mars3142
1339157182
Redis-backed when REDIS_URL is set, in-memory otherwise - the counter store needs to be shared once findr-api runs as more than one replica behind Traefik, or each instance would count its own share and the real allowed rate would silently multiply by the replica count. One findr-api instance (the default today) just uses the in-memory store. /healthz is exempt so the container healthcheck never trips it. The allowlist matcher is pulled into its own pure function (lib/rate-limit- allowlist.ts) and unit tested - @fastify/rate-limit's allowList option has two shapes (string[] matches request.ip, a function matches whatever you check) and passing paths as the array form silently allows nothing, which is exactly what a manual smoke test caught before this got committed. Signed-off-by: Peter Siegmund <mars3142@noreply.mars3142.dev>
18 lines
618 B
TypeScript
18 lines
618 B
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { isAllowlistedPath } from "../src/lib/rate-limit-allowlist.js";
|
|
|
|
describe("isAllowlistedPath", () => {
|
|
it("exempts the container healthcheck", () => {
|
|
expect(isAllowlistedPath({ url: "/healthz" })).toBe(true);
|
|
});
|
|
|
|
it("does not exempt ordinary API routes", () => {
|
|
expect(isAllowlistedPath({ url: "/v1/parts" })).toBe(false);
|
|
expect(isAllowlistedPath({ url: "/v1/tokens" })).toBe(false);
|
|
});
|
|
|
|
it("does not exempt a healthz-prefixed but different path", () => {
|
|
expect(isAllowlistedPath({ url: "/healthz/extra" })).toBe(false);
|
|
});
|
|
});
|