From 1d011b78173defda8701a142ba7f4b4de5368e54 Mon Sep 17 00:00:00 2001 From: Jonathan Baldie Date: Thu, 23 Jul 2026 12:31:24 +0100 Subject: [PATCH 1/2] refactor: clear middleware quality gate --- src/middleware.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/middleware.ts b/src/middleware.ts index 62cb508..4707118 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -3,12 +3,12 @@ import { RateLimiter } from "./rate_limiter.ts"; export type HttpHandler = (request: Request, info?: Deno.ServeHandlerInfo) => Promise | Response; export type Middleware = (next: HttpHandler) => HttpHandler; -const healthPattern = new URLPattern({ pathname: "/health" }); +const HEALTH_PATTERN = new URLPattern({ pathname: "/health" }); export function withAuth(apiToken: string): Middleware { return (next: HttpHandler) => { return (request: Request, info?: Deno.ServeHandlerInfo) => { - if (healthPattern.exec(request.url)) { + if (HEALTH_PATTERN.exec(request.url)) { return next(request, info); } const authHeader = request.headers.get("Authorization"); @@ -23,7 +23,7 @@ export function withAuth(apiToken: string): Middleware { export function withRateLimit(limiter: RateLimiter): Middleware { return (next: HttpHandler) => { return (request: Request, info?: Deno.ServeHandlerInfo) => { - if (healthPattern.exec(request.url)) { + if (HEALTH_PATTERN.exec(request.url)) { return next(request, info); } const remoteAddr = info?.remoteAddr && info.remoteAddr.transport === "tcp" From be066167e46d3a3dcaa3a6d45ede3b96454963a5 Mon Sep 17 00:00:00 2001 From: Jonathan Baldie Date: Thu, 23 Jul 2026 12:35:54 +0100 Subject: [PATCH 2/2] test: prove rate limiting precedes authentication --- tests/handler_test.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/handler_test.ts b/tests/handler_test.ts index 7bf2fa3..e8a153a 100644 --- a/tests/handler_test.ts +++ b/tests/handler_test.ts @@ -241,6 +241,16 @@ Deno.test("response body: rate limited returns 'Too many requests'", async () => assertEquals(await res.text(), "Too many requests"); }); +Deno.test("middleware: rate limiting runs before authentication", async () => { + const handler = makeHandler(undefined, undefined, 1); + const firstResponse = await handler(new Request("http://localhost/length/q")); + const secondResponse = await handler(new Request("http://localhost/length/q")); + + assertEquals(firstResponse.status, 401); + assertEquals(secondResponse.status, 429); + assertEquals(await secondResponse.text(), "Too many requests"); +}); + Deno.test("response body: queues POST returns 'Method not allowed'", async () => { const handler = makeHandler(); const res = await handler(new Request("http://localhost/queues", { method: "POST", headers: auth }));