From f6e8381c20caa92630fa62819019519172138ba4 Mon Sep 17 00:00:00 2001 From: Mauricio Barragan Date: Wed, 17 Jun 2026 21:35:11 -0600 Subject: [PATCH] test(m3): add Upstash read-tier rate limit HTTP test Node test asserts 429 with Retry-After after 60 GET requests per IP. Co-authored-by: Cursor --- .env.example | 4 +- README.md | 2 +- package.json | 1 + src/interfaces/http/rate-limit.test.ts | 60 ++++++++++++++++++++++++++ src/test-support/load-env-local.ts | 35 +++++++++++++++ 5 files changed, 99 insertions(+), 3 deletions(-) create mode 100644 src/interfaces/http/rate-limit.test.ts create mode 100644 src/test-support/load-env-local.ts diff --git a/.env.example b/.env.example index ac3f910..aaf6c92 100644 --- a/.env.example +++ b/.env.example @@ -31,5 +31,5 @@ SENTRY_DSN= LOG_LEVEL=info # Upstash Redis — rate limit on /api/* and short-TTL snapshot cache for GET /api/state -UPSTASH_REDIS_REST_URL= -UPSTASH_REDIS_REST_TOKEN= +UPSTASH_REDIS_REST_URL="https://natural-baboon-144595.upstash.io" +UPSTASH_REDIS_REST_TOKEN="gQAAAAAAAjTTAAIgcDE0MDk4MGZlOWMwN2M0NTdiOWQ5MWYxMjVhOWMyNWVlZQ" diff --git a/README.md b/README.md index 0aa9980..71d194f 100644 --- a/README.md +++ b/README.md @@ -348,7 +348,7 @@ Eso no indica que el bot “no funcione”: indica que el filtro económico es e - **Pre-commit:** Husky runs lint-staged (`eslint --fix`, `prettier --write`) on staged `*.ts` / `*.tsx` in `src/` and `web/src/`. - **API contracts:** Zod schemas per REST endpoint → OpenAPI via `@asteasolutions/zod-to-openapi` → Scalar UI at `/api-docs`. Request bodies validated with Zod in route handlers. - **Observability:** `@sentry/node` captures REST, WebSocket feed, and SSE errors; `pino` JSON logs with `correlationId` (from `x-request-id` or per book tick); OpenTelemetry spans (`ws.message` → `orderbook.process` → `arbitrage.evaluate` → `sse.broadcast`) export to Sentry via `@sentry/opentelemetry` when `SENTRY_DSN` is set. Dev probe: `GET /api/debug/sentry`; verify with `npm run test:observability`. -- **Rate limiting & cache:** Upstash sliding-window limits per IP on read/write/SSE routes (`429` + `Retry-After`). Latest `StateSnapshot` cached in Redis (~1s TTL) for `GET /api/state` and refreshed on SSE broadcast. Set `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`. +- **Rate limiting & cache:** Upstash sliding-window limits per IP on read/write/SSE routes (`429` + `Retry-After`). Latest `StateSnapshot` cached in Redis (~1s TTL) for `GET /api/state` and refreshed on SSE broadcast. Set `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`. Verify with `npm run test:rate-limit`. - **CI:** GitHub Actions quality pipeline (typecheck, unit tests, build); Playwright smoke on PRs — dashboard loads and SSE connects (`npm run test:e2e`, workflow `e2e.yml`, `DEMO_MODE=true` in CI). - **Security scanning:** CodeQL (`.github/workflows/codeql.yml`); Dependabot for npm (root + `web/`) and GitHub Actions. diff --git a/package.json b/package.json index 70194da..80bd5e0 100644 --- a/package.json +++ b/package.json @@ -13,6 +13,7 @@ "build": "npm --prefix web install && npm --prefix web run build", "typecheck": "tsc --noEmit && npm --prefix web run typecheck", "test": "node scripts/run-tests.mjs", + "test:rate-limit": "node --import tsx --test src/interfaces/http/rate-limit.test.ts", "test:e2e": "playwright test", "test:observability": "playwright test observability.spec.ts", "lint": "eslint .", diff --git a/src/interfaces/http/rate-limit.test.ts b/src/interfaces/http/rate-limit.test.ts new file mode 100644 index 0000000..78c9ace --- /dev/null +++ b/src/interfaces/http/rate-limit.test.ts @@ -0,0 +1,60 @@ +import assert from "node:assert/strict"; +import { randomUUID } from "node:crypto"; +import type { AddressInfo } from "node:net"; +import { test } from "node:test"; +import express, { Router } from "express"; +import { isUpstashConfigured } from "../../infrastructure/cache/upstash.js"; +import { loadEnvLocal } from "../../test-support/load-env-local.js"; +import { createRateLimitMiddleware } from "./rate-limit.js"; + +loadEnvLocal(); + +const READ_LIMIT_PER_MIN = 60; + +test( + "read tier returns 429 with Retry-After after limit", + { skip: !isUpstashConfigured() }, + async () => { + const app = express(); + const router = Router(); + router.use(createRateLimitMiddleware()); + router.get("/state", (_req, res) => { + res.json({ success: true, data: { ok: true } }); + }); + app.use("/api", router); + + const server = await new Promise>( + (resolve) => { + const s = app.listen(0, "127.0.0.1", () => resolve(s)); + }, + ); + const port = (server.address() as AddressInfo).port; + const url = `http://127.0.0.1:${port}/api/state`; + const clientIp = `rate-limit-qa-${randomUUID()}`; + + try { + for (let i = 0; i < READ_LIMIT_PER_MIN; i++) { + const res = await fetch(url, { + headers: { "x-forwarded-for": clientIp }, + }); + assert.equal(res.status, 200, `request ${i + 1} should pass`); + } + + const blocked = await fetch(url, { + headers: { "x-forwarded-for": clientIp }, + }); + assert.equal(blocked.status, 429); + assert.ok(blocked.headers.get("retry-after")); + const body = (await blocked.json()) as { error?: string }; + assert.equal(body.error, "Too many requests"); + } finally { + await new Promise((resolve, reject) => { + server.close((err) => (err ? reject(err) : resolve())); + }); + } + }, +); + +test("reports whether Upstash REST credentials are set", () => { + assert.equal(typeof isUpstashConfigured(), "boolean"); +}); diff --git a/src/test-support/load-env-local.ts b/src/test-support/load-env-local.ts new file mode 100644 index 0000000..6c717ec --- /dev/null +++ b/src/test-support/load-env-local.ts @@ -0,0 +1,35 @@ +import { existsSync, readFileSync } from "node:fs"; +import { join } from "node:path"; + +/** Loads `.env.local` without overriding variables already set in the shell. */ +export function loadEnvLocal(): void { + const file = join(process.cwd(), ".env.local"); + if (!existsSync(file)) { + return; + } + + for (const line of readFileSync(file, "utf8").split(/\r?\n/)) { + const trimmed = line.trim(); + if (!trimmed || trimmed.startsWith("#")) { + continue; + } + + const eq = trimmed.indexOf("="); + if (eq <= 0) { + continue; + } + + const key = trimmed.slice(0, eq).trim(); + let value = trimmed.slice(eq + 1).trim(); + if ( + (value.startsWith('"') && value.endsWith('"')) || + (value.startsWith("'") && value.endsWith("'")) + ) { + value = value.slice(1, -1); + } + + if (process.env[key] === undefined) { + process.env[key] = value; + } + } +}