3cea24d45f
- Rewrote audit_compliance.rs: Proper behavior tests (no stubs) - Agent 9, 19 - Enhanced audit_trail_persistence_test.rs: Comprehensive persistence validation - Fixed audit_trails.rs: Improved error handling and event processing - Updated rate limiter tests: Result unwrapping and stress test improvements - Optimized full_trading_cycle.rs benchmark: Better performance measurement - All tests follow anti-workaround protocol (no placeholders, actual validations)
329 lines
10 KiB
Rust
329 lines
10 KiB
Rust
//! Rate Limiting Integration Tests
|
|
//!
|
|
//! Tests for Layer 6 of the authentication pipeline:
|
|
//! - In-memory rate limiting with atomic counters
|
|
//! - Per-user rate limits
|
|
//! - Concurrent request handling
|
|
//! - Rate limit reset behavior
|
|
|
|
#[path = "common/mod.rs"]
|
|
mod common;
|
|
|
|
use anyhow::Result;
|
|
use std::time::{Duration, Instant};
|
|
|
|
use api_gateway::auth::{RateLimiter};
|
|
|
|
const REDIS_URL: &str = "redis://localhost:6380";
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_basic() -> Result<()> {
|
|
println!("\n=== Test: Rate Limiter Basic Functionality ===");
|
|
|
|
let rate_limiter = RateLimiter::new(10).expect("Failed to create rate limiter"); // 10 requests per second
|
|
|
|
let mut allowed_count = 0;
|
|
let mut denied_count = 0;
|
|
|
|
// Make 15 requests
|
|
for i in 1..=15 {
|
|
if rate_limiter.check_rate_limit("user_basic") {
|
|
allowed_count += 1;
|
|
} else {
|
|
denied_count += 1;
|
|
if denied_count == 1 {
|
|
println!(" ✓ First denial at request #{}", i);
|
|
}
|
|
}
|
|
}
|
|
|
|
println!(" Allowed: {}, Denied: {}", allowed_count, denied_count);
|
|
|
|
assert!(allowed_count <= 10, "Should allow at most 10 requests");
|
|
assert!(denied_count > 0, "Should deny some requests after limit");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_per_user() -> Result<()> {
|
|
println!("\n=== Test: Per-User Rate Limiting ===");
|
|
|
|
let rate_limiter = RateLimiter::new(5).expect("Failed to create rate limiter"); // 5 requests per second per user
|
|
|
|
// User 1 makes 7 requests
|
|
let mut user1_allowed = 0;
|
|
for _ in 1..=7 {
|
|
if rate_limiter.check_rate_limit("user1") {
|
|
user1_allowed += 1;
|
|
}
|
|
}
|
|
|
|
// User 2 makes 7 requests
|
|
let mut user2_allowed = 0;
|
|
for _ in 1..=7 {
|
|
if rate_limiter.check_rate_limit("user2") {
|
|
user2_allowed += 1;
|
|
}
|
|
}
|
|
|
|
println!(" User 1 allowed: {}", user1_allowed);
|
|
println!(" User 2 allowed: {}", user2_allowed);
|
|
|
|
// Each user should be rate limited independently
|
|
assert!(user1_allowed <= 5, "User 1 should be limited to 5 requests");
|
|
assert!(user2_allowed <= 5, "User 2 should be limited to 5 requests");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_concurrent_requests() -> Result<()> {
|
|
println!("\n=== Test: Concurrent Rate Limiting ===");
|
|
|
|
let rate_limiter = RateLimiter::new(100).expect("Failed to create rate limiter"); // 100 requests per second
|
|
|
|
// Spawn 200 concurrent requests for same user
|
|
let mut handles = Vec::new();
|
|
|
|
println!(" Spawning 200 concurrent requests...");
|
|
for _ in 0..200 {
|
|
let limiter = rate_limiter.clone();
|
|
let handle = tokio::spawn(async move {
|
|
limiter.check_rate_limit("concurrent_user")
|
|
});
|
|
handles.push(handle);
|
|
}
|
|
|
|
// Collect results
|
|
let mut allowed_count = 0;
|
|
for handle in handles {
|
|
if let Ok(allowed) = handle.await {
|
|
if allowed {
|
|
allowed_count += 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
println!(" ✓ {}/200 concurrent requests allowed", allowed_count);
|
|
|
|
// Should allow around 100 requests (may vary slightly due to timing)
|
|
assert!(allowed_count >= 90, "Should allow at least 90 requests");
|
|
assert!(allowed_count <= 110, "Should not allow more than 110 requests");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_performance() -> Result<()> {
|
|
println!("\n=== Test: Rate Limiter Performance (<50ns target) ===");
|
|
|
|
let rate_limiter = RateLimiter::new(1000000).expect("Failed to create rate limiter"); // Very high limit for perf testing
|
|
|
|
let mut latencies = Vec::new();
|
|
|
|
// Perform 1000 rate limit checks
|
|
println!(" Running 1000 rate limit checks...");
|
|
for _ in 0..1000 {
|
|
let start = Instant::now();
|
|
let _ = rate_limiter.check_rate_limit("perf_user");
|
|
let elapsed = start.elapsed();
|
|
latencies.push(elapsed);
|
|
}
|
|
|
|
// Calculate percentiles
|
|
latencies.sort();
|
|
let p50 = latencies[499];
|
|
let p95 = latencies[949];
|
|
let p99 = latencies[989];
|
|
let p999 = latencies[999];
|
|
|
|
println!("\n Performance Metrics:");
|
|
println!(" ├─ P50: {:?}", p50);
|
|
println!(" ├─ P95: {:?}", p95);
|
|
println!(" ├─ P99: {:?}", p99);
|
|
println!(" └─ P99.9: {:?}", p999);
|
|
|
|
println!("\n Target: <50ns per check");
|
|
|
|
if p99 > Duration::from_nanos(50) {
|
|
println!(" ⚠ WARNING: P99 latency {:?} exceeds 50ns target", p99);
|
|
} else {
|
|
println!(" ✓ P99 latency within 50ns target");
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_reset_behavior() -> Result<()> {
|
|
println!("\n=== Test: Rate Limiter Reset Behavior ===");
|
|
|
|
let rate_limiter = RateLimiter::new(5).expect("Failed to create rate limiter"); // 5 requests per second
|
|
|
|
// Exhaust rate limit
|
|
let mut initial_allowed = 0;
|
|
for _ in 1..=10 {
|
|
if rate_limiter.check_rate_limit("reset_user") {
|
|
initial_allowed += 1;
|
|
}
|
|
}
|
|
|
|
println!(" Initial requests allowed: {}", initial_allowed);
|
|
assert!(initial_allowed <= 5, "Should be limited to 5 requests");
|
|
|
|
// Wait for rate limiter window to reset (1 second)
|
|
println!(" Waiting 1.1s for rate limit window to reset...");
|
|
tokio::time::sleep(Duration::from_millis(1100)).await;
|
|
|
|
// Try again after reset
|
|
let mut post_reset_allowed = 0;
|
|
for _ in 1..=10 {
|
|
if rate_limiter.check_rate_limit("reset_user") {
|
|
post_reset_allowed += 1;
|
|
}
|
|
}
|
|
|
|
println!(" Post-reset requests allowed: {}", post_reset_allowed);
|
|
assert!(post_reset_allowed > 0, "Should allow requests after reset");
|
|
assert!(post_reset_allowed <= 5, "Should still enforce limit after reset");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_multiple_users() -> Result<()> {
|
|
println!("\n=== Test: Multiple Users Rate Limiting ===");
|
|
|
|
let rate_limiter = RateLimiter::new(10).expect("Failed to create rate limiter"); // 10 requests per second per user
|
|
|
|
// 10 different users make 15 requests each
|
|
let mut user_results = Vec::new();
|
|
|
|
for user_id in 1..=10 {
|
|
let mut allowed = 0;
|
|
for _ in 1..=15 {
|
|
if rate_limiter.check_rate_limit(&format!("multi_user_{}", user_id)) {
|
|
allowed += 1;
|
|
}
|
|
}
|
|
user_results.push(allowed);
|
|
}
|
|
|
|
println!(" User results: {:?}", user_results);
|
|
|
|
// Each user should be limited independently
|
|
for (i, &allowed) in user_results.iter().enumerate() {
|
|
assert!(
|
|
allowed <= 10,
|
|
"User {} should be limited to 10 requests, got {}",
|
|
i + 1,
|
|
allowed
|
|
);
|
|
}
|
|
|
|
println!(" ✓ All 10 users independently rate limited");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_burst_handling() -> Result<()> {
|
|
println!("\n=== Test: Burst Request Handling ===");
|
|
|
|
let rate_limiter = RateLimiter::new(50).expect("Failed to create rate limiter"); // 50 requests per second
|
|
|
|
// Send 100 requests as fast as possible (burst)
|
|
let start = Instant::now();
|
|
let mut burst_allowed = 0;
|
|
|
|
for _ in 0..100 {
|
|
if rate_limiter.check_rate_limit("burst_user") {
|
|
burst_allowed += 1;
|
|
}
|
|
}
|
|
|
|
let burst_duration = start.elapsed();
|
|
|
|
println!(" Burst allowed: {} requests in {:?}", burst_allowed, burst_duration);
|
|
|
|
assert!(burst_allowed <= 50, "Should limit burst to 50 requests");
|
|
assert!(burst_duration < Duration::from_millis(100), "Burst check should be fast");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_edge_cases() -> Result<()> {
|
|
println!("\n=== Test: Rate Limiter Edge Cases ===");
|
|
|
|
// Test with very low limit
|
|
let low_limit = RateLimiter::new(1).expect("Failed to create rate limiter");
|
|
let mut low_allowed = 0;
|
|
for _ in 0..5 {
|
|
if low_limit.check_rate_limit("low_limit_user") {
|
|
low_allowed += 1;
|
|
}
|
|
}
|
|
println!(" Low limit (1/s): {} allowed", low_allowed);
|
|
assert!(low_allowed <= 1, "Should enforce limit of 1");
|
|
|
|
// Test with high limit
|
|
let high_limit = RateLimiter::new(10000).expect("Failed to create rate limiter");
|
|
let mut high_allowed = 0;
|
|
for _ in 0..100 {
|
|
if high_limit.check_rate_limit("high_limit_user") {
|
|
high_allowed += 1;
|
|
}
|
|
}
|
|
println!(" High limit (10000/s): {} allowed", high_allowed);
|
|
assert_eq!(high_allowed, 100, "Should allow all 100 requests");
|
|
|
|
// Test with empty user ID
|
|
let empty_limiter = RateLimiter::new(5).expect("Failed to create rate limiter");
|
|
let mut empty_allowed = 0;
|
|
for _ in 0..10 {
|
|
if empty_limiter.check_rate_limit("") {
|
|
empty_allowed += 1;
|
|
}
|
|
}
|
|
println!(" Empty user ID: {} allowed", empty_allowed);
|
|
assert!(empty_allowed <= 5, "Should still enforce limit for empty user ID");
|
|
|
|
Ok(())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rate_limiter_sustained_load() -> Result<()> {
|
|
println!("\n=== Test: Sustained Load Rate Limiting ===");
|
|
|
|
let rate_limiter = RateLimiter::new(100).expect("Failed to create rate limiter"); // 100 requests per second
|
|
|
|
let mut total_allowed = 0;
|
|
let start = Instant::now();
|
|
|
|
// Simulate sustained load for 2 seconds
|
|
while start.elapsed() < Duration::from_secs(2) {
|
|
if rate_limiter.check_rate_limit("sustained_user") {
|
|
total_allowed += 1;
|
|
}
|
|
// Small delay to prevent tight loop
|
|
tokio::time::sleep(Duration::from_micros(100)).await;
|
|
}
|
|
|
|
let actual_duration = start.elapsed();
|
|
let requests_per_second = (total_allowed as f64) / actual_duration.as_secs_f64();
|
|
|
|
println!(" Total allowed: {} requests over {:?}", total_allowed, actual_duration);
|
|
println!(" Effective rate: {:.2} req/s", requests_per_second);
|
|
|
|
// Should be close to 200 requests (100/s * 2s), allowing for some variance
|
|
assert!(
|
|
total_allowed >= 180 && total_allowed <= 220,
|
|
"Sustained rate should be around 200 requests (got {})",
|
|
total_allowed
|
|
);
|
|
|
|
Ok(())
|
|
}
|