37 lines
1.3 KiB
PHP
37 lines
1.3 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
use App\Models\User;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* T6.1 — write-heavy booking/payment endpoints are throttled tighter than
|
||
|
|
* read-only catalog/routing endpoints (domain.md §8).
|
||
|
|
*/
|
||
|
|
test('the booking write limiter is tighter than the catalog read limiter', function () {
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$token = $user->createToken('test')->plainTextToken;
|
||
|
|
|
||
|
|
$readResponses = collect(range(1, 25))->map(
|
||
|
|
fn () => $this->withHeader('Authorization', "Bearer {$token}")->getJson('/api/v1/companies')
|
||
|
|
);
|
||
|
|
expect($readResponses->every(fn ($response) => $response->status() !== 429))->toBeTrue();
|
||
|
|
|
||
|
|
$writeResponses = collect(range(1, 25))->map(
|
||
|
|
fn () => $this->withHeader('Authorization', "Bearer {$token}")->postJson('/api/v1/bookings', [])
|
||
|
|
);
|
||
|
|
expect($writeResponses->contains(fn ($response) => $response->status() === 429))->toBeTrue();
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a rate-limited api request gets a 429 JSON envelope', function () {
|
||
|
|
$user = User::factory()->create();
|
||
|
|
$token = $user->createToken('test')->plainTextToken;
|
||
|
|
|
||
|
|
$responses = collect(range(1, 25))->map(
|
||
|
|
fn () => $this->withHeader('Authorization', "Bearer {$token}")->postJson('/api/v1/bookings', [])
|
||
|
|
);
|
||
|
|
|
||
|
|
$limited = $responses->first(fn ($response) => $response->status() === 429);
|
||
|
|
|
||
|
|
expect($limited)->not->toBeNull();
|
||
|
|
$limited->assertJsonStructure(['message']);
|
||
|
|
});
|