diff --git a/tests/api/test_auth.py b/tests/api/test_auth.py
index c0ed64f784..1b0a815757 100644
--- a/tests/api/test_auth.py
+++ b/tests/api/test_auth.py
@@ -21,13 +21,11 @@ from synapse.api.constants import UserTypes
from synapse.api.errors import (
AuthError,
Codes,
- InvalidClientCredentialsError,
InvalidClientTokenError,
MissingClientTokenError,
ResourceLimitError,
)
from synapse.storage.databases.main.registration import TokenLookupResult
-from synapse.types import UserID
from tests import unittest
from tests.test_utils import simple_async_mock
@@ -253,67 +251,6 @@ class AuthTestCase(unittest.HomeserverTestCase):
self.assertTrue(user_info.is_guest)
self.store.get_user_by_id.assert_called_with(user_id)
- def test_cannot_use_regular_token_as_guest(self):
- USER_ID = "@percy:matrix.org"
- self.store.add_access_token_to_user = simple_async_mock(None)
- self.store.get_device = simple_async_mock(None)
-
- token = self.get_success(
- self.hs.get_auth_handler().get_access_token_for_user_id(
- USER_ID, "DEVICE", valid_until_ms=None
- )
- )
- self.store.add_access_token_to_user.assert_called_with(
- user_id=USER_ID,
- token=token,
- device_id="DEVICE",
- valid_until_ms=None,
- puppets_user_id=None,
- )
-
- async def get_user(tok):
- if token != tok:
- return None
- return TokenLookupResult(
- user_id=USER_ID,
- is_guest=False,
- token_id=1234,
- device_id="DEVICE",
- )
-
- self.store.get_user_by_access_token = get_user
- self.store.get_user_by_id = simple_async_mock({"is_guest": False})
-
- # check the token works
- request = Mock(args={})
- request.args[b"access_token"] = [token.encode("ascii")]
- request.requestHeaders.getRawHeaders = mock_getRawHeaders()
- requester = self.get_success(
- self.auth.get_user_by_req(request, allow_guest=True)
- )
- self.assertEqual(UserID.from_string(USER_ID), requester.user)
- self.assertFalse(requester.is_guest)
-
- # add an is_guest caveat
- mac = pymacaroons.Macaroon.deserialize(token)
- mac.add_first_party_caveat("guest = true")
- guest_tok = mac.serialize()
-
- # the token should *not* work now
- request = Mock(args={})
- request.args[b"access_token"] = [guest_tok.encode("ascii")]
- request.requestHeaders.getRawHeaders = mock_getRawHeaders()
-
- cm = self.get_failure(
- self.auth.get_user_by_req(request, allow_guest=True),
- InvalidClientCredentialsError,
- )
-
- self.assertEqual(401, cm.value.code)
- self.assertEqual("Guest access token used for regular user", cm.value.msg)
-
- self.store.get_user_by_id.assert_called_with(USER_ID)
-
def test_blocking_mau(self):
self.auth_blocking._limit_usage_by_mau = False
self.auth_blocking._max_mau_value = 50
diff --git a/tests/api/test_ratelimiting.py b/tests/api/test_ratelimiting.py
index fa96ba07a5..dcf0110c16 100644
--- a/tests/api/test_ratelimiting.py
+++ b/tests/api/test_ratelimiting.py
@@ -230,3 +230,60 @@ class TestRatelimiter(unittest.HomeserverTestCase):
# Shouldn't raise
for _ in range(20):
self.get_success_or_raise(limiter.ratelimit(requester, _time_now_s=0))
+
+ def test_multiple_actions(self):
+ limiter = Ratelimiter(
+ store=self.hs.get_datastore(), clock=None, rate_hz=0.1, burst_count=3
+ )
+ # Test that 4 actions aren't allowed with a maximum burst of 3.
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(None, key="test_id", n_actions=4, _time_now_s=0)
+ )
+ self.assertFalse(allowed)
+
+ # Test that 3 actions are allowed with a maximum burst of 3.
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(None, key="test_id", n_actions=3, _time_now_s=0)
+ )
+ self.assertTrue(allowed)
+ self.assertEquals(10.0, time_allowed)
+
+ # Test that, after doing these 3 actions, we can't do any more action without
+ # waiting.
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(None, key="test_id", n_actions=1, _time_now_s=0)
+ )
+ self.assertFalse(allowed)
+ self.assertEquals(10.0, time_allowed)
+
+ # Test that after waiting we can do only 1 action.
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(
+ None,
+ key="test_id",
+ update=False,
+ n_actions=1,
+ _time_now_s=10,
+ )
+ )
+ self.assertTrue(allowed)
+ # The time allowed is the current time because we could still repeat the action
+ # once.
+ self.assertEquals(10.0, time_allowed)
+
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(None, key="test_id", n_actions=2, _time_now_s=10)
+ )
+ self.assertFalse(allowed)
+ # The time allowed doesn't change despite allowed being False because, while we
+ # don't allow 2 actions, we could still do 1.
+ self.assertEquals(10.0, time_allowed)
+
+ # Test that after waiting a bit more we can do 2 actions.
+ allowed, time_allowed = self.get_success_or_raise(
+ limiter.can_do_action(None, key="test_id", n_actions=2, _time_now_s=20)
+ )
+ self.assertTrue(allowed)
+ # The time allowed is the current time because we could still repeat the action
+ # once.
+ self.assertEquals(20.0, time_allowed)
|
