def test_it_uses_rate_limiting(self):
self.client.login(username="******", password="******")
obj = TokenBucket(value=f"sudo-{self.alice.id}")
obj.tokens = 0
obj.save()
r = self.client.get(self.url)
self.assertContains(r, "Too Many Requests")
def test_it_rate_limits_password_attempts(self):
# "d60d..." is sha1("[email protected]")
obj = TokenBucket(value="pw-d60db3b2343e713a4de3e92d4eb417e4f05f06ab")
obj.tokens = 0
obj.save()
form = {"action": "login", "email": "*****@*****.**", "password": "******"}
r = self.client.post("/accounts/login/", form)
self.assertContains(r, "Too many attempts")
def test_it_tops_up(self):
obj = TokenBucket(value="em-" + ALICE_HASH)
obj.tokens = 0
obj.updated = now() - td(minutes=30)
obj.save()
r = TokenBucket.authorize_login_email("*****@*****.**")
self.assertTrue(r)
obj.refresh_from_db()
self.assertAlmostEqual(obj.tokens, 0.45, places=5)
def test_it_obeys_rate_limit(self, mock_post):
self._setup_data("123|0")
# "c0ca..." is sha1("123test-secret")
obj = TokenBucket(value="po-c0ca2a9774952af32cabf86453f69e442c4ed0eb")
obj.tokens = 0
obj.save()
self.channel.notify(self.check)
n = Notification.objects.get()
self.assertEqual(n.error, "Rate limit exceeded")
def test_it_rate_limits_invites(self):
obj = TokenBucket(value="invite-%d" % self.alice.id)
obj.tokens = 0
obj.save()
self.client.login(username="******", password="******")
form = {"invite_team_member": "1", "email": "*****@*****.**"}
r = self.client.post(self.url, form)
self.assertContains(r, "Too Many Requests")
self.assertEqual(len(mail.outbox), 0)
def test_it_obeys_rate_limit(self, mock_bus):
# "2862..." is sha1("+123456789test-secret")
obj = TokenBucket(
value="signal-2862991ccaa15c8856e7ee0abaf3448fb3c292e0")
obj.tokens = 0
obj.save()
self.channel.notify(self.check)
n = Notification.objects.first()
self.assertEqual(n.error, "Rate limit exceeded")
self.assertFalse(mock_bus.SysemBus.called)
def test_it_rate_limits_emails(self):
# "d60d..." is sha1("[email protected]")
obj = TokenBucket(value="em-d60db3b2343e713a4de3e92d4eb417e4f05f06ab")
obj.tokens = 0
obj.save()
form = {"identity": "*****@*****.**"}
r = self.client.post("/accounts/login/", form)
self.assertContains(r, "Too many attempts")
# No email should have been sent
self.assertEqual(len(mail.outbox), 0)