baodev0andClaude Opus 5.5
e888a6ed5d
- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
37 lines
1.2 KiB
PHP
37 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Support;
|
|
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Tests\TestCase;
|
|
|
|
class RegisterThrottleTest extends TestCase
|
|
{
|
|
private function limitsFor(string $routeName): mixed
|
|
{
|
|
$route = Route::getRoutes()->getByName($routeName);
|
|
$request = Request::create('/' . $route->uri(), 'POST', ['email' => 'a@example.com'], [], [], ['REMOTE_ADDR' => '9.9.9.9']);
|
|
$request->setRouteResolver(fn () => $route);
|
|
|
|
return RateLimiter::limiter('client-auth')($request);
|
|
}
|
|
|
|
public function test_email_sending_routes_are_limited_per_ip_across_emails(): void
|
|
{
|
|
foreach (['api.client.register' => 5, 'api.client.resend-verify' => 10] as $name => $max) {
|
|
$limits = $this->limitsFor($name);
|
|
|
|
$this->assertCount(2, $limits);
|
|
$this->assertSame($name . '|ip|9.9.9.9', $limits[1]->key);
|
|
$this->assertSame($max, $limits[1]->maxAttempts);
|
|
}
|
|
}
|
|
|
|
public function test_other_auth_routes_keep_single_email_limit(): void
|
|
{
|
|
$this->assertInstanceOf(\Illuminate\Cache\RateLimiting\Limit::class, $this->limitsFor('api.client.login'));
|
|
}
|
|
}
|