Skip to content

Test: add IT scenario for match condition on keyExtraction for advanced-ratelimit policy #3325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Saadha123 wants to merge 5 commits into
base: main
Choose a base branch
from
+290 −1
Open

Test: add IT scenario for match condition on keyExtraction for advanced-ratelimit policy #3325

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7b9ba7c
test(ratelimit): add IT scenario for match condition on keyExtraction
Saadha123 Aug 28, 2026
9c56799
test(ratelimit): add IT scenario for authproperty keyExtraction type
Saadha123 Sep 2, 2026
d1059c0
chore: bump advanced-ratelimit to released v1.2.0
Saadha123 Sep 2, 2026
bac419e
test(ratelimit): add IT scenarios for filter-by-app/count-by-user and…
Saadha123 Sep 3, 2026
1dcabcd
test(ratelimit): assert a 4th non-matching request also bypasses the …
Saadha123 Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 133 additions & 0 deletions gateway/it/features/ratelimit.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,6 +757,139 @@ Feature: Rate Limiting
When I send a GET request to "http://localhost:8080/ratelimit-peruser/v1.0/user" with header "X-User-ID" value "user-B"
Then the response status code should be 429

Scenario: Match condition restricts a quota to requests with a matching key value
Given I authenticate using basic auth as "admin"
When I deploy this API configuration:
"""
apiVersion: gateway.api-platform.wso2.com/v1
kind: RestApi
metadata:
name: ratelimit-match-api
spec:
displayName: RateLimit Match API
version: v1.0
context: /ratelimit-match/$version
upstream:
main:
url: http://sample-backend:9080/api/v1
operations:
- method: GET
path: /checkout
policies:
- name: advanced-ratelimit
version: v1
params:
quotas:
- name: guest-and-partner-checkout
limits:
- limit: 3
duration: "1h"
keyExtraction:
- type: header
key: X-App-ID
match:
type: regex
value: "^(guest-.*|channel-partner)$"
"""
Then the response should be successful
And I wait for the endpoint "http://localhost:8080/ratelimit-match/v1.0/checkout" to be ready

# A matching client ID (guest-*) is counted and enforced
When I send 3 GET requests to "http://localhost:8080/ratelimit-match/v1.0/checkout" with header "X-App-ID" value "guest-42"
Then the response status code should be 200

When I send a GET request to "http://localhost:8080/ratelimit-match/v1.0/checkout" with header "X-App-ID" value "guest-42"
Then the response status code should be 429

# A different matching client ID (exact match) gets its own separate bucket
When I send 3 GET requests to "http://localhost:8080/ratelimit-match/v1.0/checkout" with header "X-App-ID" value "channel-partner"
Then the response status code should be 200

When I send a GET request to "http://localhost:8080/ratelimit-match/v1.0/checkout" with header "X-App-ID" value "channel-partner"
Then the response status code should be 429

# A non-matching client ID bypasses the quota entirely - never throttled, no matter how many requests
When I send 6 GET requests to "http://localhost:8080/ratelimit-match/v1.0/checkout" with header "X-App-ID" value "internal-app-1"
Then the response status code should be 200

Scenario: authproperty keyExtraction with match restricts a quota to requests with a matching JWT claim
Given I authenticate using basic auth as "admin"
When I deploy this API configuration:
"""
apiVersion: gateway.api-platform.wso2.com/v1
kind: RestApi
metadata:
name: ratelimit-authproperty-api
spec:
displayName: RateLimit AuthProperty API
version: v1.0
context: /ratelimit-authproperty/$version
upstream:
main:
url: http://sample-backend:9080/api/v1
operations:
- method: GET
path: /checkout
policies:
- name: jwt-auth
version: v1
params:
issuers:
- mock-jwks
- name: advanced-ratelimit
version: v1
params:
quotas:
- name: guest-and-partner-checkout
limits:
- limit: 3
duration: "1h"
keyExtraction:
- type: authproperty
key: app_id
match:
type: regex
value: "^(guest-.*|channel-partner)$"
"""
Then the response should be successful

# A JWT with a matching app_id claim is counted and enforced
When I get a JWT token from the mock JWKS server with issuer "http://mock-jwks:8080/token" and claims "app_id=guest-42"
And I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 429

# A different matching app_id claim (exact match) gets its own separate bucket
When I get a JWT token from the mock JWKS server with issuer "http://mock-jwks:8080/token" and claims "app_id=channel-partner"
And I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 429

# A non-matching app_id claim bypasses the quota entirely - never throttled, no matter how many requests
When I get a JWT token from the mock JWKS server with issuer "http://mock-jwks:8080/token" and claims "app_id=internal-app-1"
And I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200
When I send a GET request to "http://localhost:8080/ratelimit-authproperty/v1.0/checkout" with the JWT token
Then the response status code should be 200

Scenario: Multiple limits per quota - enforces most restrictive limit
Given I authenticate using basic auth as "admin"
When I deploy this API configuration:
Expand Down
Loading