fix rate-limit valid login bug and fix sessions of redis and psql in tests
This commit is contained in:
Vendored
+1
-2
@@ -19,8 +19,7 @@ class RateLimit:
|
||||
if attempts>5:
|
||||
raise self.errors.rate_limit_error(detail="too many attempts", retry_after=60)
|
||||
|
||||
async def check_rate_limit(self, request: Request) -> None:
|
||||
client_ip = request.headers.get('x-forwarded-for', '').split(',')[0].strip() or (request.client.host if request.client else 'unknown')
|
||||
async def check_rate_limit(self, client_ip:str) -> None:
|
||||
await self.rate_limit(client_ip)
|
||||
|
||||
|
||||
|
||||
@@ -17,7 +17,12 @@ from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column, relationship
|
||||
|
||||
from src.models.configs_read.env import env_settings
|
||||
|
||||
engine = create_async_engine(f"postgresql+asyncpg://{env_settings.DB_USER}:{env_settings.DB_PASSWORD}@{env_settings.DB_HOST}:{env_settings.DB_PORT}/{env_settings.DB_POSTGRESS}")
|
||||
engine = create_async_engine(f"postgresql+asyncpg://{env_settings.DB_USER}:{env_settings.DB_PASSWORD}@{env_settings.DB_HOST}:{env_settings.DB_PORT}/{env_settings.DB_POSTGRESS}",
|
||||
pool_size=20, # сколько соединений держать открытыми постоянно
|
||||
max_overflow=10, # сколько доп. соединений можно создать при пиковой нагрузке
|
||||
pool_timeout=30, # сколько ждать свободное соединение, прежде чем упасть с ошибкой
|
||||
pool_pre_ping=True, # проверять соединение перед использованием (ловит "протухшие" соединения)
|
||||
)
|
||||
|
||||
'''remember as a boilerplate, or just cp/pst'''
|
||||
class Model(DeclarativeBase):
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
from fastapi import APIRouter, Cookie, Depends, Request, Response
|
||||
from fastapi import APIRouter, Cookie, Depends, HTTPException, Request, Response
|
||||
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
|
||||
|
||||
from src.cache.rate_limit import rate_limiter
|
||||
@@ -24,10 +24,15 @@ async def get_access_token(request: Request,
|
||||
response:Response,
|
||||
auth:CurrentUserService=Depends(auth_service),
|
||||
form_data:OAuth2PasswordRequestForm=Depends(),
|
||||
_:None = Depends(rate_limiter.check_rate_limit)
|
||||
)->dict:
|
||||
|
||||
access_token, refresh_token=await auth.login(form_data_email=form_data.username, form_data_password=form_data.password, request=request)
|
||||
client_ip = request.headers.get('x-forwarded-for', '').split(',')[0].strip() or (request.client.host if request.client else 'unknown')
|
||||
|
||||
try:
|
||||
access_token, refresh_token=await auth.login(form_data_email=form_data.username, form_data_password=form_data.password, request=request)
|
||||
except HTTPException:
|
||||
await rate_limiter.rate_limit(client_ip)
|
||||
raise
|
||||
|
||||
response.set_cookie(
|
||||
key="refresh_token",
|
||||
|
||||
Reference in New Issue
Block a user