4cb747fdb6
Test helpers are separated between two files: spec_helper and rails_helper. This separation is meant to allow tests that do not require Rails (like testing standalone libs) to boot faster. The spec_helper file is always loaded, through `--require spec_helper` in the `.rspec` config file. When needed, the rails_helper file is expected to be required manually. This is fine, but: - Many test files have a redundant `require 'spec_helper'` line; - Many test files should require `rails_helper`, but don't. Not requiring `rails_helper` will cause the Rails-concerned section of the test environment not to be configured–which may cause subtle bugs (like the test database not being properly initialized). Moreover, Spring loads all the Rails files on preloading anyway. So the gains from using only `spec_helper` are thin. To streamline this process, this commit: - Configures `.rspec` to require `rails_helper` by default; - Remove all manual requires to spec_helper or rails_helper. Reference: https://stackoverflow.com/questions/24145329/how-is-spec-rails-helper-rb-different-from-spec-spec-helper-rb-do-i-need-it
54 lines
1.2 KiB
Ruby
54 lines
1.2 KiB
Ruby
describe Rack::Attack, type: :request do
|
|
let(:limit) { 5 }
|
|
let(:period) { 20 }
|
|
let(:ip) { "1.2.3.4" }
|
|
|
|
before(:each) do
|
|
ENV['RACK_ATTACK_ENABLE'] = 'true'
|
|
setup_rack_attack_cache_store
|
|
avoid_test_overlaps_in_cache
|
|
end
|
|
|
|
after do
|
|
ENV['RACK_ATTACK_ENABLE'] = 'false'
|
|
end
|
|
|
|
def setup_rack_attack_cache_store
|
|
Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
|
|
end
|
|
|
|
def avoid_test_overlaps_in_cache
|
|
Rails.cache.clear
|
|
end
|
|
|
|
context '/users/sign_in' do
|
|
before do
|
|
limit.times do
|
|
Rack::Attack.cache.count("/users/sign_in/ip:#{ip}", period)
|
|
end
|
|
end
|
|
|
|
subject do
|
|
post "/users/sign_in", headers: { 'X-Forwarded-For': ip }
|
|
end
|
|
|
|
it "throttle excessive requests by IP address" do
|
|
subject
|
|
|
|
expect(response).to have_http_status(:too_many_requests)
|
|
end
|
|
|
|
context 'when the ip is whitelisted' do
|
|
before do
|
|
allow(IPService).to receive(:ip_trusted?).and_return(true)
|
|
allow_any_instance_of(Users::SessionsController).to receive(:create).and_return(:ok)
|
|
end
|
|
|
|
it "respects the whitelist" do
|
|
subject
|
|
|
|
expect(response).not_to have_http_status(:too_many_requests)
|
|
end
|
|
end
|
|
end
|
|
end
|