senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(backend): use explicit DISABLE_RATE_LIMIT_FOR_TESTS flag instead of env-based bypass

Browse source 
Replace NODE_ENV/APP_ENV bypass with DISABLE_RATE_LIMIT_FOR_TESTS=true.
Only test runners should set this. Prevents rate limiting bypass when
APP_ENV=development is mistakenly used in production.
Phase 1 audit - P1.6
This commit is contained in:
senke 2026-02-15 15:56:53 +01:00
parent 35370330b5
commit 66ba082788
6 changed files with 12 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ENV_CONFIG.md
View file

@ -47,6 +47,9 @@ RABBITMQ_ENABLE=true
JWT_SECRET=your-secret-key-here-change-in-production
CORS_ALLOWED_ORIGINS=http://localhost:3000
# Rate limiting (P1.6): Use DISABLE_RATE_LIMIT_FOR_TESTS=true ONLY for automated test runners.
# Never set in production. When set, bypasses rate limiting for E2E/integration tests.
# Services
STREAM_SERVER_URL=http://localhost:8082
CHAT_SERVER_URL=http://localhost:8081

1
veza-backend-api/README.md
View file

@ -149,6 +149,7 @@ CHAT_SERVER_URL=http://localhost:8081 # URL Chat Server
# DEV/TEST UNIQUEMENT - Ne jamais utiliser en production
# CSRF_DISABLED=true # Désactive CSRF (dev/test seulement)
# BYPASS_CONTENT_CREATOR_ROLE=true # Bypass vérification rôle créateur (dev/test seulement)
# DISABLE_RATE_LIMIT_FOR_TESTS=true # Désactive rate limiting (E2E/integration tests seulement)
```
### Fichiers de Configuration

1
veza-backend-api/internal/config/testutils.go
View file

@ -60,6 +60,7 @@ func ResetEnv() {
"RATE_LIMIT_LIMIT",
"RATE_LIMIT_WINDOW",
"LOG_LEVEL",
"DISABLE_RATE_LIMIT_FOR_TESTS",
}
for _, v := range testVars {
os.Unsetenv(v)

14
veza-backend-api/internal/middleware/endpoint_limiter.go
View file

@ -171,18 +171,8 @@ func (el *EndpointLimiter) createEndpointLimit(
errorMessage string,
) gin.HandlerFunc {
return func(c *gin.Context) {
// Désactiver le rate limiting en mode test/e2e/development pour les tests E2E et développement.
// Utiliser uniquement les variables d'environnement (jamais de headers contrôlables par le client).
if os.Getenv("GO_ENV") == "test" ||
os.Getenv("GO_ENV") == "e2e" ||
os.Getenv("GO_ENV") == "development" ||
os.Getenv("E2E_TEST") == "true" ||
os.Getenv("NODE_ENV") == "test" ||
os.Getenv("NODE_ENV") == "e2e" ||
os.Getenv("NODE_ENV") == "development" ||
os.Getenv("APP_ENV") == "test" ||
os.Getenv("APP_ENV") == "e2e" ||
os.Getenv("APP_ENV") == "development" {
// P1.6: Use explicit DISABLE_RATE_LIMIT_FOR_TESTS flag instead of env-based bypass.
if os.Getenv("DISABLE_RATE_LIMIT_FOR_TESTS") == "true" {
c.Next()
return
}

11
veza-backend-api/internal/middleware/rate_limiter.go
View file

@ -96,14 +96,9 @@ func (rl *RateLimiter) RateLimitMiddleware() gin.HandlerFunc {
return
}
// Désactiver le rate limiting en mode test/e2e/development pour les tests E2E et développement.
// Utiliser uniquement les variables d'environnement (jamais de headers contrôlables par le client).
if os.Getenv("NODE_ENV") == "test" ||
os.Getenv("NODE_ENV") == "e2e" ||
os.Getenv("NODE_ENV") == "development" ||
os.Getenv("APP_ENV") == "test" ||
os.Getenv("APP_ENV") == "e2e" ||
os.Getenv("APP_ENV") == "development" {
// P1.6: Use explicit DISABLE_RATE_LIMIT_FOR_TESTS flag instead of env-based bypass.
// Only test runners should set this. Never use in production.
if os.Getenv("DISABLE_RATE_LIMIT_FOR_TESTS") == "true" {
c.Next()
return
}

10
veza-backend-api/internal/middleware/ratelimit.go
View file

@ -75,14 +75,8 @@ func (rl *SimpleRateLimiter) Middleware() gin.HandlerFunc {
return
}
// Désactiver le rate limiting en mode test/e2e/development pour les tests E2E et développement.
// Utiliser uniquement les variables d'environnement (jamais de headers contrôlables par le client).
if os.Getenv("NODE_ENV") == "test" ||
os.Getenv("NODE_ENV") == "e2e" ||
os.Getenv("NODE_ENV") == "development" ||
os.Getenv("APP_ENV") == "test" ||
os.Getenv("APP_ENV") == "e2e" ||
os.Getenv("APP_ENV") == "development" {
// P1.6: Use explicit DISABLE_RATE_LIMIT_FOR_TESTS flag instead of env-based bypass.
if os.Getenv("DISABLE_RATE_LIMIT_FOR_TESTS") == "true" {
c.Next()
return
}