From 4a5719311be4936e4635303f060e9ef9a112f4b7 Mon Sep 17 00:00:00 2001 From: curo1305 Date: Thu, 4 Jun 2026 23:11:23 +0200 Subject: [PATCH] fix(06): WR-01 reset auth_limiter between tests to prevent 429 cross-contamination Add auth_limiter (IP-level limiter from api.auth) to the reset_rate_limiter autouse fixture in conftest.py, alongside the existing account_limiter reset. Prevents spurious 429s when tests call /api/auth/* endpoints in a tight loop. Co-Authored-By: Claude Sonnet 4.6 --- backend/tests/conftest.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py index e01b489..5895e89 100644 --- a/backend/tests/conftest.py +++ b/backend/tests/conftest.py @@ -161,14 +161,17 @@ async def async_client(db_session: AsyncSession): def reset_rate_limiter(): """Reset the in-memory rate limiter storage before each test. - The account_limiter is a module-level singleton using MemoryStorage. - Without this fixture, rate limit counters accumulate across tests in the - same process and cause unrelated tests to receive 429 responses. + Resets both account_limiter (per-user) and auth_limiter (IP-level) so + that tight test loops against /api/auth/* do not accumulate counters and + cause spurious 429 failures in later tests. """ from services.rate_limiting import account_limiter + from api.auth import limiter as auth_limiter account_limiter._storage.reset() + auth_limiter._storage.reset() yield account_limiter._storage.reset() + auth_limiter._storage.reset() # ── File fixtures ─────────────────────────────────────────────────────────────