kin: BATON-ARCH-010 Написать unit-тесты бэкенда (tester FAILED без вывода)

backend/main.py

@@ -13,7 +13,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 
 from backend import config, db, telegram
-from backend.middleware import verify_webhook_secret
+from backend.middleware import rate_limit_register, verify_webhook_secret
 from backend.models import (
     RegisterRequest,
     RegisterResponse,
@@ -45,6 +45,7 @@ async def _keep_alive_loop(app_url: str) -> None:
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     # Startup
+    app.state.rate_counters = {}
     await db.init_db()
     logger.info("Database initialized")
 
@@ -100,7 +101,7 @@ async def health() -> dict[str, Any]:
 
 
 @app.post("/api/register", response_model=RegisterResponse)
-async def register(body: RegisterRequest) -> RegisterResponse:
+async def register(body: RegisterRequest, _: None = Depends(rate_limit_register)) -> RegisterResponse:
     result = await db.register_user(uuid=body.uuid, name=body.name)
     return RegisterResponse(user_id=result["user_id"], uuid=result["uuid"])
 

backend/middleware.py

@@ -1,12 +1,34 @@
 from __future__ import annotations
 
-from fastapi import Header, HTTPException
+import secrets
+import time
+
+from fastapi import Header, HTTPException, Request
 
 from backend import config
 
+_RATE_LIMIT = 5
+_RATE_WINDOW = 600  # 10 minutes
+
 
 async def verify_webhook_secret(
     x_telegram_bot_api_secret_token: str = Header(default=""),
 ) -> None:
-    if x_telegram_bot_api_secret_token != config.WEBHOOK_SECRET:
+    if not secrets.compare_digest(
+        x_telegram_bot_api_secret_token, config.WEBHOOK_SECRET
+    ):
         raise HTTPException(status_code=403, detail="Forbidden")
+
+
+async def rate_limit_register(request: Request) -> None:
+    counters = request.app.state.rate_counters
+    client_ip = request.client.host if request.client else "unknown"
+    now = time.time()
+    count, window_start = counters.get(client_ip, (0, now))
+    if now - window_start >= _RATE_WINDOW:
+        count = 0
+        window_start = now
+    count += 1
+    counters[client_ip] = (count, window_start)
+    if count > _RATE_LIMIT:
+        raise HTTPException(status_code=429, detail="Too Many Requests")