MichilisandClaude Fable 5
e38d14970d
- Locks no longer fail open: an unreachable backend throws LockUnavailableError and withLock skips the run (or opts into running unlocked, as template seeding does). The lnbits payment poller keeps polling through an outage, made safe by only sending confirmation emails when a row actually transitioned. - Rate limiter INCR+PEXPIRE now runs as one Lua script, self-healing counters stranded without a TTL. - Per-email login lockout moves to a Redis-backed store shared across replicas (in-memory fallback preserved), case-insensitive on email. - Graceful shutdown on SIGTERM/SIGINT: stop periodic jobs, close the server, force-close lingering SSE sockets, close Redis. - Active PING probe backs the health flag; /health reports last ping. SSE payment streams also poll the DB as a pub/sub-gap fallback. - Scale compose gains requirepass, maxmemory 256mb with noeviction, and an authenticated healthcheck; .env.example documents passwords, TLS (rediss://), and DB-index selection. - First tests in the repo: vitest + ioredis-mock covering the lock, rate limiter, and login lockout stores (27 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
85 lines
3.0 KiB
TypeScript
85 lines
3.0 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
|
import RedisMock from 'ioredis-mock';
|
|
|
|
const mocks = vi.hoisted(() => ({ redis: null as any }));
|
|
|
|
vi.mock('../redis.js', () => ({
|
|
isRedisEnabled: () => true,
|
|
getRedis: () => mocks.redis,
|
|
}));
|
|
|
|
import { MemoryRateLimiter, RedisRateLimiter } from './rateLimiter.js';
|
|
|
|
describe('MemoryRateLimiter', () => {
|
|
it('allows up to max within the window, then blocks with retryAfter', async () => {
|
|
const limiter = new MemoryRateLimiter();
|
|
for (let i = 0; i < 3; i++) {
|
|
expect((await limiter.consume('k', 3, 60_000)).allowed).toBe(true);
|
|
}
|
|
const blocked = await limiter.consume('k', 3, 60_000);
|
|
expect(blocked.allowed).toBe(false);
|
|
expect(blocked.retryAfter).toBeGreaterThan(0);
|
|
expect(blocked.retryAfter).toBeLessThanOrEqual(60);
|
|
});
|
|
|
|
it('resets after the window elapses', async () => {
|
|
vi.useFakeTimers();
|
|
try {
|
|
const limiter = new MemoryRateLimiter();
|
|
expect((await limiter.consume('k', 1, 1_000)).allowed).toBe(true);
|
|
expect((await limiter.consume('k', 1, 1_000)).allowed).toBe(false);
|
|
vi.advanceTimersByTime(1_500);
|
|
expect((await limiter.consume('k', 1, 1_000)).allowed).toBe(true);
|
|
} finally {
|
|
vi.useRealTimers();
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('RedisRateLimiter', () => {
|
|
beforeEach(async () => {
|
|
mocks.redis = new RedisMock();
|
|
// ioredis-mock shares data between instances by connection string.
|
|
await mocks.redis.flushall();
|
|
});
|
|
|
|
it('sets the window TTL atomically on the first hit', async () => {
|
|
const limiter = new RedisRateLimiter();
|
|
expect((await limiter.consume('k', 5, 60_000)).allowed).toBe(true);
|
|
const ttl = await mocks.redis.pttl('rl:k');
|
|
expect(ttl).toBeGreaterThan(0);
|
|
expect(ttl).toBeLessThanOrEqual(60_000);
|
|
});
|
|
|
|
it('blocks over the limit with a sane retryAfter', async () => {
|
|
const limiter = new RedisRateLimiter();
|
|
for (let i = 0; i < 2; i++) {
|
|
expect((await limiter.consume('k', 2, 60_000)).allowed).toBe(true);
|
|
}
|
|
const blocked = await limiter.consume('k', 2, 60_000);
|
|
expect(blocked.allowed).toBe(false);
|
|
expect(blocked.retryAfter).toBeGreaterThan(0);
|
|
expect(blocked.retryAfter).toBeLessThanOrEqual(60);
|
|
});
|
|
|
|
it('self-heals a counter stranded without a TTL', async () => {
|
|
await mocks.redis.set('rl:k', '3');
|
|
expect(await mocks.redis.pttl('rl:k')).toBeLessThan(0);
|
|
const limiter = new RedisRateLimiter();
|
|
await limiter.consume('k', 10, 60_000);
|
|
expect(await mocks.redis.pttl('rl:k')).toBeGreaterThan(0);
|
|
});
|
|
|
|
it('fails open when the backend errors', async () => {
|
|
mocks.redis = { rlConsume: () => Promise.reject(new Error('connection refused')) };
|
|
const limiter = new RedisRateLimiter();
|
|
expect((await limiter.consume('k', 1, 60_000)).allowed).toBe(true);
|
|
});
|
|
|
|
it('fails open when the client is not initialized', async () => {
|
|
mocks.redis = null;
|
|
const limiter = new RedisRateLimiter();
|
|
expect((await limiter.consume('k', 1, 60_000)).allowed).toBe(true);
|
|
});
|
|
});
|