chore: initial project import

backend/tests/Monitor.Backend.Tests/LoginRateLimitTests.cs

@@ -0,0 +1,49 @@
+using System.Net;
+using System.Text.Json.Nodes;
+
+namespace Monitor.Backend.Tests;
+
+/// <summary>登录限流按来源地址计，会影响同一地址上的其他登录，所以用独立的后端实例。</summary>
+public sealed class LoginRateLimitTests : IClassFixture<StrictLoginFixture>
+{
+    private readonly StrictLoginFixture _backend;
+
+    public LoginRateLimitTests(StrictLoginFixture backend)
+    {
+        _backend = backend;
+    }
+
+    [Fact]
+    public async Task LoginAttempts_AreRateLimited_WithRetryAfter_AndASuccessfulLoginIsAlsoCounted()
+    {
+        using HttpClient client = _backend.NewClient();
+        HttpResponseMessage? limited = null;
+        int attempts = 0;
+        for (; attempts < 15 && limited is null; attempts++)
+        {
+            HttpResponseMessage response = await client.PostAsync("/api/admin/auth/login", BackendFixture.Json(new JsonObject { ["username"] = "admin", ["password"] = "wrong" }));
+            if (response.StatusCode == HttpStatusCode.TooManyRequests)
+            {
+                limited = response;
+            }
+            else
+            {
+                Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+                response.Dispose();
+            }
+        }
+
+        Assert.NotNull(limited);
+        using (limited)
+        {
+            // 前一次登录（创建管理员令牌）也占了一次配额：第 10 次之内的都是 401
+            Assert.InRange(attempts, 9, 10);
+            Assert.Equal("too_many_requests", JsonNode.Parse(await limited.Content.ReadAsStringAsync())!["code"]!.GetValue<string>());
+            Assert.True(limited.Headers.RetryAfter!.Delta!.Value.TotalSeconds is >= 1 and <= 60);
+        }
+
+        // 被限流的来源连正确的密码也不行：限流发生在校验密码之前，不能被用来猜密码
+        using HttpResponseMessage correct = await client.PostAsync("/api/admin/auth/login", BackendFixture.Json(new JsonObject { ["username"] = BackendFixture.AdminUser, ["password"] = BackendFixture.AdminPassword }));
+        Assert.Equal(HttpStatusCode.TooManyRequests, correct.StatusCode);
+    }
+}