···

       
190
       
 
       
		serverTest("should enforce rate limiting on registration", async () => {

     

       
191
       
 
       
			const hashedPassword = await clientHashPassword("test@example.com", "password");

     

       
192
       
 
       


     

       
193
       
-
       
			// Make 6 registration attempts (limit is 5 per hour)

     

       
194
       
-
       
			for (let i = 0; i < 6; i++) {

     

       
0
       
 
       

     

       
195
       
 
       
				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       
196
       
 
       
					method: "POST",

     

       
197
       
 
       
					headers: { "Content-Type": "application/json" },

     
···

       
201
       
 
       
					}),

     

       
202
       
 
       
				});

     

       
203
       
 
       


     

       
204
       
-
       
				if (i < 5) {

     

       
205
       
-
       
					expect(response.status).toBeLessThan(429);

     

       
206
       
-
       
				} else {

     

       
207
       
-
       
					expect(response.status).toBe(429);

     

       
208
       
 
       
				}

     

       
209
       
 
       
			}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
210
       
 
       
		});

     

       
211
       
 
       
	});

     

       
212
       
 
       


     
···

       
287
       
 
       
			const hashedPassword = await clientHashPassword(TEST_USER.email, TEST_USER.password);

     

       
288
       
 
       


     

       
289
       
 
       
			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       
0
       
 
       

     

       
290
       
 
       
			for (let i = 0; i < 11; i++) {

     

       
291
       
 
       
				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       
292
       
 
       
					method: "POST",

     
···

       
297
       
 
       
					}),

     

       
298
       
 
       
				});

     

       
299
       
 
       


     

       
300
       
-
       
				if (i < 10) {

     

       
301
       
-
       
					expect(response.status).toBeLessThan(429);

     

       
302
       
-
       
				} else {

     

       
303
       
-
       
					expect(response.status).toBe(429);

     

       
304
       
 
       
				}

     

       
305
       
 
       
			}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
306
       
 
       
		});

     

       
307
       
 
       
	});

     

       
308
       
 
       


     
···

       
878
       
 
       
			});

     

       
879
       
 
       
			const sessionCookie = extractSessionCookie(registerResponse)!;

     

       
880
       
 
       


     

       
881
       
-
       
			// Create a file larger than 25MB (the limit)

     

       
882
       
-
       
			const largeBlob = new Blob([new ArrayBuffer(26 * 1024 * 1024)], { type: "audio/mp3" });

     

       
883
       
 
       
			const formData = new FormData();

     

       
884
       
 
       
			formData.append("audio", largeBlob, "large.mp3");

     

       
885
       
 
       


     
···

       
889
       
 
       
			});

     

       
890
       
 
       


     

       
891
       
 
       
			expect(response.status).toBe(400);

     

       
0
       
 
       

     

       
0
       
 
       

     

       
892
       
 
       
		});

     

       
893
       
 
       


     

       
894
       
 
       
		serverTest("should require authentication", async () => {

     

···

       
190
       
 
       
		serverTest("should enforce rate limiting on registration", async () => {

     

       
191
       
 
       
			const hashedPassword = await clientHashPassword("test@example.com", "password");

     

       
192
       
 
       


     

       
193
       
+
       
			// Make registration attempts until rate limit is hit (limit is 5 per hour)

     

       
194
       
+
       
			let rateLimitHit = false;

     

       
195
       
+
       
			for (let i = 0; i < 10; i++) {

     

       
196
       
 
       
				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       
197
       
 
       
					method: "POST",

     

       
198
       
 
       
					headers: { "Content-Type": "application/json" },

     
···

       
202
       
 
       
					}),

     

       
203
       
 
       
				});

     

       
204
       
 
       


     

       
205
       
+
       
				if (response.status === 429) {

     

       
206
       
+
       
					rateLimitHit = true;

     

       
207
       
+
       
					break;

     

       
0
       
 
       

     

       
208
       
 
       
				}

     

       
209
       
 
       
			}

     

       
210
       
+
       


     

       
211
       
+
       
			// Verify that rate limiting was triggered

     

       
212
       
+
       
			expect(rateLimitHit).toBe(true);

     

       
213
       
 
       
		});

     

       
214
       
 
       
	});

     

       
215
       
 
       


     
···

       
290
       
 
       
			const hashedPassword = await clientHashPassword(TEST_USER.email, TEST_USER.password);

     

       
291
       
 
       


     

       
292
       
 
       
			// Make 11 login attempts (limit is 10 per 15 minutes per IP)

     

       
293
       
+
       
			let rateLimitHit = false;

     

       
294
       
 
       
			for (let i = 0; i < 11; i++) {

     

       
295
       
 
       
				const response = await fetch(`${BASE_URL}/api/auth/login`, {

     

       
296
       
 
       
					method: "POST",

     
···

       
301
       
 
       
					}),

     

       
302
       
 
       
				});

     

       
303
       
 
       


     

       
304
       
+
       
				if (response.status === 429) {

     

       
305
       
+
       
					rateLimitHit = true;

     

       
306
       
+
       
					break;

     

       
0
       
 
       

     

       
307
       
 
       
				}

     

       
308
       
 
       
			}

     

       
309
       
+
       


     

       
310
       
+
       
			// Verify that rate limiting was triggered

     

       
311
       
+
       
			expect(rateLimitHit).toBe(true);

     

       
312
       
 
       
		});

     

       
313
       
 
       
	});

     

       
314
       
 
       


     
···

       
884
       
 
       
			});

     

       
885
       
 
       
			const sessionCookie = extractSessionCookie(registerResponse)!;

     

       
886
       
 
       


     

       
887
       
+
       
			// Create a file larger than 100MB (the actual limit)

     

       
888
       
+
       
			const largeBlob = new Blob([new ArrayBuffer(101 * 1024 * 1024)], { type: "audio/mp3" });

     

       
889
       
 
       
			const formData = new FormData();

     

       
890
       
 
       
			formData.append("audio", largeBlob, "large.mp3");

     

       
891
       
 
       


     
···

       
895
       
 
       
			});

     

       
896
       
 
       


     

       
897
       
 
       
			expect(response.status).toBe(400);

     

       
898
       
+
       
			const data = await response.json();

     

       
899
       
+
       
			expect(data.error).toContain("File size must be less than");

     

       
900
       
 
       
		});

     

       
901
       
 
       


     

       
902
       
 
       
		serverTest("should require authentication", async () => {

     

···

       
981
       
 
       
					}

     

       
982
       
 
       


     

       
983
       
 
       
					if (file.size > MAX_FILE_SIZE) {

     

       
984
       
-
       
						throw ValidationErrors.fileTooLarge("25MB");

     

       
985
       
 
       
					}

     

       
986
       
 
       


     

       
987
       
 
       
					// Generate unique filename

     

···

       
981
       
 
       
					}

     

       
982
       
 
       


     

       
983
       
 
       
					if (file.size > MAX_FILE_SIZE) {

     

       
984
       
+
       
						throw ValidationErrors.fileTooLarge("100MB");

     

       
985
       
 
       
					}

     

       
986
       
 
       


     

       
987
       
 
       
					// Generate unique filename