runegate 0.4.0

Lightweight Rust-based identity proxy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

// SPDX-License-Identifier: Apache-2.0
use runegate::rate_limit::{EmailRateLimiter, LoginRateLimiter, RateLimitConfig, TokenRateLimiter};
use std::thread;
use std::time::Duration;

#[test]
fn test_email_rate_limiter() {
    // Create a test config
    let config = RateLimitConfig {
        login_rate_limit: 5,
        email_cooldown: 2, // short cooldown for testing (2 seconds)
        token_rate_limit: 10,
        enabled: true,
    };

    let email_limiter = EmailRateLimiter::new(&config);
    let test_email = "test@example.com";

    // First request should be allowed
    assert!(email_limiter.check_email(test_email).is_none());

    // Second immediate request should be rate limited
    let cooldown = email_limiter.check_email(test_email);
    assert!(cooldown.is_some());
    assert!(cooldown.unwrap() > 0);

    // Wait for cooldown to expire
    thread::sleep(Duration::from_secs(3));

    // Should be allowed again
    assert!(email_limiter.check_email(test_email).is_none());
}

#[test]
fn test_login_rate_limiter() {
    // Create a test config
    let config = RateLimitConfig {
        login_rate_limit: 3, // only allow 3 attempts
        email_cooldown: 300,
        token_rate_limit: 10,
        enabled: true,
    };

    let login_limiter = LoginRateLimiter::new(&config);
    let test_ip = "192.168.1.1";

    // First three attempts should be allowed
    assert!(login_limiter.check_ip(test_ip));
    assert!(login_limiter.check_ip(test_ip));
    assert!(login_limiter.check_ip(test_ip));

    // Fourth attempt should be blocked
    assert!(!login_limiter.check_ip(test_ip));

    // Different IP should still be allowed
    assert!(login_limiter.check_ip("192.168.1.2"));

    // Check that disabling works
    let disabled_config = RateLimitConfig {
        enabled: false,
        ..config
    };
    let disabled_limiter = LoginRateLimiter::new(&disabled_config);

    // Even excessive attempts should be allowed when disabled
    for _ in 0..10 {
        assert!(disabled_limiter.check_ip(test_ip));
    }
}

#[test]
fn test_token_rate_limiter() {
    // Create a test config
    let config = RateLimitConfig {
        login_rate_limit: 5,
        email_cooldown: 300,
        token_rate_limit: 4, // only allow 4 attempts
        enabled: true,
    };

    let token_limiter = TokenRateLimiter::new(&config);
    let test_ip = "192.168.1.1";

    // First four attempts should be allowed
    assert!(token_limiter.check_ip(test_ip));
    assert!(token_limiter.check_ip(test_ip));
    assert!(token_limiter.check_ip(test_ip));
    assert!(token_limiter.check_ip(test_ip));

    // Fifth attempt should be blocked
    assert!(!token_limiter.check_ip(test_ip));
}