hamedandClaude Opus 4.8
61ac775175
- M10 GET /settlement: was unbounded; add page/limit + countByUser + data.meta.
- M11 GET /admin/comments/pending: paginate findPending + countPending.
- M12 GET /comments/{doctor}: paginate the fetch-joined roots query via
Paginator(fetchJoinCollection) + countApprovedRootsByDoctor.
All keep the existing { data: { data: [...] } } envelope and add data.meta
(backward compatible). Default limit 50 / max 100.
Regressions: SettlementListPaginationTest, CommentPaginationTest (both fail
without the limits). Also de-flaked SendCodeMobileRateLimitTest (randomised the
IP block so the persistent per-IP limiter buckets don't accumulate across runs).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.4 KiB
PHP
38 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Auth;
|
|
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* send-code must cap requests per mobile number, not only per IP — otherwise a
|
|
* victim's number can be SMS-flooded from rotating IPs.
|
|
*/
|
|
class SendCodeMobileRateLimitTest extends ApiTestCase
|
|
{
|
|
public function testPerMobileCapHoldsAcrossDifferentIps(): void
|
|
{
|
|
$this->client->disableReboot();
|
|
$mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
|
|
// a fresh random IP block per run so the persistent per-IP limiter buckets
|
|
// don't accumulate across runs and fire early.
|
|
$ipBase = random_int(1, 250);
|
|
|
|
$statuses = [];
|
|
for ($i = 0; $i < 6; $i++) {
|
|
// each request from a different IP → the per-IP limiter never fires
|
|
$this->client->request(
|
|
'POST',
|
|
'/api/v1/user/send-code',
|
|
server: ['REMOTE_ADDR' => "10.$ipBase.30.$i", 'CONTENT_TYPE' => 'application/json'],
|
|
content: json_encode(['mobile' => $mobile]),
|
|
);
|
|
$statuses[] = $this->client->getResponse()->getStatusCode();
|
|
}
|
|
|
|
// send_code limit is 5/hour → the 6th for the same mobile is rejected
|
|
$this->assertSame(429, $statuses[5], 'per-mobile cap not enforced: ' . implode(',', $statuses));
|
|
$this->assertNotContains(429, array_slice($statuses, 0, 5));
|
|
}
|
|
}
|