cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add tests for API change rate limits

Browse source
This commit is contained in:
Tom Hughes 2023-10-29 19:21:23 +00:00
parent ba503e02d2
commit 7e974b8662
4 changed files with 402 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

101
test/controllers/api/changesets_controller_test.rb
View file

@ -1606,6 +1606,107 @@ module Api
assert_equal "Precondition failed: Node #{node.id} is still used by ways #{way.id}.", @response.body
end
##
# test initial rate limit
def test_upload_initial_rate_limit
# create a user
user = create(:user)
# create some objects to use
node = create(:node)
way = create(:way_with_nodes, :nodes_count => 2)
relation = create(:relation)
# create a changeset that puts us near the initial rate limit
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => Settings.initial_changes_per_hour - 2)
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# simple diff to create a node way and relation using placeholders
diff = <<~CHANGESET
<osmChange>
<create>
<node id='-1' lon='0' lat='0' changeset='#{changeset.id}'>
<tag k='foo' v='bar'/>
<tag k='baz' v='bat'/>
</node>
<way id='-1' changeset='#{changeset.id}'>
<nd ref='#{node.id}'/>
</way>
</create>
<create>
<relation id='-1' changeset='#{changeset.id}'>
<member type='way' role='some' ref='#{way.id}'/>
<member type='node' role='some' ref='#{node.id}'/>
<member type='relation' role='some' ref='#{relation.id}'/>
</relation>
</create>
</osmChange>
CHANGESET
# upload it
post changeset_upload_path(changeset), :params => diff, :headers => auth_header
assert_response :too_many_requests, "upload did not hit rate limit"
end
##
# test maximum rate limit
def test_upload_maximum_rate_limit
# create a user
user = create(:user)
# create some objects to use
node = create(:node)
way = create(:way_with_nodes, :nodes_count => 2)
relation = create(:relation)
# create a changeset to establish our initial edit time
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 28.days)
# create changeset to put us near the maximum rate limit
total_changes = Settings.max_changes_per_hour - 2
while total_changes.positive?
changes = [total_changes, Changeset::MAX_ELEMENTS].min
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => changes)
total_changes -= changes
end
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# simple diff to create a node way and relation using placeholders
diff = <<~CHANGESET
<osmChange>
<create>
<node id='-1' lon='0' lat='0' changeset='#{changeset.id}'>
<tag k='foo' v='bar'/>
<tag k='baz' v='bat'/>
</node>
<way id='-1' changeset='#{changeset.id}'>
<nd ref='#{node.id}'/>
</way>
</create>
<create>
<relation id='-1' changeset='#{changeset.id}'>
<member type='way' role='some' ref='#{way.id}'/>
<member type='node' role='some' ref='#{node.id}'/>
<member type='relation' role='some' ref='#{relation.id}'/>
</relation>
</create>
</osmChange>
CHANGESET
# upload it
post changeset_upload_path(changeset), :params => diff, :headers => auth_header
assert_response :too_many_requests, "upload did not hit rate limit"
end
##
# when we make some simple changes we get the same changes back from the
# diff download.

85
test/controllers/api/nodes_controller_test.rb
View file

@ -558,6 +558,91 @@ module Api
assert_includes apinode.tags, "\#{@user.inspect}"
end
##
# test initial rate limit
def test_initial_rate_limit
# create a user
user = create(:user)
# create a changeset that puts us near the initial rate limit
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => Settings.initial_changes_per_hour - 1)
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a node
xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'/></osm>"
put node_create_path, :params => xml, :headers => auth_header
assert_response :success, "node create did not return success status"
# get the id of the node we created
nodeid = @response.body
# try updating the node, which should be rate limited
xml = "<osm><node id='#{nodeid}' version='1' lat='1' lon='1' changeset='#{changeset.id}'/></osm>"
put api_node_path(nodeid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "node update did not hit rate limit"
# try deleting the node, which should be rate limited
xml = "<osm><node id='#{nodeid}' version='2' lat='1' lon='1' changeset='#{changeset.id}'/></osm>"
delete api_node_path(nodeid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "node delete did not hit rate limit"
# try creating a node, which should be rate limited
xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'/></osm>"
put node_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "node create did not hit rate limit"
end
##
# test maximum rate limit
def test_maximum_rate_limit
# create a user
user = create(:user)
# create a changeset to establish our initial edit time
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 28.days)
# create changeset to put us near the maximum rate limit
total_changes = Settings.max_changes_per_hour - 1
while total_changes.positive?
changes = [total_changes, Changeset::MAX_ELEMENTS].min
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => changes)
total_changes -= changes
end
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a node
xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'/></osm>"
put node_create_path, :params => xml, :headers => auth_header
assert_response :success, "node create did not return success status"
# get the id of the node we created
nodeid = @response.body
# try updating the node, which should be rate limited
xml = "<osm><node id='#{nodeid}' version='1' lat='1' lon='1' changeset='#{changeset.id}'/></osm>"
put api_node_path(nodeid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "node update did not hit rate limit"
# try deleting the node, which should be rate limited
xml = "<osm><node id='#{nodeid}' version='2' lat='1' lon='1' changeset='#{changeset.id}'/></osm>"
delete api_node_path(nodeid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "node delete did not hit rate limit"
# try creating a node, which should be rate limited
xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'/></osm>"
put node_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "node create did not hit rate limit"
end
private
##

111
test/controllers/api/relations_controller_test.rb
View file

@ -906,6 +906,117 @@ module Api
end
end
##
# test initial rate limit
def test_initial_rate_limit
# create a user
user = create(:user)
# create some nodes
node1 = create(:node)
node2 = create(:node)
# create a changeset that puts us near the initial rate limit
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => Settings.initial_changes_per_hour - 1)
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a relation
xml = "<osm><relation changeset='#{changeset.id}'>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put relation_create_path, :params => xml, :headers => auth_header
assert_response :success, "relation create did not return success status"
# get the id of the relation we created
relationid = @response.body
# try updating the relation, which should be rate limited
xml = "<osm><relation id='#{relationid}' version='1' changeset='#{changeset.id}'>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put api_relation_path(relationid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation update did not hit rate limit"
# try deleting the relation, which should be rate limited
xml = "<osm><relation id='#{relationid}' version='2' changeset='#{changeset.id}'/></osm>"
delete api_relation_path(relationid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation delete did not hit rate limit"
# try creating a relation, which should be rate limited
xml = "<osm><relation changeset='#{changeset.id}'>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put relation_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation create did not hit rate limit"
end
##
# test maximum rate limit
def test_maximum_rate_limit
# create a user
user = create(:user)
# create some nodes
node1 = create(:node)
node2 = create(:node)
# create a changeset to establish our initial edit time
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 28.days)
# create changeset to put us near the maximum rate limit
total_changes = Settings.max_changes_per_hour - 1
while total_changes.positive?
changes = [total_changes, Changeset::MAX_ELEMENTS].min
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => changes)
total_changes -= changes
end
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a relation
xml = "<osm><relation changeset='#{changeset.id}'>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put relation_create_path, :params => xml, :headers => auth_header
assert_response :success, "relation create did not return success status"
# get the id of the relation we created
relationid = @response.body
# try updating the relation, which should be rate limited
xml = "<osm><relation id='#{relationid}' version='1' changeset='#{changeset.id}'>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put api_relation_path(relationid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation update did not hit rate limit"
# try deleting the relation, which should be rate limited
xml = "<osm><relation id='#{relationid}' version='2' changeset='#{changeset.id}'/></osm>"
delete api_relation_path(relationid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation delete did not hit rate limit"
# try creating a relation, which should be rate limited
xml = "<osm><relation changeset='#{changeset.id}'>" \
"<member ref='#{node1.id}' type='node' role='some'/>" \
"<member ref='#{node2.id}' type='node' role='some'/>" \
"<tag k='test' v='yes' /></relation></osm>"
put relation_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "relation create did not hit rate limit"
end
private
def check_relations_for_element(path, type, id, expected_relations)

105
test/controllers/api/ways_controller_test.rb
View file

@ -753,6 +753,111 @@ module Api
end
end
##
# test initial rate limit
def test_initial_rate_limit
# create a user
user = create(:user)
# create some nodes
node1 = create(:node)
node2 = create(:node)
# create a changeset that puts us near the initial rate limit
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => Settings.initial_changes_per_hour - 1)
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a way
xml = "<osm><way changeset='#{changeset.id}'>" \
"<nd ref='#{node1.id}'/><nd ref='#{node2.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put way_create_path, :params => xml, :headers => auth_header
assert_response :success, "way create did not return success status"
# get the id of the way we created
wayid = @response.body
# try updating the way, which should be rate limited
xml = "<osm><way id='#{wayid}' version='1' changeset='#{changeset.id}'>" \
"<nd ref='#{node2.id}'/><nd ref='#{node1.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put api_way_path(wayid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "way update did not hit rate limit"
# try deleting the way, which should be rate limited
xml = "<osm><way id='#{wayid}' version='2' changeset='#{changeset.id}'/></osm>"
delete api_way_path(wayid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "way delete did not hit rate limit"
# try creating a way, which should be rate limited
xml = "<osm><way changeset='#{changeset.id}'>" \
"<nd ref='#{node1.id}'/><nd ref='#{node2.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put way_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "way create did not hit rate limit"
end
##
# test maximum rate limit
def test_maximum_rate_limit
# create a user
user = create(:user)
# create some nodes
node1 = create(:node)
node2 = create(:node)
# create a changeset to establish our initial edit time
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 28.days)
# create changeset to put us near the maximum rate limit
total_changes = Settings.max_changes_per_hour - 1
while total_changes.positive?
changes = [total_changes, Changeset::MAX_ELEMENTS].min
changeset = create(:changeset, :user => user,
:created_at => Time.now.utc - 5.minutes,
:num_changes => changes)
total_changes -= changes
end
# create authentication header
auth_header = basic_authorization_header user.email, "test"
# try creating a way
xml = "<osm><way changeset='#{changeset.id}'>" \
"<nd ref='#{node1.id}'/><nd ref='#{node2.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put way_create_path, :params => xml, :headers => auth_header
assert_response :success, "way create did not return success status"
# get the id of the way we created
wayid = @response.body
# try updating the way, which should be rate limited
xml = "<osm><way id='#{wayid}' version='1' changeset='#{changeset.id}'>" \
"<nd ref='#{node2.id}'/><nd ref='#{node1.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put api_way_path(wayid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "way update did not hit rate limit"
# try deleting the way, which should be rate limited
xml = "<osm><way id='#{wayid}' version='2' changeset='#{changeset.id}'/></osm>"
delete api_way_path(wayid), :params => xml, :headers => auth_header
assert_response :too_many_requests, "way delete did not hit rate limit"
# try creating a way, which should be rate limited
xml = "<osm><way changeset='#{changeset.id}'>" \
"<nd ref='#{node1.id}'/><nd ref='#{node2.id}'/>" \
"<tag k='test' v='yes' /></way></osm>"
put way_create_path, :params => xml, :headers => auth_header
assert_response :too_many_requests, "way create did not hit rate limit"
end
private
##