diff options
author | Michael Kozono <mkozono@gmail.com> | 2017-10-31 21:36:33 +0300 |
---|---|---|
committer | Francisco Lopez <fjlopez@gitlab.com> | 2017-11-17 11:58:18 +0300 |
commit | 203e3b2d072b3a673fda651dafdacb0e0cd6f1ae (patch) | |
tree | 47172c59fa6d0b8e0baddd061fd84662ebf69ea5 /spec/requests/rack_attack_global_spec.rb | |
parent | 6c5f46ace2ef5636e89822787a336c2b433d7dde (diff) |
Dry up URLs and get args construction
Diffstat (limited to 'spec/requests/rack_attack_global_spec.rb')
-rw-r--r-- | spec/requests/rack_attack_global_spec.rb | 84 |
1 files changed, 48 insertions, 36 deletions
diff --git a/spec/requests/rack_attack_global_spec.rb b/spec/requests/rack_attack_global_spec.rb index aa9aa99bbba..c5f48d3b0cc 100644 --- a/spec/requests/rack_attack_global_spec.rb +++ b/spec/requests/rack_attack_global_spec.rb @@ -22,6 +22,10 @@ describe 'Rack Attack global throttles' do let(:period_in_seconds) { 10000 } let(:period) { period_in_seconds.seconds } + let(:url_that_does_not_require_authentication) { '/users/sign_in' } + let(:url_that_requires_authentication) { '/dashboard/snippets' } + let(:api_partial_url) { '/todos' } + # Make time-dependent tests deterministic around do |example| # Instead of test environment's :null_store @@ -132,42 +136,42 @@ describe 'Rack Attack global throttles' do it 'rejects requests over the rate limit' do # At first, allow requests under the rate limit. requests_per_period.times do - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end # the last straw - expect_rejection { get '/users/sign_in' } + expect_rejection { get url_that_does_not_require_authentication } end it 'allows requests after throttling and then waiting for the next period' do requests_per_period.times do - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end - expect_rejection { get '/users/sign_in' } + expect_rejection { get url_that_does_not_require_authentication } Timecop.travel((1.second + period).from_now) do # Add 1 because flaky requests_per_period.times do - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end - expect_rejection { get '/users/sign_in' } + expect_rejection { get url_that_does_not_require_authentication } end end it 'counts requests from different IPs separately' do requests_per_period.times do - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end expect_any_instance_of(Rack::Attack::Request).to receive(:ip).and_return('1.2.3.4') # would be over limit for the same IP - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end end @@ -180,7 +184,7 @@ describe 'Rack Attack global throttles' do it 'allows requests over the rate limit' do (1 + requests_per_period).times do - get '/users/sign_in' + get url_that_does_not_require_authentication expect(response).to have_http_status 200 end end @@ -193,15 +197,15 @@ describe 'Rack Attack global throttles' do let(:throttle_setting_prefix) { 'throttle_authenticated_api' } context 'with the token in the query string' do - let(:get_args) { [api('/todos', user)] } - let(:other_user_get_args) { [api('/todos', other_user)] } + let(:get_args) { [api(api_partial_url, user)] } + let(:other_user_get_args) { [api(api_partial_url, other_user)] } it_behaves_like 'rate-limited token-authenticated requests' end context 'with the token in the headers' do - let(:get_args) { ["/api/#{API::API.version}/todos", nil, private_token_headers(user)] } - let(:other_user_get_args) { ["/api/#{API::API.version}/todos", nil, private_token_headers(other_user)] } + let(:get_args) { api_get_args_with_token_headers(api_partial_url, private_token_headers(user)) } + let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, private_token_headers(other_user)) } it_behaves_like 'rate-limited token-authenticated requests' end @@ -215,15 +219,15 @@ describe 'Rack Attack global throttles' do let(:throttle_setting_prefix) { 'throttle_authenticated_api' } context 'with the token in the query string' do - let(:get_args) { [api('/todos', personal_access_token: token)] } - let(:other_user_get_args) { [api('/todos', personal_access_token: other_user_token)] } + let(:get_args) { [api(api_partial_url, personal_access_token: token)] } + let(:other_user_get_args) { [api(api_partial_url, personal_access_token: other_user_token)] } it_behaves_like 'rate-limited token-authenticated requests' end context 'with the token in the headers' do - let(:get_args) { ["/api/#{API::API.version}/todos", nil, personal_access_token_headers(token)] } - let(:other_user_get_args) { ["/api/#{API::API.version}/todos", nil, personal_access_token_headers(other_user_token)] } + let(:get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(token)) } + let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(other_user_token)) } it_behaves_like 'rate-limited token-authenticated requests' end @@ -239,15 +243,15 @@ describe 'Rack Attack global throttles' do let(:throttle_setting_prefix) { 'throttle_authenticated_api' } context 'with the token in the query string' do - let(:get_args) { [api('/todos', oauth_access_token: token)] } - let(:other_user_get_args) { [api('/todos', oauth_access_token: other_user_token)] } + let(:get_args) { [api(api_partial_url, oauth_access_token: token)] } + let(:other_user_get_args) { [api(api_partial_url, oauth_access_token: other_user_token)] } it_behaves_like 'rate-limited token-authenticated requests' end context 'with the token in the headers' do - let(:get_args) { ["/api/#{API::API.version}/todos", nil, oauth_token_headers(token)] } - let(:other_user_get_args) { ["/api/#{API::API.version}/todos", nil, oauth_token_headers(other_user_token)] } + let(:get_args) { api_get_args_with_token_headers(api_partial_url, oauth_token_headers(token)) } + let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, oauth_token_headers(other_user_token)) } it_behaves_like 'rate-limited token-authenticated requests' end @@ -260,15 +264,15 @@ describe 'Rack Attack global throttles' do context 'with the token in the query string' do context 'with the atom extension' do - let(:get_args) { ["/dashboard/projects.atom?rss_token=#{user.rss_token}"] } - let(:other_user_get_args) { ["/dashboard/projects.atom?rss_token=#{other_user.rss_token}"] } + let(:get_args) { [rss_url(user)] } + let(:other_user_get_args) { [rss_url(other_user)] } it_behaves_like 'rate-limited token-authenticated requests' end context 'with the atom format in the Accept header' do - let(:get_args) { ["/dashboard/projects?rss_token=#{user.rss_token}", nil, { 'HTTP_ACCEPT' => 'application/atom+xml' }] } - let(:other_user_get_args) { ["/dashboard/projects?rss_token=#{other_user.rss_token}", nil, { 'HTTP_ACCEPT' => 'application/atom+xml' }] } + let(:get_args) { [rss_url(user), nil, { 'HTTP_ACCEPT' => 'application/atom+xml' }] } + let(:other_user_get_args) { [rss_url(other_user), nil, { 'HTTP_ACCEPT' => 'application/atom+xml' }] } it_behaves_like 'rate-limited token-authenticated requests' end @@ -295,54 +299,54 @@ describe 'Rack Attack global throttles' do it 'rejects requests over the rate limit' do # At first, allow requests under the rate limit. requests_per_period.times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end # the last straw - expect_rejection { get '/dashboard/snippets' } + expect_rejection { get url_that_requires_authentication } end it 'allows requests after throttling and then waiting for the next period' do requests_per_period.times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end - expect_rejection { get '/dashboard/snippets' } + expect_rejection { get url_that_requires_authentication } Timecop.travel((1.second + period).from_now) do # Add 1 because flaky requests_per_period.times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end - expect_rejection { get '/dashboard/snippets' } + expect_rejection { get url_that_requires_authentication } end end it 'counts requests from different users separately, even from the same IP' do requests_per_period.times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end # would be over the limit if this wasn't a different user login_as(create(:user)) - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end it 'counts all requests from the same user, even via different IPs' do requests_per_period.times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end expect_any_instance_of(Rack::Attack::Request).to receive(:ip).and_return('1.2.3.4') - expect_rejection { get '/dashboard/snippets' } + expect_rejection { get url_that_requires_authentication } end end @@ -354,13 +358,21 @@ describe 'Rack Attack global throttles' do it 'allows requests over the rate limit' do (1 + requests_per_period).times do - get '/dashboard/snippets' + get url_that_requires_authentication expect(response).to have_http_status 200 end end end end + def api_get_args_with_token_headers(partial_url, token_headers) + ["/api/#{API::API.version}#{partial_url}", nil, token_headers] + end + + def rss_url(user) + "/dashboard/projects.atom?rss_token=#{user.rss_token}" + end + def private_token_headers(user) { 'HTTP_PRIVATE_TOKEN' => user.private_token } end |