@useatlas/create 0.0.1

package/templates/docker/src/lib/db/__tests__/salesforce.test.ts

@@ -0,0 +1,339 @@
+/**
+ * Tests for the Salesforce DataSource adapter and registry.
+ */
+import { describe, it, expect, beforeEach, mock } from "bun:test";
+
+// Mock jsforce before importing the module under test
+const mockLogin = mock(() => Promise.resolve());
+const mockLogout = mock(() => Promise.resolve());
+const mockQuery = mock(() =>
+  Promise.resolve({
+    records: [
+      { attributes: { type: "Account" }, Id: "001", Name: "Acme" },
+      { attributes: { type: "Account" }, Id: "002", Name: "Widget Co" },
+    ],
+  }),
+);
+const mockDescribe = mock(() =>
+  Promise.resolve({
+    name: "Account",
+    label: "Account",
+    fields: [
+      {
+        name: "Id",
+        type: "id",
+        label: "Account ID",
+        picklistValues: [],
+        referenceTo: [],
+        nillable: false,
+        length: 18,
+      },
+      {
+        name: "Name",
+        type: "string",
+        label: "Account Name",
+        picklistValues: [],
+        referenceTo: [],
+        nillable: false,
+        length: 255,
+      },
+      {
+        name: "Industry",
+        type: "picklist",
+        label: "Industry",
+        picklistValues: [
+          { value: "Technology", label: "Technology", active: true },
+          { value: "Finance", label: "Finance", active: true },
+        ],
+        referenceTo: [],
+        nillable: true,
+        length: 255,
+      },
+    ],
+  }),
+);
+const mockDescribeGlobal = mock(() =>
+  Promise.resolve({
+    sobjects: [
+      { name: "Account", label: "Account", queryable: true },
+      { name: "Contact", label: "Contact", queryable: true },
+      { name: "ApexLog", label: "Apex Log", queryable: false },
+    ],
+  }),
+);
+
+mock.module("jsforce", () => ({
+  Connection: class MockConnection {
+    login = mockLogin;
+    logout = mockLogout;
+    query = mockQuery;
+    describe = mockDescribe;
+    describeGlobal = mockDescribeGlobal;
+  },
+}));
+
+const {
+  parseSalesforceURL,
+  createSalesforceDataSource,
+  registerSalesforceSource,
+  getSalesforceSource,
+  listSalesforceSources,
+  describeSalesforceSources,
+  _resetSalesforceSources,
+} = await import("@atlas/api/lib/db/salesforce");
+
+describe("parseSalesforceURL", () => {
+  it("parses a full URL", () => {
+    const config = parseSalesforceURL(
+      "salesforce://user%40example.com:pass123@login.salesforce.com?token=SECTOKEN",
+    );
+    expect(config.loginUrl).toBe("https://login.salesforce.com");
+    expect(config.username).toBe("user@example.com");
+    expect(config.password).toBe("pass123");
+    expect(config.securityToken).toBe("SECTOKEN");
+  });
+
+  it("parses minimal URL with defaults", () => {
+    const config = parseSalesforceURL("salesforce://admin:secret@localhost");
+    expect(config.loginUrl).toBe("https://localhost");
+    expect(config.username).toBe("admin");
+    expect(config.password).toBe("secret");
+    expect(config.securityToken).toBeUndefined();
+  });
+
+  it("parses sandbox URL (test.salesforce.com)", () => {
+    const config = parseSalesforceURL(
+      "salesforce://user:pass@test.salesforce.com",
+    );
+    expect(config.loginUrl).toBe("https://test.salesforce.com");
+  });
+
+  it("parses OAuth params", () => {
+    const config = parseSalesforceURL(
+      "salesforce://user:pass@login.salesforce.com?clientId=CID&clientSecret=CSEC",
+    );
+    expect(config.clientId).toBe("CID");
+    expect(config.clientSecret).toBe("CSEC");
+  });
+
+  it("throws for non-salesforce scheme", () => {
+    expect(() => parseSalesforceURL("postgresql://user:pass@localhost")).toThrow(
+      "expected salesforce://",
+    );
+  });
+
+  it("throws for missing username", () => {
+    expect(() =>
+      parseSalesforceURL("salesforce://:pass@login.salesforce.com"),
+    ).toThrow("missing username");
+  });
+
+  it("throws for missing password", () => {
+    expect(() =>
+      parseSalesforceURL("salesforce://user@login.salesforce.com"),
+    ).toThrow("missing password");
+  });
+});
+
+describe("createSalesforceDataSource", () => {
+  beforeEach(() => {
+    mockLogin.mockClear();
+    mockLogout.mockClear();
+    mockQuery.mockClear();
+    mockDescribe.mockClear();
+    mockDescribeGlobal.mockClear();
+  });
+
+  it("query returns columns and rows without attributes key", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    const result = await source.query("SELECT Id, Name FROM Account");
+    expect(result.columns).toEqual(["Id", "Name"]);
+    expect(result.rows).toEqual([
+      { Id: "001", Name: "Acme" },
+      { Id: "002", Name: "Widget Co" },
+    ]);
+    expect(mockLogin).toHaveBeenCalledTimes(1);
+  });
+
+  it("query returns empty result for no records", async () => {
+    mockQuery.mockImplementationOnce(() =>
+      Promise.resolve({ records: [] }),
+    );
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    const result = await source.query("SELECT Id FROM Account WHERE Id = 'none'");
+    expect(result.columns).toEqual([]);
+    expect(result.rows).toEqual([]);
+  });
+
+  it("describe returns mapped fields", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    const desc = await source.describe("Account");
+    expect(desc.name).toBe("Account");
+    expect(desc.fields).toHaveLength(3);
+    expect(desc.fields[0].name).toBe("Id");
+    expect(desc.fields[2].picklistValues).toHaveLength(2);
+  });
+
+  it("listObjects filters to queryable only", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    const objects = await source.listObjects();
+    expect(objects).toHaveLength(2);
+    expect(objects.map((o) => o.name)).toEqual(["Account", "Contact"]);
+  });
+
+  it("close calls logout", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    // Force login first
+    await source.listObjects();
+    await source.close();
+    expect(mockLogout).toHaveBeenCalledTimes(1);
+  });
+
+  it("appends security token to password on login", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+      securityToken: "TOKEN123",
+    });
+
+    await source.listObjects();
+    expect(mockLogin).toHaveBeenCalledWith("user", "passTOKEN123");
+  });
+
+  it("serializes concurrent login attempts (no duplicate logins)", async () => {
+    // Make login take some time so concurrent calls overlap
+    mockLogin.mockImplementation(
+      () => new Promise((resolve) => setTimeout(resolve, 50)),
+    );
+
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    // Fire three concurrent queries — all need login
+    await Promise.all([
+      source.query("SELECT Id FROM Account"),
+      source.listObjects(),
+      source.describe("Account"),
+    ]);
+
+    // Login should have been called exactly once despite three concurrent callers
+    expect(mockLogin).toHaveBeenCalledTimes(1);
+  });
+
+  it("close without prior login is a no-op", async () => {
+    const source = createSalesforceDataSource({
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    // Close without ever calling login — should not throw or call logout
+    await source.close();
+    expect(mockLogout).not.toHaveBeenCalled();
+    expect(mockLogin).not.toHaveBeenCalled();
+  });
+});
+
+describe("Salesforce source registry", () => {
+  beforeEach(() => {
+    _resetSalesforceSources();
+    mockLogin.mockClear();
+    mockLogout.mockClear();
+  });
+
+  it("register and get a source", () => {
+    registerSalesforceSource("sf1", {
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    const source = getSalesforceSource("sf1");
+    expect(source).toBeDefined();
+    expect(source.query).toBeDefined();
+  });
+
+  it("throws for unregistered source", () => {
+    expect(() => getSalesforceSource("nonexistent")).toThrow(
+      'not registered',
+    );
+  });
+
+  it("lists registered sources", () => {
+    registerSalesforceSource("sf1", {
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+    registerSalesforceSource("sf2", {
+      loginUrl: "https://test.salesforce.com",
+      username: "admin",
+      password: "secret",
+    });
+
+    expect(listSalesforceSources()).toEqual(["sf1", "sf2"]);
+  });
+
+  it("reset clears all sources", () => {
+    registerSalesforceSource("sf1", {
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+
+    _resetSalesforceSources();
+    expect(listSalesforceSources()).toEqual([]);
+  });
+
+  it("describeSalesforceSources returns metadata for registered sources", () => {
+    registerSalesforceSource("sf1", {
+      loginUrl: "https://login.salesforce.com",
+      username: "user",
+      password: "pass",
+    });
+    registerSalesforceSource("sf2", {
+      loginUrl: "https://test.salesforce.com",
+      username: "admin",
+      password: "secret",
+    });
+
+    const meta = describeSalesforceSources();
+    expect(meta).toEqual([
+      { id: "sf1", dbType: "salesforce" },
+      { id: "sf2", dbType: "salesforce" },
+    ]);
+  });
+
+  it("describeSalesforceSources returns empty array when no sources registered", () => {
+    expect(describeSalesforceSources()).toEqual([]);
+  });
+});

package/templates/docker/src/lib/db/__tests__/snowflake.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Tests for Snowflake URL parsing, detectDBType integration, and connection behavior.
+ */
+import { describe, it, expect, mock, beforeEach } from "bun:test";
+import { resolve } from "path";
+
+// Track all SQL statements executed via the mock connection.
+// Reset in each describe block's beforeEach to prevent cross-test pollution.
+let executedStatements: string[] = [];
+
+// Flag to make the QUERY_TAG ALTER SESSION fail in specific tests
+let queryTagShouldFail = false;
+
+// Mock logger to capture structured log output
+const mockWarn = mock(() => {});
+mock.module("@atlas/api/lib/logger", () => ({
+  createLogger: () => ({
+    info: mock(() => {}),
+    warn: mockWarn,
+    error: mock(() => {}),
+    debug: mock(() => {}),
+    child: () => ({ info: mock(() => {}), warn: mockWarn, error: mock(() => {}), debug: mock(() => {}) }),
+  }),
+}));
+
+// Mock database drivers before importing connection module
+mock.module("pg", () => ({
+  Pool: class MockPool {
+    async query() { return { rows: [], fields: [] }; }
+    async connect() { return { async query() { return { rows: [], fields: [] }; }, release() {} }; }
+    async end() {}
+  },
+}));
+
+mock.module("mysql2/promise", () => ({
+  createPool: () => ({
+    async getConnection() { return { async execute() { return [[], []]; }, release() {} }; },
+    async end() {},
+  }),
+}));
+
+mock.module("snowflake-sdk", () => ({
+  configure: () => {},
+  createPool: () => ({
+    use: async (fn: (conn: unknown) => Promise<unknown>) => {
+      const mockConn = {
+        execute: (opts: { sqlText: string; complete: (err: Error | null, stmt: unknown, rows: unknown[]) => void }) => {
+          executedStatements.push(opts.sqlText);
+          if (queryTagShouldFail && opts.sqlText.includes("QUERY_TAG")) {
+            opts.complete(new Error("Insufficient privileges to set QUERY_TAG"), null, []);
+            return;
+          }
+          opts.complete(null, { getColumns: () => [] }, []);
+        },
+      };
+      return fn(mockConn);
+    },
+    drain: async () => {},
+    clear: async () => {},
+  }),
+}));
+
+// Cache-busting import to get a fresh module instance, avoiding interference
+// from global mock.module("@atlas/api/lib/db/connection") in other test files
+// (e.g. sql.test.ts) that don't export parseSnowflakeURL.
+const connModPath = resolve(__dirname, "../connection.ts");
+const connMod = await import(`${connModPath}?t=${Date.now()}`);
+const parseSnowflakeURL = connMod.parseSnowflakeURL as typeof import("../connection").parseSnowflakeURL;
+const detectDBType = connMod.detectDBType as typeof import("../connection").detectDBType;
+
+describe("parseSnowflakeURL", () => {
+  it("parses full Snowflake URL with all components", () => {
+    const opts = parseSnowflakeURL(
+      "snowflake://myuser:mypass@xy12345.us-east-1/mydb/myschema?warehouse=COMPUTE_WH&role=ANALYST"
+    );
+    expect(opts.account).toBe("xy12345.us-east-1");
+    expect(opts.username).toBe("myuser");
+    expect(opts.password).toBe("mypass");
+    expect(opts.database).toBe("mydb");
+    expect(opts.schema).toBe("myschema");
+    expect(opts.warehouse).toBe("COMPUTE_WH");
+    expect(opts.role).toBe("ANALYST");
+  });
+
+  it("parses URL with database only (no schema)", () => {
+    const opts = parseSnowflakeURL("snowflake://user:pass@account123/mydb");
+    expect(opts.account).toBe("account123");
+    expect(opts.username).toBe("user");
+    expect(opts.password).toBe("pass");
+    expect(opts.database).toBe("mydb");
+    expect(opts.schema).toBeUndefined();
+    expect(opts.warehouse).toBeUndefined();
+    expect(opts.role).toBeUndefined();
+  });
+
+  it("parses minimal URL (account only)", () => {
+    const opts = parseSnowflakeURL("snowflake://user:pass@account123");
+    expect(opts.account).toBe("account123");
+    expect(opts.username).toBe("user");
+    expect(opts.password).toBe("pass");
+    expect(opts.database).toBeUndefined();
+    expect(opts.schema).toBeUndefined();
+  });
+
+  it("decodes URL-encoded credentials", () => {
+    const opts = parseSnowflakeURL("snowflake://my%40user:p%40ss%23word@account123/db");
+    expect(opts.username).toBe("my@user");
+    expect(opts.password).toBe("p@ss#word");
+  });
+
+  it("handles warehouse query parameter only", () => {
+    const opts = parseSnowflakeURL("snowflake://user:pass@account123/db/schema?warehouse=WH");
+    expect(opts.warehouse).toBe("WH");
+    expect(opts.role).toBeUndefined();
+  });
+
+  it("throws for non-snowflake protocol", () => {
+    expect(() => parseSnowflakeURL("postgresql://user:pass@localhost:5432/db")).toThrow(
+      "Invalid Snowflake URL"
+    );
+  });
+
+  it("accepts empty password (key-pair auth scenario)", () => {
+    const opts = parseSnowflakeURL("snowflake://user:@account123/db");
+    expect(opts.username).toBe("user");
+    expect(opts.password).toBe("");
+    expect(opts.database).toBe("db");
+  });
+
+  it("throws for missing username", () => {
+    expect(() => parseSnowflakeURL("snowflake://:pass@account123/db")).toThrow(
+      "missing username"
+    );
+  });
+
+  it("throws for missing account (unparseable URL)", () => {
+    // snowflake://user:pass@/db is not a valid URL — the URL constructor throws
+    expect(() => parseSnowflakeURL("snowflake://user:pass@/db")).toThrow();
+  });
+});
+
+describe("detectDBType — Snowflake", () => {
+  it("returns 'snowflake' for snowflake:// URLs", () => {
+    expect(detectDBType("snowflake://user:pass@account123/db")).toBe("snowflake");
+  });
+
+  it("still returns 'postgres' for postgresql:// URLs", () => {
+    expect(detectDBType("postgresql://user:pass@localhost:5432/db")).toBe("postgres");
+  });
+
+  it("still returns 'mysql' for mysql:// URLs", () => {
+    expect(detectDBType("mysql://user:pass@localhost:3306/db")).toBe("mysql");
+  });
+
+  it("throws for unsupported URL schemes", () => {
+    expect(() => detectDBType("sqlite:///test.db")).toThrow("Unsupported database URL");
+  });
+});
+
+describe("createSnowflakeDB — defense-in-depth", () => {
+  const ConnectionRegistry = connMod.ConnectionRegistry as typeof import("../connection").ConnectionRegistry;
+
+  beforeEach(() => {
+    executedStatements = [];
+    queryTagShouldFail = false;
+    mockWarn.mockClear();
+  });
+
+  it("logs a startup warning recommending a SELECT-only role", () => {
+    const registry = new ConnectionRegistry();
+    registry.register("sf-test", { url: "snowflake://user:pass@account123/db" });
+    expect(mockWarn).toHaveBeenCalledWith(
+      expect.stringContaining("no session-level read-only mode"),
+    );
+  });
+
+  it("sets QUERY_TAG before each query", async () => {
+    const registry = new ConnectionRegistry();
+    registry.register("sf-tag", { url: "snowflake://user:pass@account123/db" });
+    const db = registry.get("sf-tag");
+    await db.query("SELECT 1");
+
+    expect(executedStatements).toContain("ALTER SESSION SET QUERY_TAG = 'atlas:readonly'");
+    // QUERY_TAG should come after timeout and before the actual query
+    const tagIdx = executedStatements.indexOf("ALTER SESSION SET QUERY_TAG = 'atlas:readonly'");
+    const queryIdx = executedStatements.indexOf("SELECT 1");
+    expect(tagIdx).toBeLessThan(queryIdx);
+  });
+
+  it("sets statement timeout before QUERY_TAG", async () => {
+    const registry = new ConnectionRegistry();
+    registry.register("sf-order", { url: "snowflake://user:pass@account123/db" });
+    const db = registry.get("sf-order");
+    await db.query("SELECT 1", 15000);
+
+    const timeoutIdx = executedStatements.findIndex((s) => s.includes("STATEMENT_TIMEOUT_IN_SECONDS"));
+    const tagIdx = executedStatements.indexOf("ALTER SESSION SET QUERY_TAG = 'atlas:readonly'");
+    expect(timeoutIdx).toBeLessThan(tagIdx);
+  });
+
+  it("proceeds with the query when QUERY_TAG fails (best-effort)", async () => {
+    queryTagShouldFail = true;
+    const registry = new ConnectionRegistry();
+    registry.register("sf-tag-fail", { url: "snowflake://user:pass@account123/db" });
+    const db = registry.get("sf-tag-fail");
+    const result = await db.query("SELECT 42");
+
+    // The actual query should still execute despite QUERY_TAG failure
+    expect(executedStatements).toContain("SELECT 42");
+    expect(result).toEqual({ columns: [], rows: [] });
+
+    // A warning should be logged
+    expect(mockWarn).toHaveBeenCalledWith(
+      expect.stringContaining("Failed to set QUERY_TAG"),
+    );
+  });
+});

package/templates/docker/src/lib/db/__tests__/source-rate-limit.test.ts

@@ -0,0 +1,130 @@
+/**
+ * Tests for per-source rate limiting.
+ */
+import { describe, it, expect, afterEach } from "bun:test";
+import {
+  checkSourceRateLimit,
+  registerSourceRateLimit,
+  clearSourceRateLimit,
+  incrementSourceConcurrency,
+  decrementSourceConcurrency,
+  _resetSourceRateLimits,
+  _stopSourceRateLimitCleanup,
+} from "../source-rate-limit";
+
+afterEach(() => {
+  _resetSourceRateLimits();
+});
+
+// Stop cleanup timer so it doesn't keep test runner alive
+afterEach(() => {
+  _stopSourceRateLimitCleanup();
+});
+
+describe("per-source rate limiting", () => {
+  describe("QPM enforcement", () => {
+    it("allows queries under the limit", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 5, concurrency: 10 });
+      for (let i = 0; i < 5; i++) {
+        expect(checkSourceRateLimit("test").allowed).toBe(true);
+      }
+    });
+
+    it("blocks queries over the QPM limit", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 3, concurrency: 10 });
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      const result = checkSourceRateLimit("test");
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toContain("QPM limit reached");
+      expect(result.retryAfterMs).toBeGreaterThan(0);
+    });
+
+    it("uses default limit (60 QPM) when no custom limit is set", () => {
+      for (let i = 0; i < 60; i++) {
+        expect(checkSourceRateLimit("unregistered").allowed).toBe(true);
+      }
+      expect(checkSourceRateLimit("unregistered").allowed).toBe(false);
+    });
+  });
+
+  describe("concurrency enforcement", () => {
+    it("allows queries under the concurrency limit", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 100, concurrency: 2 });
+      incrementSourceConcurrency("test");
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+    });
+
+    it("blocks queries at the concurrency limit", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 100, concurrency: 2 });
+      incrementSourceConcurrency("test");
+      incrementSourceConcurrency("test");
+      const result = checkSourceRateLimit("test");
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toContain("concurrency limit reached");
+    });
+
+    it("allows queries after decrementing concurrency", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 100, concurrency: 1 });
+      incrementSourceConcurrency("test");
+      expect(checkSourceRateLimit("test").allowed).toBe(false);
+      decrementSourceConcurrency("test");
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+    });
+
+    it("concurrency does not go below zero", () => {
+      decrementSourceConcurrency("test");
+      decrementSourceConcurrency("test");
+      // Should not throw, count stays at 0
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+    });
+  });
+
+  describe("per-source isolation", () => {
+    it("limits are independent per source", () => {
+      registerSourceRateLimit("a", { queriesPerMinute: 2, concurrency: 10 });
+      registerSourceRateLimit("b", { queriesPerMinute: 2, concurrency: 10 });
+
+      expect(checkSourceRateLimit("a").allowed).toBe(true);
+      expect(checkSourceRateLimit("a").allowed).toBe(true);
+      expect(checkSourceRateLimit("a").allowed).toBe(false); // a is at limit
+
+      expect(checkSourceRateLimit("b").allowed).toBe(true); // b is independent
+      expect(checkSourceRateLimit("b").allowed).toBe(true);
+    });
+  });
+
+  describe("registerSourceRateLimit + clearSourceRateLimit", () => {
+    it("custom limits override defaults", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 2, concurrency: 1 });
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      expect(checkSourceRateLimit("test").allowed).toBe(false);
+    });
+
+    it("clearSourceRateLimit reverts to defaults", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 1, concurrency: 10 });
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+      expect(checkSourceRateLimit("test").allowed).toBe(false);
+
+      _resetSourceRateLimits();
+      clearSourceRateLimit("test");
+      // Should use default (60 QPM) — should allow
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+    });
+  });
+
+  describe("_resetSourceRateLimits", () => {
+    it("clears all state", () => {
+      registerSourceRateLimit("test", { queriesPerMinute: 1, concurrency: 1 });
+      incrementSourceConcurrency("test");
+      checkSourceRateLimit("test");
+
+      _resetSourceRateLimits();
+
+      // After reset, limits/concurrency/windows are cleared
+      expect(checkSourceRateLimit("test").allowed).toBe(true);
+    });
+  });
+});