diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 00682de..b0a33a5 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -52,13 +52,13 @@ kics: - pip install --index-url "$PIP_INDEX_URL" pytest pytest-asyncio httpx script: - cd backend - # Run full integration test suite, excluding large/slow tests and auth-intensive tests - # Auth-intensive tests make many login requests which trigger rate limiting on deployed environments + # Run full integration test suite, excluding large/slow tests # ORCHARD_TEST_URL tells the tests which server to connect to + # Note: Auth tests work because dev/stage deployments have relaxed rate limits - | python -m pytest tests/integration/ -v \ --junitxml=integration-report.xml \ - -m "not large and not slow and not auth_intensive" \ + -m "not large and not slow" \ --tb=short artifacts: when: always diff --git a/CHANGELOG.md b/CHANGELOG.md index 87fa0c2..a3eb62b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,7 +81,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Improved pod naming: Orchard pods now named `orchard-{env}-server-*` for clarity (#51) ### Fixed -- Fixed CI integration test rate limiting: added `auth_intensive` marker and excluded auth-heavy tests from deployed environments +- Fixed CI integration test rate limiting: added configurable `ORCHARD_LOGIN_RATE_LIMIT` env var, relaxed to 1000/minute for dev/stage - Fixed duplicate `TestSecurityEdgeCases` class definition in test_auth_api.py - Fixed integration tests auth: session-scoped client, configurable credentials via env vars, fail-fast on auth errors - Fixed Content-Disposition header encoding for non-ASCII filenames using RFC 5987 (#38) diff --git a/backend/tests/integration/test_auth_api.py b/backend/tests/integration/test_auth_api.py index 9abf6ac..20ef881 100644 --- a/backend/tests/integration/test_auth_api.py +++ b/backend/tests/integration/test_auth_api.py @@ -1,15 +1,15 @@ """Integration tests for authentication API endpoints. Note: These tests are marked as auth_intensive because they make many login -requests which can trigger rate limiting on deployed environments. They are -excluded from CI integration tests but run in local and unit test suites. +requests. Dev/stage deployments have relaxed rate limits (1000/minute) to +allow these tests to run. Production uses strict rate limits (5/minute). """ import pytest from uuid import uuid4 -# Mark all tests in this module as auth_intensive +# Mark all tests in this module as auth_intensive (informational, not excluded from CI) pytestmark = pytest.mark.auth_intensive diff --git a/helm/orchard/templates/deployment.yaml b/helm/orchard/templates/deployment.yaml index 1353547..9c6acfc 100644 --- a/helm/orchard/templates/deployment.yaml +++ b/helm/orchard/templates/deployment.yaml @@ -110,6 +110,12 @@ spec: value: {{ .Values.orchard.download.mode | quote }} - name: ORCHARD_PRESIGNED_URL_EXPIRY value: {{ .Values.orchard.download.presignedUrlExpiry | quote }} + {{- if .Values.orchard.rateLimit }} + {{- if .Values.orchard.rateLimit.login }} + - name: ORCHARD_LOGIN_RATE_LIMIT + value: {{ .Values.orchard.rateLimit.login | quote }} + {{- end }} + {{- end }} livenessProbe: {{- toYaml .Values.livenessProbe | nindent 12 }} readinessProbe: diff --git a/helm/orchard/values-dev.yaml b/helm/orchard/values-dev.yaml index 2b461df..d47b4ec 100644 --- a/helm/orchard/values-dev.yaml +++ b/helm/orchard/values-dev.yaml @@ -113,6 +113,10 @@ orchard: mode: "presigned" presignedUrlExpiry: 3600 + # Relaxed rate limits for dev/feature environments (allows integration tests to run) + rateLimit: + login: "1000/minute" # Default is 5/minute, relaxed for CI integration tests + # PostgreSQL - ephemeral, no persistence postgresql: enabled: true diff --git a/helm/orchard/values-stage.yaml b/helm/orchard/values-stage.yaml index c702bcb..0c8f7bd 100644 --- a/helm/orchard/values-stage.yaml +++ b/helm/orchard/values-stage.yaml @@ -120,6 +120,10 @@ orchard: mode: "presigned" # presigned, redirect, or proxy presignedUrlExpiry: 3600 # Presigned URL expiry in seconds + # Relaxed rate limits for stage (allows CI integration tests to run) + rateLimit: + login: "1000/minute" # Default is 5/minute, relaxed for CI integration tests + # PostgreSQL subchart configuration postgresql: enabled: true