@elevasis/core 0.7.0 → 0.8.0

package/src/platform/resilience/__tests__/rate-limiter.test.ts

@@ -1,471 +1,471 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { InMemoryRateLimiter, createRateLimiter } from '../rate-limiter'
-
-describe('InMemoryRateLimiter', () => {
-  let limiter: InMemoryRateLimiter
-
-  beforeEach(() => {
-    limiter = new InMemoryRateLimiter(10, 60000) // 10 requests per minute
-  })
-
-  describe('constructor', () => {
-    it('creates limiter with default values', () => {
-      const defaultLimiter = new InMemoryRateLimiter()
-
-      expect(defaultLimiter).toBeInstanceOf(InMemoryRateLimiter)
-    })
-
-    it('creates limiter with custom capacity', () => {
-      const customLimiter = new InMemoryRateLimiter(100, 60000)
-
-      expect(customLimiter).toBeInstanceOf(InMemoryRateLimiter)
-    })
-
-    it('creates limiter with custom refill interval', () => {
-      const customLimiter = new InMemoryRateLimiter(10, 30000)
-
-      expect(customLimiter).toBeInstanceOf(InMemoryRateLimiter)
-    })
-  })
-
-  describe('allow', () => {
-    it('allows first request', async () => {
-      const allowed = await limiter.allow('org123:gmail')
-
-      expect(allowed).toBe(true)
-    })
-
-    it('allows requests up to capacity', async () => {
-      vi.useFakeTimers()
-      const key = 'org123:gmail'
-
-      // Should allow 10 requests
-      for (let i = 0; i < 10; i++) {
-        const allowed = await limiter.allow(key)
-        expect(allowed).toBe(true)
-      }
-
-      // 11th request should be denied
-      const denied = await limiter.allow(key)
-      expect(denied).toBe(false)
-
-      vi.useRealTimers()
-    })
-
-    it('denies requests after capacity exhausted', async () => {
-      vi.useFakeTimers()
-      const key = 'org123:gmail'
-
-      // Exhaust capacity
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key)
-      }
-
-      // Should deny
-      const denied = await limiter.allow(key)
-      expect(denied).toBe(false)
-
-      vi.useRealTimers()
-    })
-
-    it('tracks separate keys independently', async () => {
-      const key1 = 'org123:gmail'
-      const key2 = 'org456:slack'
-
-      // Exhaust key1
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key1)
-      }
-
-      // key2 should still be allowed
-      const allowed = await limiter.allow(key2)
-      expect(allowed).toBe(true)
-    })
-
-    it('consumes token when allowing request', async () => {
-      const key = 'org123:gmail'
-
-      const remaining1 = await limiter.remaining(key)
-      await limiter.allow(key)
-      const remaining2 = await limiter.remaining(key)
-
-      expect(remaining2).toBe(remaining1 - 1)
-    })
-
-    it.skip('does not consume token when denying request', async () => {
-      // SKIPPED: Flaky test with timing issues - rate limiter window may refill between requests
-      const key = 'org123:gmail'
-
-      // Exhaust capacity
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key)
-      }
-
-      const remaining1 = await limiter.remaining(key)
-      await limiter.allow(key) // Denied
-      const remaining2 = await limiter.remaining(key)
-
-      expect(remaining2).toBe(remaining1)
-    })
-  })
-
-  describe('remaining', () => {
-    it('returns capacity for new key', async () => {
-      const remaining = await limiter.remaining('org123:gmail')
-
-      expect(remaining).toBe(10)
-    })
-
-    it('returns decremented count after requests', async () => {
-      const key = 'org123:gmail'
-
-      await limiter.allow(key)
-      await limiter.allow(key)
-      await limiter.allow(key)
-
-      const remaining = await limiter.remaining(key)
-      expect(remaining).toBe(7)
-    })
-
-    it('returns 0 after capacity exhausted', async () => {
-      const key = 'org123:gmail'
-
-      // Exhaust capacity
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key)
-      }
-
-      const remaining = await limiter.remaining(key)
-      expect(remaining).toBe(0)
-    })
-
-    it('returns integer (floors fractional tokens)', async () => {
-      const key = 'org123:gmail'
-
-      const remaining = await limiter.remaining(key)
-
-      expect(Number.isInteger(remaining)).toBe(true)
-    })
-  })
-
-  describe('reset', () => {
-    it('removes bucket for key', async () => {
-      const key = 'org123:gmail'
-
-      // Use some tokens
-      await limiter.allow(key)
-      await limiter.allow(key)
-      await limiter.allow(key)
-
-      const remaining1 = await limiter.remaining(key)
-      expect(remaining1).toBe(7)
-
-      // Reset
-      await limiter.reset(key)
-
-      // Should have full capacity again
-      const remaining2 = await limiter.remaining(key)
-      expect(remaining2).toBe(10)
-    })
-
-    it('does not affect other keys', async () => {
-      const key1 = 'org123:gmail'
-      const key2 = 'org456:slack'
-
-      await limiter.allow(key1)
-      await limiter.allow(key2)
-      await limiter.allow(key2)
-
-      await limiter.reset(key1)
-
-      const remaining1 = await limiter.remaining(key1)
-      const remaining2 = await limiter.remaining(key2)
-
-      expect(remaining1).toBe(10) // Reset
-      expect(remaining2).toBe(8) // Unchanged
-    })
-
-    it('handles resetting non-existent key', async () => {
-      await expect(limiter.reset('nonexistent')).resolves.toBeUndefined()
-    })
-  })
-
-  describe('refill behavior', () => {
-    let testLimiter: InMemoryRateLimiter
-
-    beforeEach(() => {
-      vi.useFakeTimers()
-      testLimiter = new InMemoryRateLimiter(10, 60000)
-    })
-
-    afterEach(() => {
-      vi.useRealTimers()
-      testLimiter.clearAll()
-    })
-
-    it('refills tokens after refill interval', async () => {
-      const key = 'org123:gmail'
-
-      // Exhaust capacity
-      for (let i = 0; i < 10; i++) {
-        await testLimiter.allow(key)
-      }
-
-      expect(await testLimiter.remaining(key)).toBe(0)
-
-      // Advance time by refill interval
-      vi.advanceTimersByTime(60000)
-
-      // Should have full capacity again
-      expect(await testLimiter.remaining(key)).toBe(10)
-    })
-
-    it('partially refills tokens based on elapsed time', async () => {
-      const key = 'org123:gmail'
-
-      // Use all tokens
-      for (let i = 0; i < 10; i++) {
-        await testLimiter.allow(key)
-      }
-
-      expect(await testLimiter.remaining(key)).toBe(0)
-
-      // Advance time by half interval (30 seconds)
-      vi.advanceTimersByTime(30000)
-
-      // Should have ~5 tokens (50% of capacity)
-      const remaining = await testLimiter.remaining(key)
-      expect(remaining).toBeGreaterThanOrEqual(4)
-      expect(remaining).toBeLessThanOrEqual(6)
-    })
-
-    it('caps refill at capacity', async () => {
-      const key = 'org123:gmail'
-
-      await testLimiter.allow(key)
-
-      // Advance time by 2x refill interval
-      vi.advanceTimersByTime(120000)
-
-      // Should not exceed capacity
-      expect(await testLimiter.remaining(key)).toBe(10)
-    })
-
-    it('refills linearly over time', async () => {
-      const key = 'org123:gmail'
-
-      // Use all tokens
-      for (let i = 0; i < 10; i++) {
-        await testLimiter.allow(key)
-      }
-
-      // Check refill at different intervals
-      const intervals = [6000, 12000, 18000, 24000, 30000]
-      const expectedTokens = [1, 2, 3, 4, 5]
-
-      for (let i = 0; i < intervals.length; i++) {
-        vi.advanceTimersByTime(intervals[i] - (i > 0 ? intervals[i - 1] : 0))
-        const remaining = await testLimiter.remaining(key)
-
-        // Allow some variance due to floating point
-        expect(remaining).toBeGreaterThanOrEqual(expectedTokens[i] - 1)
-        expect(remaining).toBeLessThanOrEqual(expectedTokens[i] + 1)
-      }
-    })
-
-    it('updates lastRefill timestamp on each check', async () => {
-      const key = 'org123:gmail'
-
-      await testLimiter.allow(key)
-      vi.advanceTimersByTime(10000)
-      await testLimiter.remaining(key)
-      vi.advanceTimersByTime(10000)
-
-      const remaining = await testLimiter.remaining(key)
-
-      // Should have refilled tokens
-      expect(remaining).toBeGreaterThan(9)
-    })
-  })
-
-  describe('clearAll', () => {
-    it('removes all buckets', async () => {
-      const key1 = 'org123:gmail'
-      const key2 = 'org456:slack'
-
-      // Use tokens
-      await limiter.allow(key1)
-      await limiter.allow(key2)
-      await limiter.allow(key2)
-
-      limiter.clearAll()
-
-      // Both should have full capacity again
-      expect(await limiter.remaining(key1)).toBe(10)
-      expect(await limiter.remaining(key2)).toBe(10)
-    })
-
-    it.skip('allows fresh start after clear', async () => {
-      // SKIPPED: Flaky test with timing issues - rate limiter window may refill between requests
-      const key = 'org123:gmail'
-
-      // Exhaust capacity
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key)
-      }
-
-      expect(await limiter.allow(key)).toBe(false)
-
-      limiter.clearAll()
-
-      // Should allow requests again
-      expect(await limiter.allow(key)).toBe(true)
-    })
-  })
-
-  describe('concurrent requests', () => {
-    it.skip('handles concurrent requests for same key', async () => {
-      // SKIPPED: This test has a race condition due to non-atomic check-then-act
-      // in the InMemoryRateLimiter.allow() method. The test is flaky and can
-      // occasionally fail when concurrent requests interleave during token checks.
-      // The in-memory implementation is for development/testing only - production
-      // uses Redis with atomic operations.
-      const key = 'org123:gmail'
-
-      const promises = Array.from({ length: 20 }, () => limiter.allow(key))
-      const results = await Promise.all(promises)
-
-      const allowed = results.filter((r) => r).length
-      const denied = results.filter((r) => !r).length
-
-      expect(allowed).toBe(10) // Capacity
-      expect(denied).toBe(10) // Excess
-    })
-
-    it('handles concurrent requests for different keys', async () => {
-      const promises = [
-        ...Array.from({ length: 5 }, () => limiter.allow('org123:gmail')),
-        ...Array.from({ length: 5 }, () => limiter.allow('org456:slack'))
-      ]
-
-      const results = await Promise.all(promises)
-
-      // All should be allowed (within capacity for each key)
-      expect(results.every((r) => r)).toBe(true)
-    })
-  })
-
-  describe('edge cases', () => {
-    it('handles fractional token refills correctly', async () => {
-      vi.useFakeTimers()
-
-      const key = 'org123:gmail'
-
-      // Use all tokens
-      for (let i = 0; i < 10; i++) {
-        await limiter.allow(key)
-      }
-
-      // Advance by 33% of interval (should add ~3.3 tokens)
-      vi.advanceTimersByTime(20000)
-
-      const remaining = await limiter.remaining(key)
-
-      // Should floor to integer tokens
-      expect(Number.isInteger(remaining)).toBe(true)
-      expect(remaining).toBeGreaterThanOrEqual(3)
-      expect(remaining).toBeLessThanOrEqual(4)
-
-      vi.useRealTimers()
-    })
-  })
-})
-
-describe('createRateLimiter', () => {
-  it('creates InMemoryRateLimiter instance', () => {
-    const limiter = createRateLimiter()
-
-    expect(limiter).toBeInstanceOf(InMemoryRateLimiter)
-  })
-
-  it('creates limiter with default config (300 req/min)', async () => {
-    vi.useFakeTimers()
-    const limiter = createRateLimiter()
-
-    // Should allow 300 requests
-    for (let i = 0; i < 300; i++) {
-      const allowed = await limiter.allow('test')
-      expect(allowed).toBe(true)
-    }
-
-    // 301st should be denied
-    const denied = await limiter.allow('test')
-    expect(denied).toBe(false)
-
-    vi.useRealTimers()
-  })
-
-  it('creates independent limiter instances', async () => {
-    const limiter1 = createRateLimiter()
-    const limiter2 = createRateLimiter()
-
-    // Exhaust limiter1
-    for (let i = 0; i < 300; i++) {
-      await limiter1.allow('test')
-    }
-
-    // limiter2 should still allow
-    const allowed = await limiter2.allow('test')
-    expect(allowed).toBe(true)
-  })
-})
-
-describe('Rate Limiter Integration', () => {
-  it('supports typical organization-integration pattern', async () => {
-    const limiter = createRateLimiter()
-
-    const key = 'org_acme_test:gmail'
-
-    // Make 50 requests
-    for (let i = 0; i < 50; i++) {
-      const allowed = await limiter.allow(key)
-      expect(allowed).toBe(true)
-    }
-
-    // Check remaining (300 capacity - 50 used = 250)
-    const remaining = await limiter.remaining(key)
-    expect(remaining).toBe(250)
-  })
-
-  it('isolates different organizations', async () => {
-    const limiter = createRateLimiter()
-
-    const orgA = 'org_acme:gmail'
-    const orgB = 'org_beta:gmail'
-
-    // Exhaust org A
-    for (let i = 0; i < 300; i++) {
-      await limiter.allow(orgA)
-    }
-
-    // Org B should still be allowed
-    const allowed = await limiter.allow(orgB)
-    expect(allowed).toBe(true)
-  })
-
-  it('isolates different integrations', async () => {
-    const limiter = createRateLimiter()
-
-    const gmail = 'org_acme:gmail'
-    const slack = 'org_acme:slack'
-
-    // Exhaust Gmail
-    for (let i = 0; i < 300; i++) {
-      await limiter.allow(gmail)
-    }
-
-    // Slack should still be allowed
-    const allowed = await limiter.allow(slack)
-    expect(allowed).toBe(true)
-  })
-})
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { InMemoryRateLimiter, createRateLimiter } from '../rate-limiter'
+
+describe('InMemoryRateLimiter', () => {
+  let limiter: InMemoryRateLimiter
+
+  beforeEach(() => {
+    limiter = new InMemoryRateLimiter(10, 60000) // 10 requests per minute
+  })
+
+  describe('constructor', () => {
+    it('creates limiter with default values', () => {
+      const defaultLimiter = new InMemoryRateLimiter()
+
+      expect(defaultLimiter).toBeInstanceOf(InMemoryRateLimiter)
+    })
+
+    it('creates limiter with custom capacity', () => {
+      const customLimiter = new InMemoryRateLimiter(100, 60000)
+
+      expect(customLimiter).toBeInstanceOf(InMemoryRateLimiter)
+    })
+
+    it('creates limiter with custom refill interval', () => {
+      const customLimiter = new InMemoryRateLimiter(10, 30000)
+
+      expect(customLimiter).toBeInstanceOf(InMemoryRateLimiter)
+    })
+  })
+
+  describe('allow', () => {
+    it('allows first request', async () => {
+      const allowed = await limiter.allow('org123:gmail')
+
+      expect(allowed).toBe(true)
+    })
+
+    it('allows requests up to capacity', async () => {
+      vi.useFakeTimers()
+      const key = 'org123:gmail'
+
+      // Should allow 10 requests
+      for (let i = 0; i < 10; i++) {
+        const allowed = await limiter.allow(key)
+        expect(allowed).toBe(true)
+      }
+
+      // 11th request should be denied
+      const denied = await limiter.allow(key)
+      expect(denied).toBe(false)
+
+      vi.useRealTimers()
+    })
+
+    it('denies requests after capacity exhausted', async () => {
+      vi.useFakeTimers()
+      const key = 'org123:gmail'
+
+      // Exhaust capacity
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key)
+      }
+
+      // Should deny
+      const denied = await limiter.allow(key)
+      expect(denied).toBe(false)
+
+      vi.useRealTimers()
+    })
+
+    it('tracks separate keys independently', async () => {
+      const key1 = 'org123:gmail'
+      const key2 = 'org456:slack'
+
+      // Exhaust key1
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key1)
+      }
+
+      // key2 should still be allowed
+      const allowed = await limiter.allow(key2)
+      expect(allowed).toBe(true)
+    })
+
+    it('consumes token when allowing request', async () => {
+      const key = 'org123:gmail'
+
+      const remaining1 = await limiter.remaining(key)
+      await limiter.allow(key)
+      const remaining2 = await limiter.remaining(key)
+
+      expect(remaining2).toBe(remaining1 - 1)
+    })
+
+    it.skip('does not consume token when denying request', async () => {
+      // SKIPPED: Flaky test with timing issues - rate limiter window may refill between requests
+      const key = 'org123:gmail'
+
+      // Exhaust capacity
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key)
+      }
+
+      const remaining1 = await limiter.remaining(key)
+      await limiter.allow(key) // Denied
+      const remaining2 = await limiter.remaining(key)
+
+      expect(remaining2).toBe(remaining1)
+    })
+  })
+
+  describe('remaining', () => {
+    it('returns capacity for new key', async () => {
+      const remaining = await limiter.remaining('org123:gmail')
+
+      expect(remaining).toBe(10)
+    })
+
+    it('returns decremented count after requests', async () => {
+      const key = 'org123:gmail'
+
+      await limiter.allow(key)
+      await limiter.allow(key)
+      await limiter.allow(key)
+
+      const remaining = await limiter.remaining(key)
+      expect(remaining).toBe(7)
+    })
+
+    it('returns 0 after capacity exhausted', async () => {
+      const key = 'org123:gmail'
+
+      // Exhaust capacity
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key)
+      }
+
+      const remaining = await limiter.remaining(key)
+      expect(remaining).toBe(0)
+    })
+
+    it('returns integer (floors fractional tokens)', async () => {
+      const key = 'org123:gmail'
+
+      const remaining = await limiter.remaining(key)
+
+      expect(Number.isInteger(remaining)).toBe(true)
+    })
+  })
+
+  describe('reset', () => {
+    it('removes bucket for key', async () => {
+      const key = 'org123:gmail'
+
+      // Use some tokens
+      await limiter.allow(key)
+      await limiter.allow(key)
+      await limiter.allow(key)
+
+      const remaining1 = await limiter.remaining(key)
+      expect(remaining1).toBe(7)
+
+      // Reset
+      await limiter.reset(key)
+
+      // Should have full capacity again
+      const remaining2 = await limiter.remaining(key)
+      expect(remaining2).toBe(10)
+    })
+
+    it('does not affect other keys', async () => {
+      const key1 = 'org123:gmail'
+      const key2 = 'org456:slack'
+
+      await limiter.allow(key1)
+      await limiter.allow(key2)
+      await limiter.allow(key2)
+
+      await limiter.reset(key1)
+
+      const remaining1 = await limiter.remaining(key1)
+      const remaining2 = await limiter.remaining(key2)
+
+      expect(remaining1).toBe(10) // Reset
+      expect(remaining2).toBe(8) // Unchanged
+    })
+
+    it('handles resetting non-existent key', async () => {
+      await expect(limiter.reset('nonexistent')).resolves.toBeUndefined()
+    })
+  })
+
+  describe('refill behavior', () => {
+    let testLimiter: InMemoryRateLimiter
+
+    beforeEach(() => {
+      vi.useFakeTimers()
+      testLimiter = new InMemoryRateLimiter(10, 60000)
+    })
+
+    afterEach(() => {
+      vi.useRealTimers()
+      testLimiter.clearAll()
+    })
+
+    it('refills tokens after refill interval', async () => {
+      const key = 'org123:gmail'
+
+      // Exhaust capacity
+      for (let i = 0; i < 10; i++) {
+        await testLimiter.allow(key)
+      }
+
+      expect(await testLimiter.remaining(key)).toBe(0)
+
+      // Advance time by refill interval
+      vi.advanceTimersByTime(60000)
+
+      // Should have full capacity again
+      expect(await testLimiter.remaining(key)).toBe(10)
+    })
+
+    it('partially refills tokens based on elapsed time', async () => {
+      const key = 'org123:gmail'
+
+      // Use all tokens
+      for (let i = 0; i < 10; i++) {
+        await testLimiter.allow(key)
+      }
+
+      expect(await testLimiter.remaining(key)).toBe(0)
+
+      // Advance time by half interval (30 seconds)
+      vi.advanceTimersByTime(30000)
+
+      // Should have ~5 tokens (50% of capacity)
+      const remaining = await testLimiter.remaining(key)
+      expect(remaining).toBeGreaterThanOrEqual(4)
+      expect(remaining).toBeLessThanOrEqual(6)
+    })
+
+    it('caps refill at capacity', async () => {
+      const key = 'org123:gmail'
+
+      await testLimiter.allow(key)
+
+      // Advance time by 2x refill interval
+      vi.advanceTimersByTime(120000)
+
+      // Should not exceed capacity
+      expect(await testLimiter.remaining(key)).toBe(10)
+    })
+
+    it('refills linearly over time', async () => {
+      const key = 'org123:gmail'
+
+      // Use all tokens
+      for (let i = 0; i < 10; i++) {
+        await testLimiter.allow(key)
+      }
+
+      // Check refill at different intervals
+      const intervals = [6000, 12000, 18000, 24000, 30000]
+      const expectedTokens = [1, 2, 3, 4, 5]
+
+      for (let i = 0; i < intervals.length; i++) {
+        vi.advanceTimersByTime(intervals[i] - (i > 0 ? intervals[i - 1] : 0))
+        const remaining = await testLimiter.remaining(key)
+
+        // Allow some variance due to floating point
+        expect(remaining).toBeGreaterThanOrEqual(expectedTokens[i] - 1)
+        expect(remaining).toBeLessThanOrEqual(expectedTokens[i] + 1)
+      }
+    })
+
+    it('updates lastRefill timestamp on each check', async () => {
+      const key = 'org123:gmail'
+
+      await testLimiter.allow(key)
+      vi.advanceTimersByTime(10000)
+      await testLimiter.remaining(key)
+      vi.advanceTimersByTime(10000)
+
+      const remaining = await testLimiter.remaining(key)
+
+      // Should have refilled tokens
+      expect(remaining).toBeGreaterThan(9)
+    })
+  })
+
+  describe('clearAll', () => {
+    it('removes all buckets', async () => {
+      const key1 = 'org123:gmail'
+      const key2 = 'org456:slack'
+
+      // Use tokens
+      await limiter.allow(key1)
+      await limiter.allow(key2)
+      await limiter.allow(key2)
+
+      limiter.clearAll()
+
+      // Both should have full capacity again
+      expect(await limiter.remaining(key1)).toBe(10)
+      expect(await limiter.remaining(key2)).toBe(10)
+    })
+
+    it.skip('allows fresh start after clear', async () => {
+      // SKIPPED: Flaky test with timing issues - rate limiter window may refill between requests
+      const key = 'org123:gmail'
+
+      // Exhaust capacity
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key)
+      }
+
+      expect(await limiter.allow(key)).toBe(false)
+
+      limiter.clearAll()
+
+      // Should allow requests again
+      expect(await limiter.allow(key)).toBe(true)
+    })
+  })
+
+  describe('concurrent requests', () => {
+    it.skip('handles concurrent requests for same key', async () => {
+      // SKIPPED: This test has a race condition due to non-atomic check-then-act
+      // in the InMemoryRateLimiter.allow() method. The test is flaky and can
+      // occasionally fail when concurrent requests interleave during token checks.
+      // The in-memory implementation is for development/testing only - production
+      // uses Redis with atomic operations.
+      const key = 'org123:gmail'
+
+      const promises = Array.from({ length: 20 }, () => limiter.allow(key))
+      const results = await Promise.all(promises)
+
+      const allowed = results.filter((r) => r).length
+      const denied = results.filter((r) => !r).length
+
+      expect(allowed).toBe(10) // Capacity
+      expect(denied).toBe(10) // Excess
+    })
+
+    it('handles concurrent requests for different keys', async () => {
+      const promises = [
+        ...Array.from({ length: 5 }, () => limiter.allow('org123:gmail')),
+        ...Array.from({ length: 5 }, () => limiter.allow('org456:slack'))
+      ]
+
+      const results = await Promise.all(promises)
+
+      // All should be allowed (within capacity for each key)
+      expect(results.every((r) => r)).toBe(true)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('handles fractional token refills correctly', async () => {
+      vi.useFakeTimers()
+
+      const key = 'org123:gmail'
+
+      // Use all tokens
+      for (let i = 0; i < 10; i++) {
+        await limiter.allow(key)
+      }
+
+      // Advance by 33% of interval (should add ~3.3 tokens)
+      vi.advanceTimersByTime(20000)
+
+      const remaining = await limiter.remaining(key)
+
+      // Should floor to integer tokens
+      expect(Number.isInteger(remaining)).toBe(true)
+      expect(remaining).toBeGreaterThanOrEqual(3)
+      expect(remaining).toBeLessThanOrEqual(4)
+
+      vi.useRealTimers()
+    })
+  })
+})
+
+describe('createRateLimiter', () => {
+  it('creates InMemoryRateLimiter instance', () => {
+    const limiter = createRateLimiter()
+
+    expect(limiter).toBeInstanceOf(InMemoryRateLimiter)
+  })
+
+  it('creates limiter with default config (300 req/min)', async () => {
+    vi.useFakeTimers()
+    const limiter = createRateLimiter()
+
+    // Should allow 300 requests
+    for (let i = 0; i < 300; i++) {
+      const allowed = await limiter.allow('test')
+      expect(allowed).toBe(true)
+    }
+
+    // 301st should be denied
+    const denied = await limiter.allow('test')
+    expect(denied).toBe(false)
+
+    vi.useRealTimers()
+  })
+
+  it('creates independent limiter instances', async () => {
+    const limiter1 = createRateLimiter()
+    const limiter2 = createRateLimiter()
+
+    // Exhaust limiter1
+    for (let i = 0; i < 300; i++) {
+      await limiter1.allow('test')
+    }
+
+    // limiter2 should still allow
+    const allowed = await limiter2.allow('test')
+    expect(allowed).toBe(true)
+  })
+})
+
+describe('Rate Limiter Integration', () => {
+  it('supports typical organization-integration pattern', async () => {
+    const limiter = createRateLimiter()
+
+    const key = 'org_acme_test:gmail'
+
+    // Make 50 requests
+    for (let i = 0; i < 50; i++) {
+      const allowed = await limiter.allow(key)
+      expect(allowed).toBe(true)
+    }
+
+    // Check remaining (300 capacity - 50 used = 250)
+    const remaining = await limiter.remaining(key)
+    expect(remaining).toBe(250)
+  })
+
+  it('isolates different organizations', async () => {
+    const limiter = createRateLimiter()
+
+    const orgA = 'org_acme:gmail'
+    const orgB = 'org_beta:gmail'
+
+    // Exhaust org A
+    for (let i = 0; i < 300; i++) {
+      await limiter.allow(orgA)
+    }
+
+    // Org B should still be allowed
+    const allowed = await limiter.allow(orgB)
+    expect(allowed).toBe(true)
+  })
+
+  it('isolates different integrations', async () => {
+    const limiter = createRateLimiter()
+
+    const gmail = 'org_acme:gmail'
+    const slack = 'org_acme:slack'
+
+    // Exhaust Gmail
+    for (let i = 0; i < 300; i++) {
+      await limiter.allow(gmail)
+    }
+
+    // Slack should still be allowed
+    const allowed = await limiter.allow(slack)
+    expect(allowed).toBe(true)
+  })
+})