create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/middleware/__tests__/rate-limit-cross-isolate.db.test.ts

@@ -1,220 +0,0 @@
-/**
- * @file rate-limit-cross-isolate.db.test.ts
- *
- * LIVE-DATABASE proof of the shared store (#5040 D8: AC-1, AC-7, AC-8). Runs
- * only when `AILK_TEST_LIVE_DATABASE === "1"` — `apps/api/src/__tests__/setup.ts`
- * always sets a placeholder `DATABASE_URL`, so the usual
- * `DATABASE_URL ? describe : describe.skip` gate can't distinguish a real
- * database from the placeholder; `.github/workflows/api-postgres-compat.yml`'s
- * full-suite step sets this variable beside its real `DATABASE_URL`.
- *
- * Uses the `pg` driver directly (raw SQL), the same reason
- * `database/__tests__/prefixed-ids.db.test.ts` does: the generated Prisma
- * client is ESM-only and cannot load under this package's CJS ts-jest
- * transform. AC-1 drives the store's SQL through a `pg.Client` shim that
- * turns a tagged template's strings and values into `$1…$n` text, not
- * through the Prisma binding production uses — that binding is exercised by
- * `rate-limit-store.test.ts`'s mocked-SQL-client unit tests.
- */
-import { createHash, randomUUID } from "node:crypto";
-
-import Fastify, { type FastifyInstance } from "fastify";
-import { Client } from "pg";
-
-import {
-  createDatabaseRateLimitStore,
-  type RateLimitSqlClient,
-} from "../../lib/rate-limit-store.js";
-
-const describeDb =
-  process.env.AILK_TEST_LIVE_DATABASE === "1" ? describe : describe.skip;
-
-function sha256Hex(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-/** Turns a tagged template's strings + values into `$1…$n` text for `pg`. */
-function sqlClient(pgClient: Client): RateLimitSqlClient {
-  function toParamText(
-    strings: TemplateStringsArray,
-    values: readonly unknown[],
-  ): string {
-    let text = strings[0] ?? "";
-    for (let i = 0; i < values.length; i++) {
-      text += `$${i + 1}${strings[i + 1] ?? ""}`;
-    }
-    return text;
-  }
-
-  async function queryRaw(
-    strings: TemplateStringsArray,
-    ...values: unknown[]
-  ): Promise<unknown[]> {
-    const res = await pgClient.query(toParamText(strings, values), values);
-    return res.rows;
-  }
-
-  async function executeRaw(
-    strings: TemplateStringsArray,
-    ...values: unknown[]
-  ): Promise<number> {
-    const res = await pgClient.query(toParamText(strings, values), values);
-    return res.rowCount ?? 0;
-  }
-
-  return {
-    $queryRaw: queryRaw as RateLimitSqlClient["$queryRaw"],
-    $executeRaw: executeRaw as RateLimitSqlClient["$executeRaw"],
-  };
-}
-
-describeDb("rate limiter — the shared database store (live, #5040)", () => {
-  let db: Client;
-
-  beforeAll(async () => {
-    db = new Client({ connectionString: process.env.DATABASE_URL });
-    await db.connect();
-  });
-
-  afterAll(async () => {
-    await db.end();
-  });
-
-  it("AC-1: 20 concurrent requests spread 10/10 over two isolated module instances, one identity, perIpPerMinute 5 — exactly 5×200, 15×429, stored count 20", async () => {
-    const identity = `rl-demo-${randomUUID()}`;
-    const clientA = new Client({ connectionString: process.env.DATABASE_URL });
-    const clientB = new Client({ connectionString: process.env.DATABASE_URL });
-    await clientA.connect();
-    await clientB.connect();
-
-    let appA: FastifyInstance | undefined;
-    let appB: FastifyInstance | undefined;
-
-    // Each isolateModules block gives a fresh require cache: requiring
-    // rate-limit-store AND rate-limit inside it yields module instances
-    // distinct from every other test file's top-level import, with their
-    // own process-default-store memoization — exactly the D8 pattern PR
-    // #5544 already used for the memory-store proof.
-    jest.isolateModules(() => {
-      const storeMod: typeof import("../../lib/rate-limit-store") = require("../../lib/rate-limit-store");
-      const rateLimitMod: typeof import("../rate-limit") = require("../rate-limit");
-      const app = Fastify({ trustProxy: true });
-      app.register(rateLimitMod.rateLimitMiddleware, {
-        perIpPerMinute: 5,
-        store: storeMod.createDatabaseRateLimitStore(sqlClient(clientA)),
-      });
-      app.get("/test", async () => ({ ok: true }));
-      appA = app;
-    });
-
-    jest.isolateModules(() => {
-      const storeMod: typeof import("../../lib/rate-limit-store") = require("../../lib/rate-limit-store");
-      const rateLimitMod: typeof import("../rate-limit") = require("../rate-limit");
-      const app = Fastify({ trustProxy: true });
-      app.register(rateLimitMod.rateLimitMiddleware, {
-        perIpPerMinute: 5,
-        store: storeMod.createDatabaseRateLimitStore(sqlClient(clientB)),
-      });
-      app.get("/test", async () => ({ ok: true }));
-      appB = app;
-    });
-
-    if (!appA || !appB) {
-      throw new Error("isolateModules did not synchronously assign both apps");
-    }
-    await appA.ready();
-    await appB.ready();
-
-    try {
-      const inject = (app: FastifyInstance) =>
-        app.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": identity },
-        });
-      const results = await Promise.all([
-        ...Array.from({ length: 10 }, () => inject(appA!)),
-        ...Array.from({ length: 10 }, () => inject(appB!)),
-      ]);
-      const statuses = results.map((r) => r.statusCode);
-      expect(statuses.filter((s) => s === 200)).toHaveLength(5);
-      expect(statuses.filter((s) => s === 429)).toHaveLength(15);
-
-      const hash = sha256Hex(identity);
-      const row = await db.query(
-        `SELECT "count" FROM "rate_limit_counters" WHERE "key_hash" = $1`,
-        [hash],
-      );
-      expect(row.rows[0]?.count).toBe(20);
-    } finally {
-      await appA.close();
-      await appB.close();
-      await clientA.end();
-      await clientB.end();
-    }
-  });
-
-  it("AC-7: sweep deletes an expired row only on the interval trigger, never on 'limited'", async () => {
-    const store = createDatabaseRateLimitStore(sqlClient(db));
-    const now = Date.now();
-    const staleHash = sha256Hex(`rl-stale-${randomUUID()}`);
-    const openHash = sha256Hex(`rl-open-${randomUUID()}`);
-
-    await db.query(
-      `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ($1, $2, $3, 1)`,
-      [staleHash, now - 120_000, 60_000],
-    );
-    await db.query(
-      `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ($1, $2, $3, 1)`,
-      [openHash, now, 60_000],
-    );
-
-    await store.sweep(now, 60_000, "limited");
-    let rows = await db.query(
-      `SELECT "key_hash" FROM "rate_limit_counters" WHERE "key_hash" IN ($1, $2)`,
-      [staleHash, openHash],
-    );
-    expect(rows.rows).toHaveLength(2);
-
-    await store.sweep(now, 60_000, "interval");
-    rows = await db.query(
-      `SELECT "key_hash" FROM "rate_limit_counters" WHERE "key_hash" IN ($1, $2)`,
-      [staleHash, openHash],
-    );
-    expect(rows.rows.map((r: { key_hash: string }) => r.key_hash)).toEqual([
-      openHash,
-    ]);
-  });
-
-  it("AC-8: key_hash is always a sha256 digest, never the raw identity, and both format CHECKs hold", async () => {
-    const store = createDatabaseRateLimitStore(sqlClient(db));
-    const identity = `203.0.113.${1 + Math.floor(Math.random() * 254)}`;
-    const now = Date.now();
-    await store.hit(identity, now, 60_000);
-
-    const allRows = await db.query(`SELECT "key_hash" FROM "rate_limit_counters"`);
-    for (const row of allRows.rows as Array<{ key_hash: string }>) {
-      expect(row.key_hash).not.toContain("203.0.113");
-    }
-    const hash = sha256Hex(identity);
-    const matched = await db.query(
-      `SELECT 1 FROM "rate_limit_counters" WHERE "key_hash" = $1`,
-      [hash],
-    );
-    expect(matched.rows).toHaveLength(1);
-
-    await expect(
-      db.query(
-        `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ('not-hex', $1, 60000, 1)`,
-        [now],
-      ),
-    ).rejects.toThrow(/rate_limit_counters_key_hash_hex/);
-
-    await expect(
-      db.query(
-        `INSERT INTO "rate_limit_counters" ("id", "key_hash", "window_start_ms", "window_ms", "count") VALUES ('bad', $1, $2, 60000, 1)`,
-        [sha256Hex(`rl-bad-id-${randomUUID()}`), now],
-      ),
-    ).rejects.toThrow(/rate_limit_counters_id_format/);
-  });
-});

package/templates/apps/api/src/middleware/__tests__/rate-limit-store.test.ts

@@ -1,430 +0,0 @@
-/**
- * @file rate-limit-store.test.ts
- *
- * Unit tests for the rate limiter's database store seam (#5040 AC-2 to
- * AC-5). The SQL double below is a `RateLimitSqlClient` whose `$queryRaw` /
- * `$executeRaw` are `jest.fn()`s modeling the same upsert/sweep semantics as
- * the real SQL (`apps/api/src/lib/rate-limit-store.ts`'s `createDatabaseRateLimitStore`);
- * the SQL text itself is proved against a real Postgres by
- * `rate-limit-cross-isolate.db.test.ts` (AC-1, AC-7, AC-8). AC-6's own claim
- * ("the existing rate-limit.test.ts passes unedited") is checked by running
- * that file, not re-asserted here.
- */
-import { createHash } from "node:crypto";
-
-import Fastify, { type FastifyInstance } from "fastify";
-
-import {
-  createDatabaseRateLimitStore,
-  resolveRateLimitStoreKind,
-  type RateLimitSqlClient,
-} from "../../lib/rate-limit-store.js";
-import {
-  buildTrustedKeyDigests,
-  rateLimitMiddleware,
-  type RateLimitOptions,
-} from "../rate-limit.js";
-
-function sha256Hex(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-type Row = { count: number; windowStartMs: number; windowMs: number };
-
-/** A `RateLimitSqlClient` double over an in-memory `Map<keyHash, Row>`. */
-function armSqlDouble(): {
-  client: RateLimitSqlClient;
-  queryRaw: jest.Mock;
-  executeRaw: jest.Mock;
-  rows: Map<string, Row>;
-} {
-  const rows = new Map<string, Row>();
-
-  const queryRaw = jest.fn(
-    (strings: TemplateStringsArray, ...values: unknown[]) => {
-      const sql = strings.join("?");
-      const hash = values[0] as string;
-      const now = values[1] as number;
-      const windowMs = values[2] as number;
-
-      if (sql.includes("INSERT INTO")) {
-        const existing = rows.get(hash);
-        const fresh =
-          !existing || now - existing.windowStartMs >= windowMs;
-        const row: Row = fresh
-          ? { count: 1, windowStartMs: now, windowMs }
-          : { count: existing.count + 1, windowStartMs: existing.windowStartMs, windowMs };
-        rows.set(hash, row);
-        return Promise.resolve([
-          { count: row.count, window_start_ms: row.windowStartMs },
-        ]);
-      }
-      if (sql.includes("SELECT 1")) {
-        const row = rows.get(hash);
-        const open = row !== undefined && now - row.windowStartMs < windowMs;
-        return Promise.resolve(open ? [{ one: 1 }] : []);
-      }
-      return Promise.resolve([]);
-    },
-  );
-
-  const executeRaw = jest.fn(
-    (strings: TemplateStringsArray, ...values: unknown[]) => {
-      const sql = strings.join("?");
-      if (sql.includes("DELETE FROM")) {
-        const now = values[0] as number;
-        for (const [key, row] of rows) {
-          if (row.windowStartMs + row.windowMs <= now) rows.delete(key);
-        }
-      }
-      return Promise.resolve(0);
-    },
-  );
-
-  // eslint-disable-next-line no-restricted-syntax -- RateLimitSqlClient's methods are Prisma's overloaded tagged-template signature, which a jest.fn() double cannot structurally match; this double is the SQL boundary, same footing as lib/prisma.ts's own repo-standard test double.
-  const client = {
-    $queryRaw: queryRaw,
-    $executeRaw: executeRaw,
-  } as unknown as RateLimitSqlClient;
-
-  return { client, queryRaw, executeRaw, rows };
-}
-
-describe("AC-2 — the #7394 R-1 rule holds over the database store", () => {
-  const KEY = "a".repeat(32);
-  const noWarn = () => undefined;
-  const SCOPE = "leads";
-  const KEY_BUCKET = `${SCOPE}|key,0`;
-
-  function keyed(visitorIp: string): Record<string, string> {
-    return {
-      "x-forwarded-for": "198.51.100.1",
-      "x-ailk-visitor-forward-key": KEY,
-      "x-ailk-visitor-ip": visitorIp,
-    };
-  }
-
-  function buildApp(double: ReturnType<typeof armSqlDouble>): FastifyInstance {
-    const app = Fastify({ trustProxy: true });
-    app.register(rateLimitMiddleware, {
-      scope: SCOPE,
-      perIpPerMinute: 10,
-      perKeyPerMinute: 5,
-      trustedKeyDigests: buildTrustedKeyDigests(KEY, noWarn),
-      store: createDatabaseRateLimitStore(double.client),
-    } satisfies RateLimitOptions);
-    app.post("/v1/leads/submit", async () => ({ ok: true }));
-    return app;
-  }
-
-  async function post(app: FastifyInstance, visitorIp: string): Promise<number> {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      headers: keyed(visitorIp),
-    });
-    return res.statusCode;
-  }
-
-  it("a key over ceiling for a visitor with no open window: hitKey + hasOpenWindow run, hit does not", async () => {
-    const double = armSqlDouble();
-    const app = buildApp(double);
-    await app.ready();
-    try {
-      for (let i = 1; i <= 5; i++) expect(await post(app, `203.0.113.${i}`)).toBe(200);
-
-      const fresh = "203.0.113.50";
-      const freshHash = sha256Hex(`${SCOPE}|v0,${fresh}`);
-      const sixth = await app.inject({
-        method: "POST",
-        url: "/v1/leads/submit",
-        headers: keyed(fresh),
-      });
-      expect(sixth.statusCode).toBe(429);
-
-      const keyHash = sha256Hex(KEY_BUCKET);
-      const insertCalls = double.queryRaw.mock.calls.filter(
-        (call) =>
-          String((call[0] as TemplateStringsArray).join("?")).includes(
-            "INSERT INTO",
-          ),
-      );
-      expect(insertCalls.some((call) => call[1] === keyHash)).toBe(true);
-      // hasOpenWindow ran for the fresh visitor...
-      const selectCalls = double.queryRaw.mock.calls.filter(
-        (call) =>
-          String((call[0] as TemplateStringsArray).join("?")).includes(
-            "SELECT 1",
-          ),
-      );
-      expect(selectCalls.some((call) => call[1] === freshHash)).toBe(true);
-      // ...but no `hit` (INSERT) ran for the fresh visitor's own bucket.
-      expect(insertCalls.some((call) => call[1] === freshHash)).toBe(false);
-    } finally {
-      await app.close();
-    }
-  });
-
-  it("a key over ceiling for a visitor with an OPEN window still issues the visitor hit", async () => {
-    const double = armSqlDouble();
-    const app = buildApp(double);
-    await app.ready();
-    try {
-      // Visitor 1 opens its own window first (count 1, well under perIpPerMinute).
-      expect(await post(app, "203.0.113.1")).toBe(200);
-      for (let i = 2; i <= 5; i++) expect(await post(app, `203.0.113.${i}`)).toBe(200);
-
-      const visitor1Hash = sha256Hex(`${SCOPE}|v0,203.0.113.1`);
-      const before = double.queryRaw.mock.calls.filter(
-        (call) =>
-          String((call[0] as TemplateStringsArray).join("?")).includes(
-            "INSERT INTO",
-          ) && call[1] === visitor1Hash,
-      ).length;
-
-      // The key is now over ceiling; visitor 1 still has an open window.
-      await post(app, "203.0.113.1");
-
-      const after = double.queryRaw.mock.calls.filter(
-        (call) =>
-          String((call[0] as TemplateStringsArray).join("?")).includes(
-            "INSERT INTO",
-          ) && call[1] === visitor1Hash,
-      ).length;
-      expect(after).toBe(before + 1);
-    } finally {
-      await app.close();
-    }
-  });
-});
-
-describe("AC-3 — bounded, fail-open to the memory store, never to no limit (#5040 D5)", () => {
-  const IP = "203.0.113.9";
-
-  // Each half runs inside its own jest.isolateModules instance so D5's
-  // once-per-60-s fallback-warn throttle starts fresh for it — a shared
-  // module instance would let test (a)'s warn suppress test (b)'s.
-  function runIsolated(
-    build: (mod: typeof import("../rate-limit")) => Promise<void>,
-  ): Promise<void> {
-    return new Promise<void>((resolve, reject) => {
-      jest.isolateModules(() => {
-        const mod: typeof import("../rate-limit") = require("../rate-limit");
-        build(mod).then(resolve, reject);
-      });
-    });
-  }
-
-  it("(a) every SQL call rejecting: 10 succeed, the 11th is 429, exactly one fallback line with reason: error", async () => {
-    await runIsolated(async (mod) => {
-      // eslint-disable-next-line no-restricted-syntax -- see the SQL double above.
-      const client = {
-        $queryRaw: jest.fn().mockRejectedValue(new Error("db down")),
-        $executeRaw: jest.fn().mockRejectedValue(new Error("db down")),
-      } as unknown as RateLimitSqlClient;
-
-      const logLines: Array<Record<string, unknown>> = [];
-      const app = Fastify({
-        trustProxy: true,
-        logger: {
-          level: "warn",
-          stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
-        },
-      });
-      app.register(mod.rateLimitMiddleware, {
-        perIpPerMinute: 10,
-        store: createDatabaseRateLimitStore(client),
-      } satisfies RateLimitOptions);
-      app.get("/test", async () => ({ ok: true }));
-      await app.ready();
-
-      try {
-        for (let i = 0; i < 10; i++) {
-          const res = await app.inject({
-            method: "GET",
-            url: "/test",
-            headers: { "x-forwarded-for": IP },
-          });
-          expect(res.statusCode).toBe(200);
-        }
-        const eleventh = await app.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": IP },
-        });
-        expect(eleventh.statusCode).toBe(429);
-
-        const fallbackLines = logLines.filter(
-          (l) => l["event"] === "rate_limit_store_fallback",
-        );
-        expect(fallbackLines).toHaveLength(1);
-        expect(fallbackLines[0]?.["reason"]).toBe("error");
-        // No key, IP, hash or error message on the fallback line.
-        expect(JSON.stringify(fallbackLines)).not.toContain(IP);
-      } finally {
-        await app.close();
-      }
-    });
-  });
-
-  it("(b) a never-settling SQL call with storeTimeoutMs:50: each request answers within 1s, the 11th is 429, one fallback line with reason: timeout", async () => {
-    await runIsolated(async (mod) => {
-      // eslint-disable-next-line no-restricted-syntax -- see the SQL double above.
-      const client = {
-        $queryRaw: jest.fn(() => new Promise(() => undefined)),
-        $executeRaw: jest.fn(() => new Promise(() => undefined)),
-      } as unknown as RateLimitSqlClient;
-
-      const logLines: Array<Record<string, unknown>> = [];
-      const app = Fastify({
-        trustProxy: true,
-        logger: {
-          level: "warn",
-          stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
-        },
-      });
-      app.register(mod.rateLimitMiddleware, {
-        perIpPerMinute: 10,
-        storeTimeoutMs: 50,
-        store: createDatabaseRateLimitStore(client),
-      } satisfies RateLimitOptions);
-      app.get("/test", async () => ({ ok: true }));
-      await app.ready();
-
-      try {
-        for (let i = 0; i < 10; i++) {
-          const res = await app.inject({
-            method: "GET",
-            url: "/test",
-            headers: { "x-forwarded-for": IP },
-          });
-          expect(res.statusCode).toBe(200);
-        }
-        const eleventh = await app.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": IP },
-        });
-        expect(eleventh.statusCode).toBe(429);
-
-        const fallbackLines = logLines.filter(
-          (l) => l["event"] === "rate_limit_store_fallback",
-        );
-        expect(fallbackLines).toHaveLength(1);
-        expect(fallbackLines[0]?.["reason"]).toBe("timeout");
-      } finally {
-        await app.close();
-      }
-    });
-  }, 15_000);
-});
-
-describe("AC-4 — resolveRateLimitStoreKind (D4's table, all seven rows)", () => {
-  it.each<
-    [string, string | undefined, string | undefined, "memory" | "database", boolean]
-  >([
-    ["set + unset", "postgresql://x", undefined, "database", false],
-    ["set + database", "postgresql://x", "database", "database", false],
-    ["set + memory", "postgresql://x", "memory", "memory", false],
-    ["unset + memory", undefined, "memory", "memory", false],
-    ["unset + unset", undefined, undefined, "memory", false],
-    ["unset + database", undefined, "database", "memory", true],
-    ["set + garbage", "postgresql://x", "garbage", "database", true],
-  ])(
-    "%s -> %s (warns: %s)",
-    (_label, databaseUrl, store, expected, warns) => {
-      const warn = jest.fn();
-      const result = resolveRateLimitStoreKind(
-        { DATABASE_URL: databaseUrl, AILK_RATE_LIMIT_STORE: store },
-        warn,
-      );
-      expect(result).toBe(expected);
-      expect(warn).toHaveBeenCalledTimes(warns ? 1 : 0);
-    },
-  );
-
-  it("unset + garbage -> memory, with the same warning", () => {
-    const warn = jest.fn();
-    const result = resolveRateLimitStoreKind(
-      { DATABASE_URL: undefined, AILK_RATE_LIMIT_STORE: "garbage" },
-      warn,
-    );
-    expect(result).toBe("memory");
-    expect(warn).toHaveBeenCalledTimes(1);
-    expect(warn.mock.calls[0]?.[0]).toContain(
-      "AILK_RATE_LIMIT_STORE is not memory or database",
-    );
-  });
-});
-
-describe("AC-5 — the process default store, resolved and logged once per process", () => {
-  const prevDatabaseUrl = process.env.DATABASE_URL;
-  const prevStore = process.env.AILK_RATE_LIMIT_STORE;
-
-  afterEach(() => {
-    if (prevDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = prevDatabaseUrl;
-    if (prevStore === undefined) delete process.env.AILK_RATE_LIMIT_STORE;
-    else process.env.AILK_RATE_LIMIT_STORE = prevStore;
-  });
-
-  it("defaults to the database store when DATABASE_URL is set and AILK_RATE_LIMIT_STORE is unset, logging once", async () => {
-    let queryRawMock!: jest.Mock;
-
-    await new Promise<void>((resolve, reject) => {
-      jest.isolateModules(() => {
-        process.env.DATABASE_URL = "postgresql://test:test@localhost:5432/test";
-        delete process.env.AILK_RATE_LIMIT_STORE;
-
-        queryRawMock = jest.fn().mockResolvedValue([
-          { count: 1, window_start_ms: Date.now() },
-        ]);
-        const executeRawMock = jest.fn().mockResolvedValue(0);
-
-        jest.doMock("../../lib/prisma.js", () => ({
-          prisma: { $queryRaw: queryRawMock, $executeRaw: executeRawMock },
-        }));
-
-        const mod: typeof import("../rate-limit") = require("../rate-limit");
-
-        const logLines: Array<Record<string, unknown>> = [];
-        const app = Fastify({
-          trustProxy: true,
-          logger: {
-            level: "info",
-            stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
-          },
-        });
-        app.register(mod.rateLimitMiddleware, { perIpPerMinute: 10 });
-        app.register(async (child) => {
-          child.register(mod.rateLimitMiddleware, {
-            perIpPerMinute: 10,
-            scope: "leads",
-          });
-          child.get("/other", async () => ({ ok: true }));
-        });
-        app.get("/test", async () => ({ ok: true }));
-
-        app
-          .ready()
-          .then(() =>
-            app.inject({
-              method: "GET",
-              url: "/test",
-              headers: { "x-forwarded-for": "203.0.113.77" },
-            }),
-          )
-          .then((res) => {
-            expect(res.statusCode).toBe(200);
-            expect(queryRawMock).toHaveBeenCalledTimes(1);
-            const infoLines = logLines.filter(
-              (l) => l["rateLimitStore"] === "database",
-            );
-            expect(infoLines).toHaveLength(1);
-            return app.close();
-          })
-          .then(resolve, reject);
-      });
-    });
-  });
-});