chore: add ci/cd

Author: fiqrikm18

src/core/dependency/rate_limit.py

@@ -1,4 +1,6 @@
-from fastapi import Request
+from types import SimpleNamespace
+
+from fastapi import Request, Response
 from fastapi_limiter import FastAPILimiter
 from fastapi_limiter.depends import RateLimiter
 
@@ -20,6 +22,31 @@
 settings = get_settings()
 
 
+def _rate_limiter_request(request: Request) -> Request:
+    if "app" not in request.scope:
+        return request
+
+    routes = []
+    for route in request.app.routes:
+        if hasattr(route, "path") and hasattr(route, "methods"):
+            routes.append(route)
+            continue
+
+        effective_route_contexts = getattr(route, "effective_route_contexts", None)
+        if effective_route_contexts is None:
+            continue
+
+        routes.extend(
+            nested_route
+            for nested_route in effective_route_contexts()
+            if hasattr(nested_route, "path") and hasattr(nested_route, "methods")
+        )
+
+    scope = dict(request.scope)
+    scope["app"] = SimpleNamespace(routes=routes)
+    return Request(scope, receive=request.receive)
+
+
 async def custom_identifier(request: Request) -> str:
     """Smart identifier: User ID > Proxy IP > Direct IP"""
     user_id = getattr(request.state, "user_id", None)
@@ -46,7 +73,7 @@ async def close_rate_limiter():
     await redis_client.aclose()
 
 
-async def apply_global_rate_limit(request: Request):
+async def apply_global_rate_limit(request: Request, response: Response):
     if request.url.path in EXEMPT_PATHS:
         return
 
@@ -56,4 +83,4 @@ async def apply_global_rate_limit(request: Request):
     seconds = 60 if "minute" in period else 1
 
     limiter = RateLimiter(times=times, seconds=seconds)
-    await limiter(request)
+    await limiter(_rate_limiter_request(request), response)

tests/core/test_security_todo.py

@@ -1,11 +1,11 @@
 import pytest
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, Response
 
 from src.core.bootstrap.exception import register_exception
 from src.core.bootstrap.middleware import register_middleware
 from src.core.config.setting import Settings
 from src.core.dependency import rate_limit as rate_limit_module
-from src.core.dependency.rate_limit import apply_global_rate_limit
+from src.core.dependency.rate_limit import apply_global_rate_limit, custom_identifier
 from src.core.exceptions.handler import (
     DOMAIN_EXCEPTION_MAP,
     domain_exception_handler,
@@ -23,7 +23,7 @@ def __init__(self, times: int, seconds: int):
             self.seconds = seconds
             created_limiters.append(self)
 
-        async def __call__(self, request):
+        async def __call__(self, request, response):
             return None
 
     request = Request(
@@ -44,12 +44,79 @@ async def __call__(self, request):
 
     import asyncio
 
-    asyncio.run(apply_global_rate_limit(request))
+    asyncio.run(apply_global_rate_limit(request, Response()))
 
     assert created_limiters[0].times == 42
     assert created_limiters[0].seconds == 60
 
 
+def test_rate_limit_passes_response_to_limiter(monkeypatch):
+    limiter_calls = []
+
+    class FakeLimiter:
+        def __init__(self, times: int, seconds: int):
+            self.times = times
+            self.seconds = seconds
+
+        async def __call__(self, request, response):
+            limiter_calls.append((request, response))
+
+    request = Request(
+        {
+            "type": "http",
+            "method": "GET",
+            "path": "/api/v1/todos/",
+            "headers": [],
+            "query_string": b"",
+            "server": ("testserver", 80),
+            "scheme": "http",
+            "client": ("testclient", 50000),
+        }
+    )
+    response = Response()
+
+    monkeypatch.setattr(rate_limit_module, "RateLimiter", FakeLimiter)
+
+    import asyncio
+
+    asyncio.run(apply_global_rate_limit(request, response))
+
+    assert limiter_calls == [(request, response)]
+
+
+def test_rate_limit_handles_included_router_entries():
+    class FakeRedis:
+        async def script_load(self, script):
+            return "sha"
+
+        async def evalsha(self, sha, keys, key, times, milliseconds):
+            return 0
+
+    app = create_app(Settings(APP_ENV="development"))
+    request = Request(
+        {
+            "type": "http",
+            "app": app,
+            "method": "GET",
+            "path": "/api/v1/todos/",
+            "headers": [],
+            "query_string": b"",
+            "server": ("testserver", 80),
+            "scheme": "http",
+            "client": ("testclient", 50000),
+        }
+    )
+
+    import asyncio
+    from fastapi_limiter import FastAPILimiter
+
+    async def run_rate_limit():
+        await FastAPILimiter.init(FakeRedis(), identifier=custom_identifier)
+        await apply_global_rate_limit(request, Response())
+
+    asyncio.run(run_rate_limit())
+
+
 def test_cors_middleware_uses_environment_driven_settings(monkeypatch):
     monkeypatch.setattr(
         "src.core.bootstrap.middleware.settings",