Test the API rate limiter's edges

Raised by: Theo (API platform) · Priority: Medium · Component: API gateway / rate limiting

Goal

Next sprint we're rewriting the rate limiter's storage so it can run across several gateway instances. Today it has four smoke tests. Last quarter a "harmless" change let one customer double their burst at every minute boundary, and support found out from the customer's invoice. Write tests that pin down the rules in README.md, so the rewrite can't quietly break them.

You are writing tests, not changing the code. Put them in tests/ (for example tests/test_limiter_rules.py). tests/conftest.py gives you a clock fixture: a fake monotonic clock you move with clock.advance(seconds). conftest.py itself can't be changed.

Requirements

Cover, through SlidingWindowLimiter and check_request:

• The window edge: a request stops counting exactly window_seconds after it was made, not before and not later.
• It is a sliding window: no double burst around a minute (or window) boundary.
• Budgets are per key: different API keys never share a budget, even from the same IP; anonymous requests are limited per IP.
• Rejected requests don't count against the client.
• 429 responses: Retry-After is the time until the oldest counted request ages out, in whole seconds rounded up; X-RateLimit-Remaining counts down correctly.

Acceptance

• Your tests must all pass on the current code; a test that fails on correct code scores zero.
• We run them against several realistic broken versions of the limiter. Each counts as caught when at least one of your tests fails on it. Your score is the share caught.
• Only test files count. Aim to finish in about 10 minutes.