authentication header + auth_header = basic_authorization_header user.email, "test" + + # try creating a node + xml = "" + put node_create_path, :params => xml, :headers => auth_header + assert_response :success, "node create did not return success status" + + # get the id of the node we created + nodeid = @response.body + + # try updating the node, which should be rate limited + xml = "" + put api_node_path(nodeid), :params => xml, :headers => auth_header + assert_response :too_many_requests, "node update did not hit rate limit" + + # try deleting the node, which should be rate limited + xml = "" + delete api_node_path(nodeid), :params => xml, :headers => auth_header + assert_response :too_many_requests, "node delete did not hit rate limit" + + # try creating a node, which should be rate limited + xml = "" + put node_create_path, :params => xml, :headers => auth_header + assert_response :too_many_requests, "node create did not hit rate limit" + end + + ## + # test maximum rate limit + def test_maximum_rate_limit + # create a user + user = create(:user) + + # create a changeset to establish our initial edit time + changeset = create(:changeset, :user => user, + :created_at => Time.now.utc - 28.days) + + # create changeset to put us near the maximum rate limit + total_changes = Settings.max_changes_per_hour - 1 + while total_changes.positive? + changes = [total_changes, Changeset::MAX_ELEMENTS].min + changeset = create(:changeset, :user => user, + :created_at => Time.now.utc - 5.minutes, + :num_changes => changes) + total_changes -= changes + end + + # create authentication header + auth_header = basic_authorization_header user.email, "test" + + # try creating a node + xml = "" + put node_create_path, :params => xml, :headers => auth_header + assert_response :success, "node create did not return success status" + + # get the id of the node we created + nodeid = @response.body + + # try updating the node, which should be rate limited + xml = "" + put api_node_path(nodeid), :params => xml, :headers => auth_header + assert_response :too_many_requests, "node update did not hit rate limit" + + # try deleting the node, which should be rate limited + xml = "" + delete api_node_path(nodeid), :params => xml, :headers => auth_header + assert_response :too_many_requests, "node delete did not hit rate limit" + + # try creating a node, which should be rate limited + xml = "" + put node_create_path, :params => xml, :headers => auth_header + assert_response :too_many_requests, "node create did not hit rate limit" + end + private ##