javier
cdded06ba3
This PR contains the work done to rename the _Web_ package as _Infrastructure_, to provide a clear naming and purpose to this particular package within the project. To provide further details about the work: * Infrastructure * Asset fingerprinting: an FNV-1a token derived from the static files directory, appended as ?v= to asset URLs so deploys bust caches; pre-rendered pages also revalidate via weak ETags. * New middlewares: fixed-window RateLimitMiddleware (per-client budgets keyed by trusted X-Forwarded-For or remote address) and VaryMiddleware (Accept-Encoding on every response); SecurityHeadersMiddleware now also stamps error responses. * Auto-generated HEAD endpoints, cache max-age configuration, and Docker build/Compose refinements. * Protocols and scaffolding: Asset/AssetExtension, the Page protocol (viewport, stylesheets, scripts, versioned URLs), and LocalizedRequestContext. * Rate limiter's counter store swapped from an actor to a Mutex (no executor hop per request) with amortized batch eviction instead of O(n²) scans under client floods. * FingerprintAssets reports unreadable files to a logger instead of silently producing a token that never busts their cache. Reviewed-on: rock-n-code/loud-amsterdam#25 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
171 lines
4.9 KiB
Swift
171 lines
4.9 KiB
Swift
import Hummingbird
|
|
import HummingbirdTesting
|
|
import Testing
|
|
|
|
@testable import Infrastructure
|
|
|
|
@Suite("RateLimitMiddleware middleware", .tags(.middleware))
|
|
struct RateLimitMiddlewareTests {
|
|
|
|
// MARK: Functional tests
|
|
|
|
@Test
|
|
func `admits requests within the limit`() async throws {
|
|
try await app(
|
|
configuration: .init(limit: 3)
|
|
).test(.router) { client in
|
|
for _ in 1 ... 3 {
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
@Test
|
|
func `rejects a request over the limit with a retry-after header`() async throws {
|
|
try await app(
|
|
configuration: .init(limit: 2)
|
|
).test(.router) { client in
|
|
for _ in 1 ... 2 {
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
}
|
|
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .tooManyRequests)
|
|
|
|
let retryAfter = try #require(response.headers[.retryAfter])
|
|
|
|
#expect(try #require(Int(retryAfter)) >= 1)
|
|
}
|
|
}
|
|
}
|
|
|
|
@Test
|
|
func `admits requests again once the window resets`() async throws {
|
|
try await app(
|
|
configuration: .init(
|
|
limit: 1,
|
|
window: .milliseconds(50)
|
|
)
|
|
).test(.router) { client in
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .tooManyRequests)
|
|
}
|
|
|
|
try await Task.sleep(for: .milliseconds(100))
|
|
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
}
|
|
}
|
|
|
|
@Test
|
|
func `separates clients by their forwarded address when trusted`() async throws {
|
|
try await app(
|
|
configuration: .init(
|
|
limit: 1,
|
|
trustForwardedFor: true
|
|
)
|
|
).test(.router) { client in
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get,
|
|
headers: [.xForwardedFor: "203.0.113.7"]
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get,
|
|
headers: [.xForwardedFor: "203.0.113.8"]
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
// The first entry names the client; the appended proxy hop must not change its key.
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get,
|
|
headers: [.xForwardedFor: "203.0.113.7, 10.0.0.1"]
|
|
) { response in
|
|
#expect(response.status == .tooManyRequests)
|
|
}
|
|
}
|
|
}
|
|
|
|
@Test
|
|
func `ignores the forwarded address when not trusted`() async throws {
|
|
try await app(
|
|
configuration: .init(limit: 1)
|
|
).test(.router) { client in
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get,
|
|
headers: [.xForwardedFor: "203.0.113.7"]
|
|
) { response in
|
|
#expect(response.status == .ok)
|
|
}
|
|
// Without trust (and without a connection address in router-only testing), every client
|
|
// shares one bucket, so a rotated header must not mint a fresh budget.
|
|
try await client.execute(
|
|
uri: "/hello",
|
|
method: .get,
|
|
headers: [.xForwardedFor: "203.0.113.8"]
|
|
) { response in
|
|
#expect(response.status == .tooManyRequests)
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
// MARK: - Helpers
|
|
|
|
private extension RateLimitMiddlewareTests {
|
|
|
|
// MARK: Methods
|
|
|
|
/// Builds an application whose router applies the rate-limit middleware ahead of a single
|
|
/// `/hello` route returning a plain body.
|
|
func app(
|
|
configuration: RateLimitMiddleware<BasicRequestContext>.Configuration
|
|
) -> some ApplicationProtocol {
|
|
let router = Router()
|
|
|
|
router.addMiddleware {
|
|
RateLimitMiddleware(configuration: configuration)
|
|
}
|
|
|
|
router.get("hello") { _, _ in
|
|
"Hello!"
|
|
}
|
|
|
|
return Application(router: router)
|
|
}
|
|
|
|
}
|