Rogeeandrogee
2b182f9956
* H-300: wire Captain Skills into Web runtime * H-300: enforce effective model and conservative skill budget * H-300: fix CI gosec step * ci: extend golangci-lint timeout * fix lint findings across backend * fix(push): resolve delivery protocol blockers * test(repository): close SQLite test databases * test(repository): reuse SQLite schema per package * H-307: restore backend Go cache in CI * H-307: prefetch modules before cold lint * H-307: resolve govulncheck security gate * H-307: build lint with patched Go toolchain * H-307: clear remaining security scan findings --------- Co-authored-by: Rogee <rogee@ipao.vip>
976 lines
28 KiB
Go
976 lines
28 KiB
Go
package middleware
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"net/http"
|
||
"net/http/httptest"
|
||
"testing"
|
||
"time"
|
||
|
||
"github.com/alicebob/miniredis/v2"
|
||
"github.com/gin-gonic/gin"
|
||
"github.com/redis/go-redis/v9"
|
||
"github.com/stretchr/testify/assert"
|
||
"github.com/stretchr/testify/require"
|
||
|
||
"github.com/gochat/gochat/pkg/logger"
|
||
"github.com/gochat/gochat/pkg/response"
|
||
)
|
||
|
||
// 初始化logger，避免测试中logger为nil导致panic
|
||
func init() {
|
||
_ = logger.Init(logger.Config{Level: "warn", Format: "json"})
|
||
}
|
||
|
||
// ============================================================================
|
||
// newInMemoryLimiter 测试
|
||
// ============================================================================
|
||
|
||
func TestNewInMemoryLimiter(t *testing.T) {
|
||
im := newInMemoryLimiter(10, time.Minute)
|
||
assert.NotNil(t, im)
|
||
assert.Equal(t, 10, im.limit)
|
||
assert.Equal(t, time.Minute, im.window)
|
||
assert.NotNil(t, im.visitors)
|
||
}
|
||
|
||
func TestNewInMemoryLimiter_ZeroValues(t *testing.T) {
|
||
// 限流器应正常创建，即使limit/window为0（由调用方保证有效值）
|
||
im := newInMemoryLimiter(0, 0)
|
||
assert.NotNil(t, im)
|
||
assert.Equal(t, 0, im.limit)
|
||
}
|
||
|
||
// ============================================================================
|
||
// checkInMemory 测试
|
||
// ============================================================================
|
||
|
||
func TestCheckInMemory_NewKey(t *testing.T) {
|
||
// 新key首次请求应被允许，计数为1
|
||
im := newInMemoryLimiter(5, time.Minute)
|
||
|
||
allowed, count := im.checkInMemory("client1")
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, 1, count)
|
||
}
|
||
|
||
func TestCheckInMemory_WithinLimit(t *testing.T) {
|
||
// 在限流窗口内、不超过限额的连续请求
|
||
im := newInMemoryLimiter(5, time.Minute)
|
||
|
||
for i := 1; i <= 5; i++ {
|
||
allowed, count := im.checkInMemory("client1")
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, i, count)
|
||
}
|
||
}
|
||
|
||
func TestCheckInMemory_OverLimit(t *testing.T) {
|
||
// 超过限额后请求应被拒绝
|
||
im := newInMemoryLimiter(3, time.Minute)
|
||
|
||
// 前3次请求允许
|
||
for i := 1; i <= 3; i++ {
|
||
allowed, count := im.checkInMemory("client1")
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, i, count)
|
||
}
|
||
|
||
// 第4次请求应被拒绝
|
||
allowed, count := im.checkInMemory("client1")
|
||
assert.False(t, allowed)
|
||
assert.Equal(t, 4, count)
|
||
}
|
||
|
||
func TestCheckInMemory_DifferentKeys(t *testing.T) {
|
||
// 不同key应有独立的计数器
|
||
im := newInMemoryLimiter(3, time.Minute)
|
||
|
||
// client1耗尽限额
|
||
for i := 1; i <= 4; i++ {
|
||
im.checkInMemory("client1")
|
||
}
|
||
|
||
// client2首次请求应被允许
|
||
allowed, count := im.checkInMemory("client2")
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, 1, count)
|
||
}
|
||
|
||
func TestCheckInMemory_WindowExpiry(t *testing.T) {
|
||
// 窗口过期后计数应重置
|
||
im := newInMemoryLimiter(3, 100*time.Millisecond) // 使用短窗口便于测试
|
||
|
||
// 前几次请求耗尽限额
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1")
|
||
|
||
// 超限后被拒绝
|
||
allowed, _ := im.checkInMemory("client1")
|
||
assert.False(t, allowed)
|
||
|
||
// 等待窗口过期
|
||
time.Sleep(150 * time.Millisecond)
|
||
|
||
// 窗口过期后，应重新允许
|
||
allowed, count := im.checkInMemory("client1")
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, 1, count)
|
||
}
|
||
|
||
// ============================================================================
|
||
// remainingInMemory 测试
|
||
// ============================================================================
|
||
|
||
func TestRemainingInMemory_NewKey(t *testing.T) {
|
||
// 新key的剩余配额应等于总限额
|
||
im := newInMemoryLimiter(10, time.Minute)
|
||
|
||
remaining := im.remainingInMemory("new_client")
|
||
assert.Equal(t, 10, remaining)
|
||
}
|
||
|
||
func TestRemainingInMemory_AfterRequests(t *testing.T) {
|
||
// 每次请求后剩余配额应递减
|
||
im := newInMemoryLimiter(5, time.Minute)
|
||
|
||
im.checkInMemory("client1")
|
||
assert.Equal(t, 4, im.remainingInMemory("client1"))
|
||
|
||
im.checkInMemory("client1")
|
||
assert.Equal(t, 3, im.remainingInMemory("client1"))
|
||
}
|
||
|
||
func TestRemainingInMemory_Exhausted(t *testing.T) {
|
||
// 配额耗尽后剩余应为0
|
||
im := newInMemoryLimiter(2, time.Minute)
|
||
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1")
|
||
// 已经用了2次，remaining应为0
|
||
assert.Equal(t, 0, im.remainingInMemory("client1"))
|
||
}
|
||
|
||
func TestRemainingInMemory_OverExhausted(t *testing.T) {
|
||
// 超额使用后剩余不应为负数，应为0
|
||
im := newInMemoryLimiter(2, time.Minute)
|
||
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1") // 超限请求（被拒绝但计数仍增加）
|
||
assert.Equal(t, 0, im.remainingInMemory("client1"))
|
||
}
|
||
|
||
func TestRemainingInMemory_WindowExpiry(t *testing.T) {
|
||
// 窗口过期后剩余配额应恢复为总限额
|
||
im := newInMemoryLimiter(5, 100*time.Millisecond)
|
||
|
||
im.checkInMemory("client1")
|
||
im.checkInMemory("client1")
|
||
assert.Equal(t, 3, im.remainingInMemory("client1"))
|
||
|
||
// 等待窗口过期
|
||
time.Sleep(150 * time.Millisecond)
|
||
|
||
remaining := im.remainingInMemory("client1")
|
||
assert.Equal(t, 5, remaining)
|
||
}
|
||
|
||
// ============================================================================
|
||
// newSlidingWindowLimiter + checkRedis 测试（使用miniredis模拟Redis）
|
||
// ============================================================================
|
||
|
||
func setupMiniredis(t *testing.T) (*miniredis.Miniredis, *redis.Client) {
|
||
t.Helper()
|
||
mr := miniredis.RunT(t)
|
||
rdb := redis.NewClient(&redis.Options{
|
||
Addr: mr.Addr(),
|
||
})
|
||
return mr, rdb
|
||
}
|
||
|
||
func TestNewSlidingWindowLimiter_WithRedis(t *testing.T) {
|
||
// 有可用Redis时应标记Redis可用
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
assert.NotNil(t, sw)
|
||
assert.Equal(t, rdb, sw.redis)
|
||
assert.True(t, sw.redisAvailable.Load())
|
||
assert.NotNil(t, sw.fallback)
|
||
}
|
||
|
||
func TestNewSlidingWindowLimiter_NoRedis(t *testing.T) {
|
||
// 无Redis客户端时应标记Redis不可用
|
||
sw := newSlidingWindowLimiter(nil)
|
||
|
||
assert.NotNil(t, sw)
|
||
assert.Nil(t, sw.redis)
|
||
assert.False(t, sw.redisAvailable.Load())
|
||
}
|
||
|
||
func TestNewSlidingWindowLimiter_DefaultValues(t *testing.T) {
|
||
// 硬编码常量应为100次/60秒
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
assert.NotNil(t, sw)
|
||
// 检查fallback使用了硬编码默认值
|
||
assert.Equal(t, 100, sw.fallback.limit)
|
||
assert.Equal(t, 60*time.Second, sw.fallback.window)
|
||
}
|
||
|
||
func TestCheckRedis_FirstRequest(t *testing.T) {
|
||
// 首次Redis请求应被允许
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
allowed, count, remaining, err := sw.checkRedis(context.Background(), "global:127.0.0.1")
|
||
assert.NoError(t, err)
|
||
assert.True(t, allowed)
|
||
assert.True(t, count > 0)
|
||
assert.True(t, remaining >= 0)
|
||
}
|
||
|
||
func TestCheckRedis_WithinLimit(t *testing.T) {
|
||
// 在限额内的多次请求都应被允许
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb) // 100次/分钟（硬编码）
|
||
|
||
for i := 0; i < 100; i++ {
|
||
allowed, _, _, err := sw.checkRedis(context.Background(), "global:127.0.0.1")
|
||
assert.NoError(t, err)
|
||
assert.True(t, allowed, "第%d次请求应被允许", i+1)
|
||
}
|
||
}
|
||
|
||
func TestCheckRedis_OverLimit(t *testing.T) {
|
||
// 滑动窗口Lua脚本中：total >= limit时拒绝（不INCR，返回{total, 0}）
|
||
// 但Go端allowed判定为 totalCount <= limit，当total==limit时allowed仍为true
|
||
// 因此limit=100时，100次请求INCR后total=100，第101次请求total=100>=100被Lua拒绝（不INCR）
|
||
// 但Go端100<=100仍返回allowed=true，remaining=0
|
||
// 实际效果：请求通过但remaining=0标识配额耗尽
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
// 前100次请求允许，total逐步增加到100
|
||
for i := 0; i < 100; i++ {
|
||
allowed, _, _, err := sw.checkRedis(context.Background(), "global:127.0.0.1")
|
||
assert.NoError(t, err)
|
||
assert.True(t, allowed, "第%d次请求应被允许", i+1)
|
||
}
|
||
|
||
// 第101次请求：Lua脚本中total=100>=100拒绝（不INCR），Go端totalCount=100<=100返回allowed=true
|
||
// 但remaining=0标识配额已耗尽
|
||
allowed, totalCount, remaining, err := sw.checkRedis(context.Background(), "global:127.0.0.1")
|
||
assert.NoError(t, err)
|
||
// 注意：这是源码的现有行为，totalCount==limit时allowed仍为true
|
||
assert.True(t, allowed)
|
||
assert.Equal(t, 100, totalCount)
|
||
assert.Equal(t, 0, remaining)
|
||
}
|
||
|
||
func TestCheckRedis_DifferentKeys(t *testing.T) {
|
||
// 不同key应有独立的限流计数
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
// key1发送2次请求
|
||
_, _, _, err := sw.checkRedis(context.Background(), "global:client1")
|
||
require.NoError(t, err)
|
||
_, _, _, err = sw.checkRedis(context.Background(), "global:client1")
|
||
require.NoError(t, err)
|
||
|
||
// key2首次请求应被允许，remaining > 0
|
||
allowed, _, remaining, err := sw.checkRedis(context.Background(), "global:client2")
|
||
assert.NoError(t, err)
|
||
assert.True(t, allowed)
|
||
assert.True(t, remaining > 0)
|
||
}
|
||
|
||
func TestCheckRedis_RemainingDecrements(t *testing.T) {
|
||
// remaining应随请求递减
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
_, _, remaining, err := sw.checkRedis(context.Background(), "global:client1")
|
||
assert.NoError(t, err)
|
||
// 第一次请求后：new_total=1, remaining=100-1=99
|
||
assert.Equal(t, 99, remaining)
|
||
|
||
_, _, remaining, err = sw.checkRedis(context.Background(), "global:client1")
|
||
assert.NoError(t, err)
|
||
// 第二次请求后：new_total=2, remaining=100-2=98
|
||
assert.Equal(t, 98, remaining)
|
||
}
|
||
|
||
// ============================================================================
|
||
// check 测试（综合：Redis可用 / Redis不可用降级）
|
||
// ============================================================================
|
||
|
||
func TestCheck_RedisAvailable(t *testing.T) {
|
||
// Redis可用时应使用Redis限流，usedRedis=true
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
allowed, _, remaining, usedRedis := sw.check(context.Background(), "global:127.0.0.1")
|
||
assert.True(t, allowed)
|
||
assert.True(t, usedRedis)
|
||
assert.True(t, remaining >= 0)
|
||
}
|
||
|
||
func TestCheck_RedisUnavailable_Fallback(t *testing.T) {
|
||
// Redis不可用时应降级到内存限流，usedRedis=false
|
||
sw := newSlidingWindowLimiter(nil) // nil Redis
|
||
|
||
allowed, _, remaining, usedRedis := sw.check(context.Background(), "global:127.0.0.1")
|
||
assert.True(t, allowed)
|
||
assert.False(t, usedRedis)
|
||
assert.True(t, remaining >= 0)
|
||
}
|
||
|
||
func TestCheck_RedisError_Fallback(t *testing.T) {
|
||
// Redis连接出错时应降级到内存限流
|
||
mr, rdb := setupMiniredis(t)
|
||
sw := newSlidingWindowLimiter(rdb)
|
||
|
||
// 先确认Redis正常工作
|
||
allowed, _, _, usedRedis := sw.check(context.Background(), "global:127.0.0.1")
|
||
assert.True(t, allowed)
|
||
assert.True(t, usedRedis)
|
||
|
||
// 关闭miniredis模拟Redis故障
|
||
mr.Close()
|
||
|
||
// Redis不可用时应降级到内存限流
|
||
allowed, _, _, usedRedis = sw.check(context.Background(), "global:127.0.0.1")
|
||
assert.True(t, allowed) // 内存限流首次请求允许
|
||
assert.False(t, usedRedis)
|
||
}
|
||
|
||
func TestCheck_FallbackOverLimit(t *testing.T) {
|
||
// 内存降级限流器超限后也应拒绝请求
|
||
sw := newSlidingWindowLimiter(nil)
|
||
|
||
// 前100次请求允许
|
||
for i := 0; i < 100; i++ {
|
||
allowed, _, _, usedRedis := sw.check(context.Background(), "client1")
|
||
assert.True(t, allowed)
|
||
assert.False(t, usedRedis)
|
||
}
|
||
|
||
// 第101次请求应被拒绝
|
||
allowed, _, _, usedRedis := sw.check(context.Background(), "client1")
|
||
assert.False(t, allowed)
|
||
assert.False(t, usedRedis)
|
||
}
|
||
|
||
// ============================================================================
|
||
// RateLimit Gin中间件测试（使用httptest.NewRecorder）
|
||
// ============================================================================
|
||
|
||
func setupGin() {
|
||
gin.SetMode(gin.TestMode)
|
||
}
|
||
|
||
func makeRequestWithMiddleware(handler gin.HandlerFunc, path string) *httptest.ResponseRecorder {
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET(path, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", path, nil)
|
||
r.ServeHTTP(w, req)
|
||
return w
|
||
}
|
||
|
||
func TestRateLimit_FirstRequestAllowed(t *testing.T) {
|
||
// 首次请求应通过并设置限流响应头
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
handler := RateLimit(rdb)
|
||
w := makeRequestWithMiddleware(handler, "/test")
|
||
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
assert.NotEmpty(t, w.Header().Get("X-RateLimit-Limit"))
|
||
assert.NotEmpty(t, w.Header().Get("X-RateLimit-Remaining"))
|
||
// Redis可用时应标记backend为redis
|
||
assert.Equal(t, "redis", w.Header().Get("X-RateLimit-Backend"))
|
||
}
|
||
|
||
func TestRateLimit_MemoryFallback(t *testing.T) {
|
||
// Redis不可用时应降级到内存限流，backend标记为memory
|
||
handler := RateLimit(nil) // nil Redis → 内存降级
|
||
w := makeRequestWithMiddleware(handler, "/test")
|
||
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
assert.Equal(t, "memory", w.Header().Get("X-RateLimit-Backend"))
|
||
}
|
||
|
||
func TestRateLimit_OverLimit_RedisBackend(t *testing.T) {
|
||
// 使用Redis后端时，由于源码的checkRedis行为（total==limit时allowed仍为true），
|
||
// RateLimit中间件不会返回429，而是通过但remaining=0
|
||
// 这是源码的已知行为：滑动窗口算法在total==limit时不拒绝请求
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
handler := RateLimit(rdb)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 前100次请求通过
|
||
for i := 0; i < 100; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// 第101次请求：由于源码行为（total==limit时allowed仍为true），不会返回429
|
||
// 但remaining=0标识配额耗尽
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
// 注意：这是源码的现有行为，使用Redis后端时超限请求仍通过
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
assert.Equal(t, "0", w.Header().Get("X-RateLimit-Remaining"))
|
||
}
|
||
|
||
func TestRateLimit_OverLimit_MemoryBackend(t *testing.T) {
|
||
// 使用内存降级后端时，超限请求应返回429
|
||
// 内存限流器的checkInMemory在超限后正确返回allowed=false
|
||
handler := RateLimit(nil) // nil Redis → 内存降级
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 前100次请求通过
|
||
for i := 0; i < 100; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// 第101次请求应被拒绝（429）
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// 检查429响应体
|
||
var body response.APIResponse
|
||
err := json.Unmarshal(w.Body.Bytes(), &body)
|
||
assert.NoError(t, err)
|
||
assert.False(t, body.Success)
|
||
assert.NotNil(t, body.Error)
|
||
assert.Equal(t, response.ErrRateLimit, body.Error.Code)
|
||
|
||
// 应设置Retry-After头
|
||
assert.NotEmpty(t, w.Header().Get("Retry-After"))
|
||
}
|
||
|
||
func TestRateLimit_DifferentIPs(t *testing.T) {
|
||
// 不同IP应有独立的限流计数
|
||
// 使用内存降级后端以确保能正确拒绝超限请求
|
||
handler := RateLimit(nil) // 内存降级后端
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// IP1耗尽限额
|
||
for i := 0; i < 100; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// IP2首次请求应被允许
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.2:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestRateLimit_HeadersSet(t *testing.T) {
|
||
// 限流中间件应设置标准限流响应头
|
||
mr, rdb := setupMiniredis(t)
|
||
defer mr.Close()
|
||
|
||
handler := RateLimit(rdb)
|
||
w := makeRequestWithMiddleware(handler, "/test")
|
||
|
||
assert.Equal(t, "100", w.Header().Get("X-RateLimit-Limit"))
|
||
assert.NotEmpty(t, w.Header().Get("X-RateLimit-Remaining"))
|
||
}
|
||
|
||
// ============================================================================
|
||
// PerRouteLimit Gin中间件测试
|
||
// ============================================================================
|
||
|
||
func TestPerRouteLimit_FirstRequestAllowed(t *testing.T) {
|
||
// 首次请求应通过
|
||
handler := PerRouteLimit("test_route", 5)
|
||
w := makeRequestWithMiddleware(handler, "/test")
|
||
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestPerRouteLimit_WithinLimit(t *testing.T) {
|
||
// 在限额内的请求都应通过
|
||
handler := PerRouteLimit("test_route", 5)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
for i := 0; i < 5; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
}
|
||
|
||
func TestPerRouteLimit_OverLimit(t *testing.T) {
|
||
// 超限请求应返回429
|
||
handler := PerRouteLimit("test_route", 3)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 前3次请求允许
|
||
for i := 0; i < 3; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// 第4次请求应被拒绝
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// 检查响应体
|
||
var body response.APIResponse
|
||
err := json.Unmarshal(w.Body.Bytes(), &body)
|
||
assert.NoError(t, err)
|
||
assert.False(t, body.Success)
|
||
assert.Equal(t, response.ErrRateLimit, body.Error.Code)
|
||
assert.Contains(t, body.Error.Message, "test_route")
|
||
}
|
||
|
||
func TestPerRouteLimit_HeadersOnSubsequentRequests(t *testing.T) {
|
||
// PerRouteLimit在首次请求时不设置X-RateLimit头（新key直接c.Next()）
|
||
// 在后续请求中才设置headers（第2次及之后）
|
||
handler := PerRouteLimit("test_route", 10)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 第1次请求：新key，直接c.Next()，不设置headers
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
// 首次请求不设置限流头
|
||
assert.Empty(t, w.Header().Get("X-RateLimit-Limit"))
|
||
|
||
// 第2次请求：非新key，会设置headers
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
assert.Equal(t, "10", w.Header().Get("X-RateLimit-Limit"))
|
||
assert.Equal(t, "8", w.Header().Get("X-RateLimit-Remaining"))
|
||
}
|
||
|
||
func TestPerRouteLimit_OverLimitHeaders(t *testing.T) {
|
||
// 超限时应设置剩余为0和Retry-After头
|
||
handler := PerRouteLimit("test_route", 1)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 第1次请求通过
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
|
||
// 第2次请求被拒绝
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
assert.Equal(t, "1", w.Header().Get("X-RateLimit-Limit"))
|
||
assert.Equal(t, "0", w.Header().Get("X-RateLimit-Remaining"))
|
||
assert.Equal(t, "60", w.Header().Get("Retry-After"))
|
||
}
|
||
|
||
func TestPerRouteLimit_DifferentIPs(t *testing.T) {
|
||
// 不同IP对同一路由应有独立的限流计数
|
||
handler := PerRouteLimit("test_route", 2)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// IP1前2次请求通过
|
||
for i := 0; i < 2; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// IP1第3次请求被限流
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// IP2首次请求应被允许
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.2:5678"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestPerRouteLimit_DifferentRoutes(t *testing.T) {
|
||
// 不同路由应有独立的限流计数
|
||
handler1 := PerRouteLimit("route_a", 2)
|
||
handler2 := PerRouteLimit("route_b", 2)
|
||
|
||
setupGin()
|
||
r := gin.New()
|
||
r.GET("/a", handler1, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"route": "a"})
|
||
})
|
||
r.GET("/b", handler2, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"route": "b"})
|
||
})
|
||
|
||
// 路由a耗尽限额（使用相同IP）
|
||
for i := 0; i < 2; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/a", nil)
|
||
req.RemoteAddr = "10.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/a", nil)
|
||
req.RemoteAddr = "10.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// 路由b对同一IP应仍然允许
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/b", nil)
|
||
req.RemoteAddr = "10.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// ============================================================================
|
||
// PerUserLimit Gin中间件测试
|
||
// ============================================================================
|
||
|
||
func makeRequestWithUserContext(handler gin.HandlerFunc, path string, userID uint, remoteAddr string) *httptest.ResponseRecorder {
|
||
setupGin()
|
||
r := gin.New()
|
||
// 先设置user_id上下文
|
||
r.Use(func(c *gin.Context) {
|
||
c.Set("user_id", userID)
|
||
c.Next()
|
||
})
|
||
r.Use(handler)
|
||
r.GET(path, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", path, nil)
|
||
req.RemoteAddr = remoteAddr
|
||
r.ServeHTTP(w, req)
|
||
return w
|
||
}
|
||
|
||
func TestPerUserLimit_AuthenticatedUser(t *testing.T) {
|
||
// 认证用户首次请求应通过
|
||
handler := PerUserLimit("test_route", 5)
|
||
w := makeRequestWithUserContext(handler, "/test", uint(1001), "127.0.0.1:1234")
|
||
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestPerUserLimit_AuthenticatedWithinLimit(t *testing.T) {
|
||
// 认证用户在限额内的请求应通过
|
||
handler := PerUserLimit("test_route", 3)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(func(c *gin.Context) {
|
||
c.Set("user_id", uint(1001))
|
||
c.Next()
|
||
})
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
for i := 0; i < 3; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
}
|
||
|
||
func TestPerUserLimit_AuthenticatedOverLimit(t *testing.T) {
|
||
// 认证用户超限后应被拒绝
|
||
handler := PerUserLimit("test_route", 2)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(func(c *gin.Context) {
|
||
c.Set("user_id", uint(1001))
|
||
c.Next()
|
||
})
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 前2次请求通过
|
||
for i := 0; i < 2; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// 第3次请求应被拒绝
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// 检查响应体
|
||
var body response.APIResponse
|
||
err := json.Unmarshal(w.Body.Bytes(), &body)
|
||
assert.NoError(t, err)
|
||
assert.False(t, body.Success)
|
||
assert.Equal(t, response.ErrRateLimit, body.Error.Code)
|
||
assert.Contains(t, body.Error.Message, "per user")
|
||
}
|
||
|
||
func TestPerUserLimit_UnauthenticatedFallsToIP(t *testing.T) {
|
||
// 未认证用户（无user_id）应降级到IP限流
|
||
handler := PerUserLimit("test_route", 3)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler) // 不设置user_id
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestPerUserLimit_UnauthenticatedOverLimit(t *testing.T) {
|
||
// 未认证用户超限（基于IP）应被拒绝
|
||
handler := PerUserLimit("test_route", 2)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(handler) // 不设置user_id
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 前2次请求通过（基于IP限流）
|
||
for i := 0; i < 2; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
// 第3次请求应被拒绝
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "192.168.1.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
}
|
||
|
||
func TestPerUserLimit_DifferentUsersIndependent(t *testing.T) {
|
||
// 不同认证用户应有独立的限流计数
|
||
handler := PerUserLimit("test_route", 2)
|
||
setupGin()
|
||
r := gin.New()
|
||
|
||
r.GET("/test/user1001", func(c *gin.Context) {
|
||
c.Set("user_id", uint(1001))
|
||
c.Next()
|
||
}, handler, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
r.GET("/test/user1002", func(c *gin.Context) {
|
||
c.Set("user_id", uint(1002))
|
||
c.Next()
|
||
}, handler, func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 用户1001耗尽限额
|
||
for i := 0; i < 2; i++ {
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test/user1001", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
// 用户1001被限流
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test/user1001", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
|
||
// 用户1002首次请求应被允许
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test/user1002", nil)
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
}
|
||
|
||
func TestPerUserLimit_HeadersAuthenticated(t *testing.T) {
|
||
// 认证用户后续请求（非首次）应设置限流响应头
|
||
// 首次请求（新key）直接c.Next()不设置headers，后续请求才设置
|
||
handler := PerUserLimit("test_route", 5)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(func(c *gin.Context) {
|
||
c.Set("user_id", uint(1001))
|
||
c.Next()
|
||
})
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 第1次请求：新key，直接c.Next()
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
// 首次请求不设置限流头
|
||
assert.Empty(t, w.Header().Get("X-RateLimit-Limit"))
|
||
|
||
// 第2次请求：非新key，会设置headers
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
assert.Equal(t, "5", w.Header().Get("X-RateLimit-Limit"))
|
||
assert.Equal(t, "3", w.Header().Get("X-RateLimit-Remaining"))
|
||
}
|
||
|
||
func TestPerUserLimit_OverLimitHeaders(t *testing.T) {
|
||
// 认证用户超限时应设置剩余为0
|
||
handler := PerUserLimit("test_route", 1)
|
||
setupGin()
|
||
r := gin.New()
|
||
r.Use(func(c *gin.Context) {
|
||
c.Set("user_id", uint(1001))
|
||
c.Next()
|
||
})
|
||
r.Use(handler)
|
||
r.GET("/test", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"message": "ok"})
|
||
})
|
||
|
||
// 第1次通过
|
||
w := httptest.NewRecorder()
|
||
req, _ := http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusOK, w.Code)
|
||
|
||
// 第2次被拒绝
|
||
w = httptest.NewRecorder()
|
||
req, _ = http.NewRequest("GET", "/test", nil)
|
||
req.RemoteAddr = "127.0.0.1:1234"
|
||
r.ServeHTTP(w, req)
|
||
assert.Equal(t, http.StatusTooManyRequests, w.Code)
|
||
assert.Equal(t, "1", w.Header().Get("X-RateLimit-Limit"))
|
||
assert.Equal(t, "0", w.Header().Get("X-RateLimit-Remaining"))
|
||
}
|