foxhunt/services/api/tests/rate_limiting_tests.rs

//! Rate Limiting Integration Tests
//!
//! Tests for Layer 6 of the authentication pipeline:
//! - In-memory rate limiting with atomic counters
//! - Per-user rate limits
//! - Concurrent request handling
//! - Rate limit reset behavior

#[path = "common/mod.rs"]
mod common;

use anyhow::Result;
use std::time::{Duration, Instant};

use api::auth::RateLimiter;

const REDIS_URL: &str = "redis://localhost:6379";

#[tokio::test]
async fn test_rate_limiter_basic() -> Result<()> {
    println!("\n=== Test: Rate Limiter Basic Functionality ===");

    let rate_limiter = RateLimiter::new(10).expect("Failed to create rate limiter"); // 10 requests per second

    let mut allowed_count = 0;
    let mut denied_count = 0;

    // Make 15 requests
    for i in 1..=15 {
        if rate_limiter.check_rate_limit("user_basic") {
            allowed_count += 1;
        } else {
            denied_count += 1;
            if denied_count == 1 {
                println!("  ✓ First denial at request #{}", i);
            }
        }
    }

    println!("  Allowed: {}, Denied: {}", allowed_count, denied_count);

    assert!(allowed_count <= 10, "Should allow at most 10 requests");
    assert!(denied_count > 0, "Should deny some requests after limit");

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_per_user() -> Result<()> {
    println!("\n=== Test: Per-User Rate Limiting ===");

    let rate_limiter = RateLimiter::new(5).expect("Failed to create rate limiter"); // 5 requests per second per user

    // User 1 makes 7 requests
    let mut user1_allowed = 0;
    for _ in 1..=7 {
        if rate_limiter.check_rate_limit("user1") {
            user1_allowed += 1;
        }
    }

    // User 2 makes 7 requests
    let mut user2_allowed = 0;
    for _ in 1..=7 {
        if rate_limiter.check_rate_limit("user2") {
            user2_allowed += 1;
        }
    }

    println!("  User 1 allowed: {}", user1_allowed);
    println!("  User 2 allowed: {}", user2_allowed);

    // Each user should be rate limited independently
    assert!(user1_allowed <= 5, "User 1 should be limited to 5 requests");
    assert!(user2_allowed <= 5, "User 2 should be limited to 5 requests");

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_concurrent_requests() -> Result<()> {
    println!("\n=== Test: Concurrent Rate Limiting ===");

    let rate_limiter = RateLimiter::new(100).expect("Failed to create rate limiter"); // 100 requests per second

    // Spawn 200 concurrent requests for same user
    let mut handles = Vec::new();

    println!("  Spawning 200 concurrent requests...");
    for _ in 0..200 {
        let limiter = rate_limiter.clone();
        let handle = tokio::spawn(async move { limiter.check_rate_limit("concurrent_user") });
        handles.push(handle);
    }

    // Collect results
    let mut allowed_count = 0;
    for handle in handles {
        if let Ok(allowed) = handle.await {
            if allowed {
                allowed_count += 1;
            }
        }
    }

    println!("  ✓ {}/200 concurrent requests allowed", allowed_count);

    // Should allow around 100 requests (may vary slightly due to timing)
    assert!(allowed_count >= 90, "Should allow at least 90 requests");
    assert!(
        allowed_count <= 110,
        "Should not allow more than 110 requests"
    );

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_performance() -> Result<()> {
    println!("\n=== Test: Rate Limiter Performance (<50ns target) ===");

    let rate_limiter = RateLimiter::new(1000000).expect("Failed to create rate limiter"); // Very high limit for perf testing

    let mut latencies = Vec::new();

    // Perform 1000 rate limit checks
    println!("  Running 1000 rate limit checks...");
    for _ in 0..1000 {
        let start = Instant::now();
        let _ = rate_limiter.check_rate_limit("perf_user");
        let elapsed = start.elapsed();
        latencies.push(elapsed);
    }

    // Calculate percentiles
    latencies.sort();
    let p50 = latencies[499];
    let p95 = latencies[949];
    let p99 = latencies[989];
    let p999 = latencies[999];

    println!("\n  Performance Metrics:");
    println!("  ├─ P50:   {:?}", p50);
    println!("  ├─ P95:   {:?}", p95);
    println!("  ├─ P99:   {:?}", p99);
    println!("  └─ P99.9: {:?}", p999);

    println!("\n  Target: <50ns per check");

    if p99 > Duration::from_nanos(50) {
        println!("  ⚠ WARNING: P99 latency {:?} exceeds 50ns target", p99);
    } else {
        println!("  ✓ P99 latency within 50ns target");
    }

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_reset_behavior() -> Result<()> {
    println!("\n=== Test: Rate Limiter Reset Behavior ===");

    let rate_limiter = RateLimiter::new(5).expect("Failed to create rate limiter"); // 5 requests per second

    // Exhaust rate limit
    let mut initial_allowed = 0;
    for _ in 1..=10 {
        if rate_limiter.check_rate_limit("reset_user") {
            initial_allowed += 1;
        }
    }

    println!("  Initial requests allowed: {}", initial_allowed);
    assert!(initial_allowed <= 5, "Should be limited to 5 requests");

    // Wait for rate limiter window to reset (1 second)
    println!("  Waiting 1.1s for rate limit window to reset...");
    tokio::time::sleep(Duration::from_millis(1100)).await;

    // Try again after reset
    let mut post_reset_allowed = 0;
    for _ in 1..=10 {
        if rate_limiter.check_rate_limit("reset_user") {
            post_reset_allowed += 1;
        }
    }

    println!("  Post-reset requests allowed: {}", post_reset_allowed);
    assert!(post_reset_allowed > 0, "Should allow requests after reset");
    assert!(
        post_reset_allowed <= 5,
        "Should still enforce limit after reset"
    );

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_multiple_users() -> Result<()> {
    println!("\n=== Test: Multiple Users Rate Limiting ===");

    let rate_limiter = RateLimiter::new(10).expect("Failed to create rate limiter"); // 10 requests per second per user

    // 10 different users make 15 requests each
    let mut user_results = Vec::new();

    for user_id in 1..=10 {
        let mut allowed = 0;
        for _ in 1..=15 {
            if rate_limiter.check_rate_limit(&format!("multi_user_{}", user_id)) {
                allowed += 1;
            }
        }
        user_results.push(allowed);
    }

    println!("  User results: {:?}", user_results);

    // Each user should be limited independently
    for (i, allowed) in user_results.into_iter().enumerate() {
        assert!(
            allowed <= 10,
            "User {} should be limited to 10 requests, got {}",
            i + 1,
            allowed
        );
    }

    println!("  ✓ All 10 users independently rate limited");

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_burst_handling() -> Result<()> {
    println!("\n=== Test: Burst Request Handling ===");

    let rate_limiter = RateLimiter::new(50).expect("Failed to create rate limiter"); // 50 requests per second

    // Send 100 requests as fast as possible (burst)
    let start = Instant::now();
    let mut burst_allowed = 0;

    for _ in 0..100 {
        if rate_limiter.check_rate_limit("burst_user") {
            burst_allowed += 1;
        }
    }

    let burst_duration = start.elapsed();

    println!(
        "  Burst allowed: {} requests in {:?}",
        burst_allowed, burst_duration
    );

    assert!(burst_allowed <= 50, "Should limit burst to 50 requests");
    assert!(
        burst_duration < Duration::from_millis(100),
        "Burst check should be fast"
    );

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_edge_cases() -> Result<()> {
    println!("\n=== Test: Rate Limiter Edge Cases ===");

    // Test with very low limit
    let low_limit = RateLimiter::new(1).expect("Failed to create rate limiter");
    let mut low_allowed = 0;
    for _ in 0..5 {
        if low_limit.check_rate_limit("low_limit_user") {
            low_allowed += 1;
        }
    }
    println!("  Low limit (1/s): {} allowed", low_allowed);
    assert!(low_allowed <= 1, "Should enforce limit of 1");

    // Test with high limit
    let high_limit = RateLimiter::new(10000).expect("Failed to create rate limiter");
    let mut high_allowed = 0;
    for _ in 0..100 {
        if high_limit.check_rate_limit("high_limit_user") {
            high_allowed += 1;
        }
    }
    println!("  High limit (10000/s): {} allowed", high_allowed);
    assert_eq!(high_allowed, 100, "Should allow all 100 requests");

    // Test with empty user ID
    let empty_limiter = RateLimiter::new(5).expect("Failed to create rate limiter");
    let mut empty_allowed = 0;
    for _ in 0..10 {
        if empty_limiter.check_rate_limit("") {
            empty_allowed += 1;
        }
    }
    println!("  Empty user ID: {} allowed", empty_allowed);
    assert!(
        empty_allowed <= 5,
        "Should still enforce limit for empty user ID"
    );

    Ok(())
}

#[tokio::test]
async fn test_rate_limiter_sustained_load() -> Result<()> {
    println!("\n=== Test: Sustained Load Rate Limiting ===");

    let rate_limiter = RateLimiter::new(100).expect("Failed to create rate limiter"); // 100 requests per second

    let mut total_allowed = 0;
    let start = Instant::now();

    // Simulate sustained load for 2 seconds
    while start.elapsed() < Duration::from_secs(2) {
        if rate_limiter.check_rate_limit("sustained_user") {
            total_allowed += 1;
        }
        // Small delay to prevent tight loop
        tokio::time::sleep(Duration::from_micros(100)).await;
    }

    let actual_duration = start.elapsed();
    let requests_per_second = (total_allowed as f64) / actual_duration.as_secs_f64();

    println!(
        "  Total allowed: {} requests over {:?}",
        total_allowed, actual_duration
    );
    println!("  Effective rate: {:.2} req/s", requests_per_second);

    // Should be close to 200 requests (100/s * 2s), allowing for some variance
    assert!(
        (180..=220).contains(&total_allowed),
        "Sustained rate should be around 200 requests (got {})",
        total_allowed
    );

    Ok(())
}