Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

test/tarakan_web/plugs/code_browser_rate_limit_test.exs

@@ -0,0 +1,68 @@
+defmodule TarakanWeb.Plugs.CodeBrowserRateLimitTest do
+  use Tarakan.DataCase, async: true
+
+  import Plug.Conn
+  import Plug.Test
+
+  alias TarakanWeb.Plugs.CodeBrowserRateLimit
+
+  test "allows requests under the per-IP budget" do
+    opts = CodeBrowserRateLimit.init(limit: 2, window_seconds: 60)
+
+    for path <- [
+          "/findings/55d5c681-240a-4e3a-a1f8-45933a30c4ef/code",
+          "/github.com/openai/codex"
+        ] do
+      conn = conn(:get, path) |> CodeBrowserRateLimit.call(opts)
+      refute conn.halted
+    end
+  end
+
+  test "answers 429 once the per-IP budget is exceeded" do
+    opts = CodeBrowserRateLimit.init(limit: 2, window_seconds: 60)
+
+    for _ <- 1..2 do
+      conn = conn(:get, "/github.com/openai/codex") |> CodeBrowserRateLimit.call(opts)
+      refute conn.halted
+    end
+
+    conn = conn(:get, "/github.com/openai/codex") |> CodeBrowserRateLimit.call(opts)
+
+    assert conn.halted
+    assert conn.status == 429
+    assert [retry_after] = get_resp_header(conn, "retry-after")
+    assert String.to_integer(retry_after) > 0
+  end
+
+  test "IPv6 clients in the same /64 share one bucket" do
+    opts = CodeBrowserRateLimit.init(limit: 1, window_seconds: 60)
+
+    first =
+      conn(:get, "/github.com/openai/codex")
+      |> Map.put(:remote_ip, {0x2001, 0x0DB8, 0, 0, 0, 0, 0, 1})
+      |> CodeBrowserRateLimit.call(opts)
+
+    refute first.halted
+
+    second =
+      conn(:get, "/github.com/openai/codex")
+      |> Map.put(:remote_ip, {0x2001, 0x0DB8, 0, 0, 0xFFFF, 0xEEEE, 0xDDDD, 0xCCCC})
+      |> CodeBrowserRateLimit.call(opts)
+
+    assert second.halted
+    assert second.status == 429
+  end
+
+  test "admins and moderators are exempt from the budget" do
+    opts = CodeBrowserRateLimit.init(limit: 1, window_seconds: 60)
+
+    for role <- ["admin", "moderator"], _ <- 1..3 do
+      conn =
+        conn(:get, "/github.com/openai/codex")
+        |> assign(:current_scope, %{platform_role: role})
+        |> CodeBrowserRateLimit.call(opts)
+
+      refute conn.halted
+    end
+  end
+end