Danijel Martinek
b61bb0c11e
Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:
- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
objects ({name,window,budget}) in addition to plain string literals,
no-undeclared-rate-limit passes on both "ip" and "account" call sites
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
2.3 KiB
TypeScript
51 lines
2.3 KiB
TypeScript
// Feature-level test: sign-up, then sign-in with the new credentials, then sign-out.
|
|
// Constructs the full chain via direct injection (no container rebinding).
|
|
|
|
import { describe, it, expect } from "vitest";
|
|
import { RecordingEventBus } from "@repo/core-testing/instrumentation";
|
|
import { NoopRateLimit } from "@repo/core-shared/rate-limit";
|
|
import { MockUsersRepository } from "../src/infrastructure/repositories/users.repository.mock";
|
|
import { MockAuthenticationService } from "../src/infrastructure/services/authentication.service.mock";
|
|
import { signInUseCase } from "../src/application/use-cases/sign-in.use-case";
|
|
import { signUpUseCase } from "../src/application/use-cases/sign-up.use-case";
|
|
import { signOutUseCase } from "../src/application/use-cases/sign-out.use-case";
|
|
import { signInController } from "../src/interface-adapters/controllers/sign-in.controller";
|
|
import { signUpController } from "../src/interface-adapters/controllers/sign-up.controller";
|
|
import { signOutController } from "../src/interface-adapters/controllers/sign-out.controller";
|
|
|
|
describe("auth feature: sign-up → sign-in → sign-out", () => {
|
|
it("a new user can sign up, then sign in, then sign out", async () => {
|
|
// Construct the full chain via direct injection
|
|
const users = new MockUsersRepository([]);
|
|
const auth = new MockAuthenticationService(users);
|
|
|
|
const signIn = signInController(
|
|
signInUseCase(users, auth, new NoopRateLimit()),
|
|
);
|
|
const signUp = signUpController(
|
|
signUpUseCase(users, auth, new RecordingEventBus(), undefined),
|
|
);
|
|
const signOut = signOutController(signOutUseCase(auth));
|
|
|
|
// signUp returns a cookie (presenter shape)
|
|
const signUpCookie = await signUp({
|
|
username: "newperson",
|
|
password: "verysecret",
|
|
confirmPassword: "verysecret",
|
|
});
|
|
expect(signUpCookie.name).toBe("session");
|
|
expect(signUpCookie.value).toBeTruthy();
|
|
|
|
const signInCookie = await signIn({
|
|
username: "newperson",
|
|
password: "verysecret",
|
|
});
|
|
expect(signInCookie.name).toBe("session");
|
|
expect(signInCookie.value).toBeTruthy();
|
|
|
|
// signOut takes { sessionId } and returns void
|
|
const signOutResult = await signOut({ sessionId: signInCookie.value });
|
|
expect(signOutResult).toBeUndefined();
|
|
});
|
|
});
|