Merge pull request #115 from openqj/feat-rate-limit-retry-after

429 限流加 Retry-After 头

cloud/tests/test_prod_webhook_exec.py

@@ -255,6 +255,35 @@ class WebhookExecTestCase(unittest.TestCase):
         self.assertEqual(status, 429)
         self.assertEqual(body, {"error": "rate_limited"})
 
+    def test_rate_limit_429_has_retry_after_window_seconds(self):
+        # 429 响应必须含 Retry-After 头，且值为限流窗口秒数
+        # （limiter.window_seconds），不是硬编码 60：先用默认
+        # 窗口 60 验一次，再用注入窗口 7 验一次。
+        for window, per_minute in ((60, 1), (7, 1)):
+            self.server.rate_limiter = RateLimiter(
+                per_minute=per_minute, window_seconds=window)
+            self.server.rate_limit_per_minute = per_minute
+            self.server.rate_limit_window_seconds = window
+            conn = http.client.HTTPConnection(
+                "127.0.0.1", self.port, timeout=10)
+            try:
+                conn.request("GET", "/projects",
+                             headers={"X-API-Key": self.owner_key})
+                resp = conn.getresponse()
+                resp.read()
+                self.assertEqual(resp.status, 200)
+                conn.request("GET", "/projects",
+                             headers={"X-API-Key": self.owner_key})
+                resp = conn.getresponse()
+                body = resp.read()
+                self.assertEqual(resp.status, 429)
+                self.assertEqual(json.loads(body.decode("utf-8")),
+                                 {"error": "rate_limited"})
+                self.assertEqual(resp.getheader("Retry-After"),
+                                 str(window))
+            finally:
+                conn.close()
+
     def test_health_backend_and_db_ok_and_metrics_by_status(self):
         status, body = self._req("GET", "/health")
         self.assertEqual(status, 200)