Files
agentic-dev/packages/core-eslint/rules/no-undeclared-rate-limit.test.js
Danijel Martinek b61bb0c11e feat(auth): add signIn rate-limit backfill with dual ip/account budgets
Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-20 09:22:41 +00:00

188 lines
5.6 KiB
JavaScript

import { describe, it } from "vitest";
import { RuleTester } from "eslint";
import path from "node:path";
import os from "node:os";
import fs from "node:fs";
import rule from "./no-undeclared-rate-limit.js";
function makeFixture({ manifestRateLimit, useCaseBody }) {
const repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nurl-"));
const featureDir = path.join(repoRoot, "packages", "demo");
fs.mkdirSync(path.join(featureDir, "src", "application", "use-cases"), {
recursive: true,
});
const rateLimitField =
manifestRateLimit.length > 0
? `, rateLimit: [${manifestRateLimit.map((b) => `"${b}"`).join(", ")}]`
: "";
fs.writeFileSync(
path.join(featureDir, "src", "feature.manifest.ts"),
`export const demoManifest = defineFeature({
name: "demo",
requiredCores: [],
useCases: {
signUp: { mutates: true, audits: [], publishes: [], consumes: []${rateLimitField} },
},
realtimeChannels: [],
jobs: [],
} as const);`,
);
const useCaseFile = path.join(
featureDir,
"src",
"application",
"use-cases",
"sign-up.use-case.ts",
);
fs.writeFileSync(useCaseFile, useCaseBody);
return { repoRoot, useCaseFile };
}
const tester = new RuleTester({
languageOptions: {
parser: await import("@typescript-eslint/parser"),
ecmaVersion: "latest",
sourceType: "module",
},
});
describe("no-undeclared-rate-limit", () => {
it("passes when rateLimit.consume budget matches manifest rateLimit[]", () => {
const { repoRoot, useCaseFile } = makeFixture({
manifestRateLimit: ["signUp.ip"],
useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
});
tester.run("no-undeclared-rate-limit", rule, {
valid: [
{
filename: useCaseFile,
code: fs.readFileSync(useCaseFile, "utf8"),
options: [{ repoRoot }],
},
],
invalid: [],
});
});
it("fires when rateLimit.consume budget is not declared in manifest", () => {
const { repoRoot, useCaseFile } = makeFixture({
manifestRateLimit: [],
useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
});
tester.run("no-undeclared-rate-limit", rule, {
valid: [],
invalid: [
{
filename: useCaseFile,
code: fs.readFileSync(useCaseFile, "utf8"),
options: [{ repoRoot }],
errors: [
{
messageId: "undeclared",
data: { budget: "signUp.ip", useCase: "signUp" },
},
],
},
],
});
});
it("fires when a declared budget is never consumed in the use-case body", () => {
const { repoRoot, useCaseFile } = makeFixture({
manifestRateLimit: ["signUp.ip"],
useCaseBody: `export const signUpUseCase = () => async () => { return { ok: true }; };`,
});
tester.run("no-undeclared-rate-limit", rule, {
valid: [],
invalid: [
{
filename: useCaseFile,
code: fs.readFileSync(useCaseFile, "utf8"),
options: [{ repoRoot }],
errors: [
{
messageId: "unusedDeclaration",
data: { budget: "signUp.ip", useCase: "signUp" },
},
],
},
],
});
});
it("passes when rateLimit.consume budget matches a RateLimitBudget object in manifest rateLimit[]", () => {
const repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nurl-obj-"));
const featureDir = path.join(repoRoot, "packages", "demo");
fs.mkdirSync(path.join(featureDir, "src", "application", "use-cases"), {
recursive: true,
});
fs.writeFileSync(
path.join(featureDir, "src", "feature.manifest.ts"),
`export const demoManifest = defineFeature({
name: "demo",
requiredCores: [],
useCases: {
signUp: { mutates: true, audits: [], publishes: [], consumes: [], rateLimit: [{ name: "ip", window: "1m", budget: 5 }, { name: "account", window: "1h", budget: 10 }] },
},
realtimeChannels: [],
jobs: [],
} as const);`,
);
const useCaseFile = path.join(
featureDir,
"src",
"application",
"use-cases",
"sign-up.use-case.ts",
);
fs.writeFileSync(
useCaseFile,
`export const signUpUseCase = (rateLimit) => async (input) => {
await rateLimit.consume("ip", input.clientIp);
await rateLimit.consume("account", input.username);
};`,
);
tester.run("no-undeclared-rate-limit", rule, {
valid: [
{
filename: useCaseFile,
code: fs.readFileSync(useCaseFile, "utf8"),
options: [{ repoRoot }],
},
],
invalid: [],
});
});
it("is a no-op for non-use-case files", () => {
const { repoRoot } = makeFixture({
manifestRateLimit: ["signUp.ip"],
useCaseBody: `export const signUpUseCase = (rateLimit) => async (input) => { await rateLimit.consume("signUp.ip", input.ip); };`,
});
const serviceFile = path.join(
repoRoot,
"packages",
"demo",
"src",
"application",
"services",
"sign-up.service.ts",
);
fs.mkdirSync(path.dirname(serviceFile), { recursive: true });
fs.writeFileSync(
serviceFile,
`export function doWork(rateLimit) { rateLimit.consume("undeclared", "x"); }`,
);
tester.run("no-undeclared-rate-limit", rule, {
valid: [
{
filename: serviceFile,
code: fs.readFileSync(serviceFile, "utf8"),
options: [{ repoRoot }],
},
],
invalid: [],
});
});
});