fix: rate limiter

fiqrikm18 · fiqrikm18 · commit 70178e5faad7 · 2026-06-19T18:25:39.000+07:00
diff --git a/.env.example b/.env.example
@@ -39,3 +39,4 @@ SEED_ADMIN_EMAIL=
 SEED_ADMIN_PASSWORD=
 SEED_ADMIN_USERNAME=admin
 SEED_ADMIN_FULLNAME=System Administrator
+SEED_DEVELOPMENT_USERS_PASSWORD=
diff --git a/README.md b/README.md
@@ -349,6 +349,20 @@ SEED_ADMIN_FULLNAME=System Administrator
 
 If `SEED_ADMIN_EMAIL` or `SEED_ADMIN_PASSWORD` is empty, user seeding is skipped. Existing users are not modified.
 
+When `APP_ENV=development`, the seeder can also create demo users with different roles. Set a shared development password before running `make seed`:
+
+```env
+SEED_DEVELOPMENT_USERS_PASSWORD=
+```
+
+Development demo accounts:
+
+- `user@example.com` with the `user` role
+- `manager@example.com` with the `manager` role
+- `viewer@example.com` with the `viewer` role
+
+These users are skipped outside development and are not updated if they already exist.
+
 ## Testing and Quality Checks
 
 Run tests:
diff --git a/scripts/seed.py b/scripts/seed.py
@@ -1,6 +1,11 @@
 import asyncio
+import sys
+from pathlib import Path
 
-from src.core.seed.runner import run_seeders
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+from src.core.seed.runner import run_seeders  # noqa: E402
 
 
 async def main() -> None:
diff --git a/src/core/authorization/permissions.py b/src/core/authorization/permissions.py
@@ -8,6 +8,12 @@ class AuthorizationResourceDefinition:
     description: str
 
 
+@dataclass(frozen=True)
+class AuthorizationRoleDefinition:
+    name: str
+    description: str
+
+
 DEFAULT_RESOURCES = (
     AuthorizationResourceDefinition(
         key="todo",
@@ -46,6 +52,27 @@ class AuthorizationResourceDefinition:
 
 DEFAULT_USER_ROLE = "user"
 ADMIN_ROLE = "admin"
+MANAGER_ROLE = "manager"
+VIEWER_ROLE = "viewer"
+
+DEFAULT_ROLES = (
+    AuthorizationRoleDefinition(
+        name=ADMIN_ROLE,
+        description="Administrator with full platform access",
+    ),
+    AuthorizationRoleDefinition(
+        name=DEFAULT_USER_ROLE,
+        description="Default authenticated user",
+    ),
+    AuthorizationRoleDefinition(
+        name=MANAGER_ROLE,
+        description="Manager user with todo management access",
+    ),
+    AuthorizationRoleDefinition(
+        name=VIEWER_ROLE,
+        description="Read-only user",
+    ),
+)
 
 
 def permission_key(resource: str, action: str) -> str:
@@ -59,4 +86,11 @@ def permission_key(resource: str, action: str) -> str:
     ("p", DEFAULT_USER_ROLE, permission_key(TODO_RESOURCE, UPDATE_ACTION)),
     ("p", DEFAULT_USER_ROLE, permission_key(TODO_RESOURCE, DELETE_ACTION)),
     ("p", DEFAULT_USER_ROLE, permission_key(USER_RESOURCE, ME_ACTION)),
+    ("p", MANAGER_ROLE, permission_key(TODO_RESOURCE, CREATE_ACTION)),
+    ("p", MANAGER_ROLE, permission_key(TODO_RESOURCE, READ_ACTION)),
+    ("p", MANAGER_ROLE, permission_key(TODO_RESOURCE, UPDATE_ACTION)),
+    ("p", MANAGER_ROLE, permission_key(TODO_RESOURCE, DELETE_ACTION)),
+    ("p", MANAGER_ROLE, permission_key(USER_RESOURCE, ME_ACTION)),
+    ("p", VIEWER_ROLE, permission_key(TODO_RESOURCE, READ_ACTION)),
+    ("p", VIEWER_ROLE, permission_key(USER_RESOURCE, ME_ACTION)),
 )
diff --git a/src/core/bootstrap/middleware.py b/src/core/bootstrap/middleware.py
@@ -2,8 +2,9 @@
 from fastapi.middleware.cors import CORSMiddleware
 
 from src.core.config.setting import get_settings
-from src.core.middleware.auth import AuthenticationMiddleware
 from src.core.middleware.audit_logging import AuditLoggingMiddleware
+from src.core.middleware.auth import AuthenticationMiddleware
+from src.core.middleware.csp import CSPMiddleware
 from src.core.middleware.idempotency import IdempotencyMiddleware
 from src.core.middleware.request_id import RequestIDMiddleware
 from src.core.middleware.request_size import LimitRequestSizeMiddleware
@@ -19,6 +20,7 @@ def register_middleware(app: FastAPI):
         max_upload_size=settings.MAX_REQUEST_SIZE_MB,
     )
     app.add_middleware(SecurityHeadersMiddleware)
+    app.add_middleware(CSPMiddleware)
     app.add_middleware(
         CORSMiddleware,
         allow_origins=settings.cors_allow_origins,
diff --git a/src/core/config/setting.py b/src/core/config/setting.py
@@ -57,6 +57,10 @@ class Settings(BaseSettings):
         alias="SEED_ADMIN_FULLNAME",
         default="System Administrator",
     )
+    SEED_DEVELOPMENT_USERS_PASSWORD: str = Field(
+        alias="SEED_DEVELOPMENT_USERS_PASSWORD",
+        default="",
+    )
     MAX_REQUEST_SIZE_MB: int = Field(
         alias="MAX_REQUEST_SIZE_MB", default=5 * 1024 * 1024
     )
diff --git a/src/core/dependency/rate_limit.py b/src/core/dependency/rate_limit.py
@@ -1,6 +1,5 @@
-from fastapi import Request
+from fastapi import HTTPException, Request, Response
 from fastapi_limiter import FastAPILimiter
-from fastapi_limiter.depends import RateLimiter
 
 from src.core.config.setting import get_settings
 from src.core.database.redis.client import get_redis_client
@@ -55,5 +54,20 @@ async def apply_global_rate_limit(request: Request):
     times = int(times_str)
     seconds = 60 if "minute" in period else 1
 
-    limiter = RateLimiter(times=times, seconds=seconds)
-    await limiter(request)
+    # Get identifier for this request
+    identifier = await custom_identifier(request)
+
+    # Check rate limit
+    is_rate_limited = await FastAPILimiter.redis.incr(
+        f"fastapi-limiter:{identifier}:{request.scope.get('path')}"
+    )
+
+    # Set expiry on first request
+    if is_rate_limited == 1:
+        await FastAPILimiter.redis.expire(
+            f"fastapi-limiter:{identifier}:{request.scope.get('path')}", seconds
+        )
+
+    # Check if rate limit exceeded
+    if is_rate_limited > times:
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
diff --git a/src/core/middleware/csp.py b/src/core/middleware/csp.py
@@ -0,0 +1,26 @@
+from starlette.middleware.base import BaseHTTPMiddleware
+
+
+class CSPMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request, call_next):
+        response = await call_next(request)
+
+        if request.url.path.startswith("/docs") or request.url.path.startswith(
+            "/redoc"
+        ):
+            response.headers["Content-Security-Policy"] = (
+                "default-src 'self'; "
+                "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+                "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+                "img-src 'self' data: https:; "
+                "font-src 'self' https:;"
+            )
+        else:
+            response.headers["Content-Security-Policy"] = (
+                "default-src 'self'; "
+                "object-src 'none'; "
+                "base-uri 'self'; "
+                "frame-ancestors 'none';"
+            )
+
+        return response
diff --git a/src/core/seed/authorization.py b/src/core/seed/authorization.py
@@ -2,10 +2,9 @@
 from typing import Protocol
 
 from src.core.authorization.permissions import (
-    ADMIN_ROLE,
     DEFAULT_RESOURCES,
+    DEFAULT_ROLES,
     DEFAULT_POLICIES,
-    DEFAULT_USER_ROLE,
 )
 from src.modules.authorization.domain.entities.permission import Permission
 from src.modules.authorization.domain.entities.resource import AuthorizationResource
@@ -142,8 +141,8 @@ async def seed_authorization(
 
 def _default_roles() -> dict[str, str]:
     return {
-        ADMIN_ROLE: "Administrator with full platform access",
-        DEFAULT_USER_ROLE: "Default authenticated user",
+        role.name: role.description
+        for role in DEFAULT_ROLES
     }
 
 
diff --git a/src/core/seed/user.py b/src/core/seed/user.py
@@ -1,7 +1,12 @@
 from dataclasses import dataclass
 from typing import Protocol
 
-from src.core.authorization.permissions import ADMIN_ROLE
+from src.core.authorization.permissions import (
+    ADMIN_ROLE,
+    DEFAULT_USER_ROLE,
+    MANAGER_ROLE,
+    VIEWER_ROLE,
+)
 from src.core.security.password import PasswordSerrvice
 from src.modules.user.domain.entities.user import User
 
@@ -21,24 +26,35 @@ async def assign_role(self, subject: str, role: str) -> None:
 
 @dataclass(frozen=True)
 class SeedUserConfig:
+    app_env: str
     admin_email: str
     admin_password: str
     admin_username: str | None = None
     admin_fullname: str | None = None
+    development_users_password: str = ""
 
     @classmethod
     def from_settings(cls, settings) -> "SeedUserConfig":
         return cls(
+            app_env=settings.APP_ENV,
             admin_email=settings.SEED_ADMIN_EMAIL,
             admin_password=settings.SEED_ADMIN_PASSWORD,
             admin_username=settings.SEED_ADMIN_USERNAME,
             admin_fullname=settings.SEED_ADMIN_FULLNAME,
+            development_users_password=settings.SEED_DEVELOPMENT_USERS_PASSWORD,
         )
 
     @property
     def has_admin_credentials(self) -> bool:
         return bool(self.admin_email.strip() and self.admin_password.strip())
 
+    @property
+    def should_seed_development_users(self) -> bool:
+        return (
+            self.app_env.lower() == "development"
+            and bool(self.development_users_password.strip())
+        )
+
 
 @dataclass(frozen=True)
 class UserSeedResult:
@@ -51,20 +67,96 @@ async def seed_user(
     authorization_service: SeedAuthorizationService,
     config: SeedUserConfig,
 ) -> UserSeedResult:
+    users_created = 0
+    roles_assigned = 0
+
     if not config.has_admin_credentials:
-        return UserSeedResult()
+        admin_result = UserSeedResult()
+    else:
+        admin_result = await _seed_one_user(
+            user_repository=user_repository,
+            authorization_service=authorization_service,
+            email=config.admin_email,
+            password=config.admin_password,
+            username=config.admin_username,
+            fullname=config.admin_fullname,
+            role=ADMIN_ROLE,
+        )
+    users_created += admin_result.users_created
+    roles_assigned += admin_result.roles_assigned
+
+    if config.should_seed_development_users:
+        for development_user in _development_users(config.development_users_password):
+            result = await _seed_one_user(
+                user_repository=user_repository,
+                authorization_service=authorization_service,
+                email=development_user.email,
+                password=development_user.password,
+                username=development_user.username,
+                fullname=development_user.fullname,
+                role=development_user.role,
+            )
+            users_created += result.users_created
+            roles_assigned += result.roles_assigned
+
+    return UserSeedResult(users_created=users_created, roles_assigned=roles_assigned)
+
 
-    existing = await user_repository.get_by_email(config.admin_email)
+@dataclass(frozen=True)
+class DevelopmentSeedUser:
+    email: str
+    password: str
+    username: str
+    fullname: str
+    role: str
+
+
+def _development_users(password: str) -> tuple[DevelopmentSeedUser, ...]:
+    return (
+        DevelopmentSeedUser(
+            email="user@example.com",
+            password=password,
+            username="user",
+            fullname="Default User",
+            role=DEFAULT_USER_ROLE,
+        ),
+        DevelopmentSeedUser(
+            email="manager@example.com",
+            password=password,
+            username="manager",
+            fullname="Todo Manager",
+            role=MANAGER_ROLE,
+        ),
+        DevelopmentSeedUser(
+            email="viewer@example.com",
+            password=password,
+            username="viewer",
+            fullname="Todo Viewer",
+            role=VIEWER_ROLE,
+        ),
+    )
+
+
+async def _seed_one_user(
+    user_repository: SeedUserRepository,
+    authorization_service: SeedAuthorizationService,
+    email: str,
+    password: str,
+    username: str | None,
+    fullname: str | None,
+    role: str,
+) -> UserSeedResult:
+    existing = await user_repository.get_by_email(email)
     if existing is not None:
         return UserSeedResult()
 
     user = User.create(
-        email=config.admin_email,
-        password=PasswordSerrvice.hash(config.admin_password),
-        username=config.admin_username,
-        fullname=config.admin_fullname,
+        email=email,
+        password=PasswordSerrvice.hash(password),
+        username=username,
+        fullname=fullname,
     )
     saved_user = await user_repository.save(user)
-    await authorization_service.assign_role(str(saved_user.id), ADMIN_ROLE)
+    await authorization_service.assign_role(str(saved_user.id), role)
 
     return UserSeedResult(users_created=1, roles_assigned=1)
diff --git a/tests/core/test_seed_cli.py b/tests/core/test_seed_cli.py
@@ -1,5 +1,7 @@
 from pathlib import Path
 
+from src.core.config.setting import Settings
+
 
 def test_makefile_exposes_seed_command():
     makefile = Path("Makefile").read_text()
@@ -12,6 +14,7 @@ def test_makefile_exposes_seed_command():
 def test_seed_script_uses_seed_runner():
     script = Path("scripts/seed.py").read_text()
 
+    assert "sys.path.insert" in script
     assert "run_seeders" in script
     assert "seed:user" in script
 
@@ -23,3 +26,10 @@ def test_env_example_documents_seed_admin_settings():
     assert "SEED_ADMIN_PASSWORD=" in env_example
     assert "SEED_ADMIN_USERNAME=admin" in env_example
     assert "SEED_ADMIN_FULLNAME=System Administrator" in env_example
+    assert "SEED_DEVELOPMENT_USERS_PASSWORD=" in env_example
+
+
+def test_seed_development_users_password_has_no_default_secret():
+    settings = Settings(_env_file=None)
+
+    assert settings.SEED_DEVELOPMENT_USERS_PASSWORD == ""
diff --git a/tests/core/test_seed_mechanism.py b/tests/core/test_seed_mechanism.py
diff --git a/tests/core/test_user_seed.py b/tests/core/test_user_seed.py

Original file line number	Diff line number	Diff line change
`@@ -57,6 +57,10 @@ class Settings(BaseSettings):`
`57`	`57`	`alias="SEED_ADMIN_FULLNAME",`
`58`	`58`	`default="System Administrator",`
`59`	`59`	`)`
	`60`	`+ SEED_DEVELOPMENT_USERS_PASSWORD: str = Field(`
	`61`	`+ alias="SEED_DEVELOPMENT_USERS_PASSWORD",`
	`62`	`+ default="",`
	`63`	`+ )`
`60`	`64`	`MAX_REQUEST_SIZE_MB: int = Field(`
`61`	`65`	`alias="MAX_REQUEST_SIZE_MB", default=5 * 1024 * 1024`
`62`	`66`	`)`