a620906209
0dabc4ebb5
commit 2a0e9255（P2 帳號鎖定上線）已將 member/provider 登入的 IP throttle 從 5,1 調整為 10,1（避免 IP throttle 搶在帳號鎖定的 423 之前觸發 429）， 但測試的迴圈次數與註解仍停留在舊版 5,1，導致預期 429 卻收到 401。 同步將迴圈次數改為 10、區塊註解改為 throttle:10,1，使其對齊現行設定。 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
102 lines
3.1 KiB
PHP
102 lines
3.1 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Tests\TestCase;
|
|
|
|
class AuthRateLimitTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
Cache::flush();
|
|
}
|
|
|
|
// ── member (throttle:10,1) ───────────────────────────────
|
|
|
|
public function test_member_login_within_limit_is_not_throttled(): void
|
|
{
|
|
for ($i = 0; $i < 10; $i++) {
|
|
$response = $this->postJson('/api/member/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
$this->assertNotEquals(429, $response->status());
|
|
}
|
|
}
|
|
|
|
public function test_member_login_exceeds_limit_returns_429(): void
|
|
{
|
|
for ($i = 0; $i < 10; $i++) {
|
|
$this->postJson('/api/member/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
}
|
|
|
|
$response = $this->postJson('/api/member/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
|
|
$response->assertStatus(429);
|
|
$this->assertTrue($response->headers->has('Retry-After'));
|
|
}
|
|
|
|
// ── provider (throttle:10,1) ─────────────────────────────
|
|
|
|
public function test_provider_login_exceeds_limit_returns_429(): void
|
|
{
|
|
for ($i = 0; $i < 10; $i++) {
|
|
$this->postJson('/api/provider/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
}
|
|
|
|
$response = $this->postJson('/api/provider/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
|
|
$response->assertStatus(429);
|
|
$this->assertTrue($response->headers->has('Retry-After'));
|
|
}
|
|
|
|
// ── admin (throttle:3,1) ─────────────────────────────────
|
|
|
|
public function test_admin_login_within_limit_is_not_throttled(): void
|
|
{
|
|
for ($i = 0; $i < 3; $i++) {
|
|
$response = $this->postJson('/api/admin/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
$this->assertNotEquals(429, $response->status());
|
|
}
|
|
}
|
|
|
|
public function test_admin_login_exceeds_stricter_limit_returns_429(): void
|
|
{
|
|
for ($i = 0; $i < 3; $i++) {
|
|
$this->postJson('/api/admin/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
}
|
|
|
|
$response = $this->postJson('/api/admin/login', [
|
|
'email' => 'notexist@example.com',
|
|
'password' => 'wrong',
|
|
]);
|
|
|
|
$response->assertStatus(429);
|
|
$this->assertTrue($response->headers->has('Retry-After'));
|
|
}
|
|
}
|