The data routes (purchases, alerts, stores, etc.) are mounted at /api/v1
in production but most test files still called them without the prefix,
producing 116 404s. The 39 tests that passed were the auth tests
(/auth/* at root) plus test_models and test_encrypted_json. This commit
brings the test suite in line with the actual route layout, fixes several
additional pre-existing source/test bugs surfaced once the 404s cleared,
and gets PR #42 to a clean green run (164 passed, 7 skipped, 0 failed).
Source fixes
- src/cartsnitch_api/auth/dependencies.py: parse ISO strings for
expires_at before tzinfo check (SQLite returns raw text for TIMESTAMP)
- src/cartsnitch_api/schemas.py: UserResponse.id is UUID, matching the
actual model type and avoiding ResponseValidationError on /auth/me
Test alignment
- tests/test_routes/*, tests/test_e2e/*: add /api/v1 prefix to all data
route calls (auth routes left alone — they live at root)
- tests/test_openapi.py: refresh EXPECTED_ROUTES to match the actual
OpenAPI spec (drop Better-Auth-only routes, add /api/v1 prefix,
update route count to 31)
Pre-existing test fixes
- tests/test_middleware/test_rate_limit.py: InMemorySlidingWindow tests
are async (is_allowed is a coroutine); Redis fallback mocks must
raise RedisError, not bare Exception, to trigger the except branch
- tests/test_middleware/test_error_handler.py: validation-error test
uses /auth/me PATCH with a bad email so Pydantic 422s before any DB
lookup; error-stats test uses settings.service_key instead of a
hard-coded placeholder
- tests/test_e2e/conftest.py: Coupon.valid_to is date.today()+offset
so the seed coupons don't expire relative to the actual current date
- tests/test_e2e/test_error_responses.py: skip TestRegistrationErrors
and TestLoginErrors — they target Better-Auth endpoints that this
gateway doesn't expose
- tests/test_e2e/test_public_endpoints.py: trend data assertion
loosened to >= 2 to match the seed window
- tests/test_config.py: test_database_url_default uses monkeypatch to
clear env vars so the hard-coded default assertion is deterministic
- tests/test_routes/test_public.py: empty-list store comparison
returns 422 (Pydantic validation), not 400
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add rate_limit_auth_requests (5/min) and rate_limit_auth_window_seconds (60) settings
- Add rate_limit_redis_enabled flag for opt-in Redis usage
- Refactor _SlidingWindowCounter into InMemorySlidingWindow class
- Add RedisSlidingWindow using sorted sets with fallback to in-memory
- Add third _auth_strict_limiter for POST /auth/* paths (5 req/min)
- Add protocol-based backend selection at module load time
- Update tests for auth strict limiter and Redis fallback behavior
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add rate_limit_auth_requests (5/min) and rate_limit_auth_window_seconds (60)
settings to config.py
- Refactor rate_limit.py to use protocol/ABC pattern with InMemorySlidingWindow
and RedisSlidingWindow implementations
- Add RedisSlidingWindow using sorted sets for distributed rate limiting
- Add auth_strict_limiter for /auth/* POST endpoints (5 req/min per IP)
- Fall back to in-memory when Redis is unavailable
- Update tests to cover new functionality
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Barcode Betty
Barcode Betty