foxhunt/services/api_gateway/tests/rate_limiting_tests.rs

//! Rate Limiting Integration Tests
//!
//! Tests for Layer 6 of the authentication pipeline:
//! - In-memory rate limiting with atomic counters
//! - Per-user rate limits
//! - Concurrent request handling
//! - Rate limit reset behavior

#[path = "common/mod.rs"]
mod common;

use anyhow::Result;
use common::{cleanup_redis, generate_test_token, wait_for_redis};
use std::time::{Duration, Instant};
use tonic::{metadata::MetadataValue, Request};

use api_gateway::auth::{RateLimiter};

const REDIS_URL: &str = "redis://localhost:6380";

#[tokio::test]
async fn test_rate_limiter_basic() -> Result<()> {
    println!("\n=== Test: Rate Limiter Basic Functionality ===");
    
    let rate_limiter = RateLimiter::new(10); // 10 requests per second
    
    let mut allowed_count = 0;
    let mut denied_count = 0;
    
    // Make 15 requests
    for i in 1..=15 {
        if rate_limiter.check_rate_limit("user_basic") {
            allowed_count += 1;
        } else {
            denied_count += 1;
            if denied_count == 1 {
                println!("  ✓ First denial at request #{}", i);
            }
        }
    }
    
    println!("  Allowed: {}, Denied: {}", allowed_count, denied_count);
    
    assert!(allowed_count <= 10, "Should allow at most 10 requests");
    assert!(denied_count > 0, "Should deny some requests after limit");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_per_user() -> Result<()> {
    println!("\n=== Test: Per-User Rate Limiting ===");
    
    let rate_limiter = RateLimiter::new(5); // 5 requests per second per user
    
    // User 1 makes 7 requests
    let mut user1_allowed = 0;
    for _ in 1..=7 {
        if rate_limiter.check_rate_limit("user1") {
            user1_allowed += 1;
        }
    }
    
    // User 2 makes 7 requests
    let mut user2_allowed = 0;
    for _ in 1..=7 {
        if rate_limiter.check_rate_limit("user2") {
            user2_allowed += 1;
        }
    }
    
    println!("  User 1 allowed: {}", user1_allowed);
    println!("  User 2 allowed: {}", user2_allowed);
    
    // Each user should be rate limited independently
    assert!(user1_allowed <= 5, "User 1 should be limited to 5 requests");
    assert!(user2_allowed <= 5, "User 2 should be limited to 5 requests");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_concurrent_requests() -> Result<()> {
    println!("\n=== Test: Concurrent Rate Limiting ===");
    
    let rate_limiter = RateLimiter::new(100); // 100 requests per second
    
    // Spawn 200 concurrent requests for same user
    let mut handles = Vec::new();
    
    println!("  Spawning 200 concurrent requests...");
    for _ in 0..200 {
        let limiter = rate_limiter.clone();
        let handle = tokio::spawn(async move {
            limiter.check_rate_limit("concurrent_user")
        });
        handles.push(handle);
    }
    
    // Collect results
    let mut allowed_count = 0;
    for handle in handles {
        if let Ok(allowed) = handle.await {
            if allowed {
                allowed_count += 1;
            }
        }
    }
    
    println!("  ✓ {}/200 concurrent requests allowed", allowed_count);
    
    // Should allow around 100 requests (may vary slightly due to timing)
    assert!(allowed_count >= 90, "Should allow at least 90 requests");
    assert!(allowed_count <= 110, "Should not allow more than 110 requests");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_performance() -> Result<()> {
    println!("\n=== Test: Rate Limiter Performance (<50ns target) ===");
    
    let rate_limiter = RateLimiter::new(1000000); // Very high limit for perf testing
    
    let mut latencies = Vec::new();
    
    // Perform 1000 rate limit checks
    println!("  Running 1000 rate limit checks...");
    for _ in 0..1000 {
        let start = Instant::now();
        let _ = rate_limiter.check_rate_limit("perf_user");
        let elapsed = start.elapsed();
        latencies.push(elapsed);
    }
    
    // Calculate percentiles
    latencies.sort();
    let p50 = latencies[499];
    let p95 = latencies[949];
    let p99 = latencies[989];
    let p999 = latencies[999];
    
    println!("\n  Performance Metrics:");
    println!("  ├─ P50:   {:?}", p50);
    println!("  ├─ P95:   {:?}", p95);
    println!("  ├─ P99:   {:?}", p99);
    println!("  └─ P99.9: {:?}", p999);
    
    println!("\n  Target: <50ns per check");
    
    if p99 > Duration::from_nanos(50) {
        println!("  ⚠ WARNING: P99 latency {:?} exceeds 50ns target", p99);
    } else {
        println!("  ✓ P99 latency within 50ns target");
    }
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_reset_behavior() -> Result<()> {
    println!("\n=== Test: Rate Limiter Reset Behavior ===");
    
    let rate_limiter = RateLimiter::new(5); // 5 requests per second
    
    // Exhaust rate limit
    let mut initial_allowed = 0;
    for _ in 1..=10 {
        if rate_limiter.check_rate_limit("reset_user") {
            initial_allowed += 1;
        }
    }
    
    println!("  Initial requests allowed: {}", initial_allowed);
    assert!(initial_allowed <= 5, "Should be limited to 5 requests");
    
    // Wait for rate limiter window to reset (1 second)
    println!("  Waiting 1.1s for rate limit window to reset...");
    tokio::time::sleep(Duration::from_millis(1100)).await;
    
    // Try again after reset
    let mut post_reset_allowed = 0;
    for _ in 1..=10 {
        if rate_limiter.check_rate_limit("reset_user") {
            post_reset_allowed += 1;
        }
    }
    
    println!("  Post-reset requests allowed: {}", post_reset_allowed);
    assert!(post_reset_allowed > 0, "Should allow requests after reset");
    assert!(post_reset_allowed <= 5, "Should still enforce limit after reset");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_multiple_users() -> Result<()> {
    println!("\n=== Test: Multiple Users Rate Limiting ===");
    
    let rate_limiter = RateLimiter::new(10); // 10 requests per second per user
    
    // 10 different users make 15 requests each
    let mut user_results = Vec::new();
    
    for user_id in 1..=10 {
        let mut allowed = 0;
        for _ in 1..=15 {
            if rate_limiter.check_rate_limit(&format!("multi_user_{}", user_id)) {
                allowed += 1;
            }
        }
        user_results.push(allowed);
    }
    
    println!("  User results: {:?}", user_results);
    
    // Each user should be limited independently
    for (i, &allowed) in user_results.iter().enumerate() {
        assert!(
            allowed <= 10,
            "User {} should be limited to 10 requests, got {}",
            i + 1,
            allowed
        );
    }
    
    println!("  ✓ All 10 users independently rate limited");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_burst_handling() -> Result<()> {
    println!("\n=== Test: Burst Request Handling ===");
    
    let rate_limiter = RateLimiter::new(50); // 50 requests per second
    
    // Send 100 requests as fast as possible (burst)
    let start = Instant::now();
    let mut burst_allowed = 0;
    
    for _ in 0..100 {
        if rate_limiter.check_rate_limit("burst_user") {
            burst_allowed += 1;
        }
    }
    
    let burst_duration = start.elapsed();
    
    println!("  Burst allowed: {} requests in {:?}", burst_allowed, burst_duration);
    
    assert!(burst_allowed <= 50, "Should limit burst to 50 requests");
    assert!(burst_duration < Duration::from_millis(100), "Burst check should be fast");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_edge_cases() -> Result<()> {
    println!("\n=== Test: Rate Limiter Edge Cases ===");
    
    // Test with very low limit
    let low_limit = RateLimiter::new(1);
    let mut low_allowed = 0;
    for _ in 0..5 {
        if low_limit.check_rate_limit("low_limit_user") {
            low_allowed += 1;
        }
    }
    println!("  Low limit (1/s): {} allowed", low_allowed);
    assert!(low_allowed <= 1, "Should enforce limit of 1");
    
    // Test with high limit
    let high_limit = RateLimiter::new(10000);
    let mut high_allowed = 0;
    for _ in 0..100 {
        if high_limit.check_rate_limit("high_limit_user") {
            high_allowed += 1;
        }
    }
    println!("  High limit (10000/s): {} allowed", high_allowed);
    assert_eq!(high_allowed, 100, "Should allow all 100 requests");
    
    // Test with empty user ID
    let empty_limiter = RateLimiter::new(5);
    let mut empty_allowed = 0;
    for _ in 0..10 {
        if empty_limiter.check_rate_limit("") {
            empty_allowed += 1;
        }
    }
    println!("  Empty user ID: {} allowed", empty_allowed);
    assert!(empty_allowed <= 5, "Should still enforce limit for empty user ID");
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_sustained_load() -> Result<()> {
    println!("\n=== Test: Sustained Load Rate Limiting ===");
    
    let rate_limiter = RateLimiter::new(100); // 100 requests per second
    
    let mut total_allowed = 0;
    let start = Instant::now();
    
    // Simulate sustained load for 2 seconds
    while start.elapsed() < Duration::from_secs(2) {
        if rate_limiter.check_rate_limit("sustained_user") {
            total_allowed += 1;
        }
        // Small delay to prevent tight loop
        tokio::time::sleep(Duration::from_micros(100)).await;
    }
    
    let actual_duration = start.elapsed();
    let requests_per_second = (total_allowed as f64) / actual_duration.as_secs_f64();
    
    println!("  Total allowed: {} requests over {:?}", total_allowed, actual_duration);
    println!("  Effective rate: {:.2} req/s", requests_per_second);
    
    // Should be close to 200 requests (100/s * 2s), allowing for some variance
    assert!(
        total_allowed >= 180 && total_allowed <= 220,
        "Sustained rate should be around 200 requests (got {})",
        total_allowed
    );
    
    Ok(())
}