create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -1,1409 +0,0 @@
-/**
- * @file rate-limit.test.ts
- * Unit tests for the per-IP rate limit middleware (B5).
- *
- * Test runner: Jest (repo convention — jest.config.cjs uses ts-jest).
- * Time control: jest.spyOn(Date, 'now') for the window-rolls case. We
- * intentionally avoid jest.useFakeTimers() because it intercepts setImmediate,
- * which Fastify's avvio plugin system uses during app.ready() — causing all
- * tests to hang. Controlling Date.now() directly is sufficient since the
- * middleware's window logic only calls Date.now().
- * IP mocking: x-forwarded-for header on a trustProxy:true test server.
- *
- * Spec: docs/internal/specs/draft/ailk-mcp-mvp-pb-b5-rate-limit-spec.md
- */
-
-import Fastify, { type FastifyInstance } from "fastify";
-import {
-  rateLimitMiddleware,
-  __resetBuckets,
-  __bucketCount,
-  FORWARDED_VISITOR_ROUTES,
-  buildTrustedKeyDigests,
-  DEFAULT_PER_IP_PER_MINUTE_STRICT,
-  resolveRateLimitIdentity,
-  siteKeyReader,
-  SITE_KEYED_ROUTES,
-  DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
-  type RateLimitOptions,
-} from "../rate-limit.js";
-
-function buildApp(
-  opts: { perIpPerMinute?: number; windowMs?: number; maxBuckets?: number } = {},
-) {
-  const app = Fastify({ trustProxy: true });
-  app.register(rateLimitMiddleware, opts);
-  app.get("/test", async () => ({ ok: true }));
-  return app;
-}
-
-describe("per-IP rate limit middleware", () => {
-  let app: ReturnType<typeof buildApp>;
-
-  beforeEach(async () => {
-    __resetBuckets();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("allows requests within the per-minute budget (5 under default)", async () => {
-    app = buildApp({ perIpPerMinute: 10 });
-    await app.ready();
-
-    for (let i = 0; i < 5; i++) {
-      const res = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "1.2.3.4" },
-      });
-      expect(res.statusCode).toBe(200);
-    }
-  });
-
-  it("returns 429 on the 11th request within the window", async () => {
-    app = buildApp({ perIpPerMinute: 10 });
-    await app.ready();
-
-    for (let i = 0; i < 10; i++) {
-      const res = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "1.2.3.4" },
-      });
-      expect(res.statusCode).toBe(200);
-    }
-
-    const overLimit = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "1.2.3.4" },
-    });
-    expect(overLimit.statusCode).toBe(429);
-    const body = JSON.parse(overLimit.body);
-    expect(body).toMatchObject({ error: "rate_limited" });
-    expect(typeof body.retryAfterSeconds).toBe("number");
-  });
-
-  it("resets the budget after the window expires", async () => {
-    // windowMs is passed explicitly so the spy's return value uses the same window the middleware sees.
-    const windowMs = 60_000;
-    app = buildApp({ perIpPerMinute: 2, windowMs });
-    await app.ready();
-
-    const origin = Date.now();
-    const dateSpy = jest.spyOn(Date, "now").mockReturnValue(origin);
-
-    try {
-      // Exhaust the budget.
-      for (let i = 0; i < 2; i++) {
-        await app.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": "1.2.3.4" },
-        });
-      }
-
-      // Advance virtual time past the window.
-      dateSpy.mockReturnValue(origin + windowMs + 1);
-
-      // First request in the new window should succeed.
-      const afterRoll = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "1.2.3.4" },
-      });
-      expect(afterRoll.statusCode).toBe(200);
-    } finally {
-      dateSpy.mockRestore();
-    }
-  });
-
-  it("includes Retry-After header <= 60 on 429 responses", async () => {
-    app = buildApp({ perIpPerMinute: 1 });
-    await app.ready();
-
-    // Use the budget.
-    await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "10.0.0.1" },
-    });
-
-    // Trigger 429.
-    const over = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "10.0.0.1" },
-    });
-
-    expect(over.statusCode).toBe(429);
-    const retryAfter = Number(over.headers["retry-after"]);
-    expect(Number.isInteger(retryAfter)).toBe(true);
-    expect(retryAfter).toBeGreaterThanOrEqual(1);
-    expect(retryAfter).toBeLessThanOrEqual(60);
-  });
-
-  it("tracks independent buckets per IP", async () => {
-    app = buildApp({ perIpPerMinute: 2 });
-    await app.ready();
-
-    // Exhaust IP A.
-    for (let i = 0; i < 2; i++) {
-      await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "192.168.1.1" },
-      });
-    }
-    const ipA429 = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "192.168.1.1" },
-    });
-    expect(ipA429.statusCode).toBe(429);
-
-    // IP B should still have a fresh budget.
-    const ipB = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "192.168.1.2" },
-    });
-    expect(ipB.statusCode).toBe(200);
-  });
-
-  it("derives independent buckets from the ORIGINATING address when two visitors share a proxy hop (#4730)", async () => {
-    // Simulates a consumer site's Next.js server action forwarding the
-    // visitor's real IP as x-forwarded-for, with this API's own edge then
-    // appending the calling web function's shared egress IP as a second
-    // hop — the exact multi-hop shape a consumer double-hop produces
-    // (apps/web/app/[locale]/flows/[slug]/flow.actions.ts). With
-    // trustProxy:true, req.ip resolves to the LEFTMOST (originating)
-    // address, so two visitors sharing the same egress hop still get
-    // independent buckets — this is the failure #4730 reports: before the
-    // fix, ALL visitors behind one web function's egress IP shared ONE
-    // bucket.
-    app = buildApp({ perIpPerMinute: 1 });
-    await app.ready();
-    const SHARED_EGRESS = "9.9.9.9";
-
-    const visitorA = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": `20.0.0.1, ${SHARED_EGRESS}` },
-    });
-    expect(visitorA.statusCode).toBe(200);
-
-    // Visitor A's own second request, still behind the shared egress hop,
-    // correctly trips ITS OWN (now-exhausted) bucket.
-    const visitorAOverLimit = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": `20.0.0.1, ${SHARED_EGRESS}` },
-    });
-    expect(visitorAOverLimit.statusCode).toBe(429);
-
-    // Visitor B, behind the SAME shared egress hop, still has a fresh
-    // budget — the two are bucketed on the leftmost (visitor) address, not
-    // the shared egress IP.
-    const visitorB = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": `20.0.0.2, ${SHARED_EGRESS}` },
-    });
-    expect(visitorB.statusCode).toBe(200);
-  });
-
-  it("respects custom perIpPerMinute option over env/default", async () => {
-    app = buildApp({ perIpPerMinute: 3 });
-    await app.ready();
-
-    // 3 requests should succeed.
-    for (let i = 0; i < 3; i++) {
-      const res = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "5.5.5.5" },
-      });
-      expect(res.statusCode).toBe(200);
-    }
-
-    // 4th exceeds the custom limit of 3.
-    const fourth = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "5.5.5.5" },
-    });
-    expect(fourth.statusCode).toBe(429);
-  });
-
-  it("reads perIpPerMinute from AILK_RATE_LIMIT_PER_IP_PER_MINUTE env var when option is absent", async () => {
-    // Cover `Number(process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE) || 20` left-side truthy arm
-    // Build the app without a perIpPerMinute option so the env var path is taken
-    const prev = process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE;
-    process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE = "2";
-    try {
-      app = buildApp({}); // no perIpPerMinute — env var drives the limit
-      await app.ready();
-
-      // 2 requests should succeed (env-configured limit).
-      for (let i = 0; i < 2; i++) {
-        const res = await app.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": "7.7.7.7" },
-        });
-        expect(res.statusCode).toBe(200);
-      }
-
-      // 3rd request exceeds the env-configured limit of 2.
-      const third = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "7.7.7.7" },
-      });
-      expect(third.statusCode).toBe(429);
-    } finally {
-      if (prev === undefined) {
-        delete process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE;
-      } else {
-        process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE = prev;
-      }
-    }
-  });
-
-  it("evicts stale buckets when cleanup is triggered on 429 with a stale IP in store", async () => {
-    // Cover the stale-bucket delete arm inside evictStaleBuckets (line 54)
-    // Scenario: IP A exhausts budget at t=0, time advances past window, IP B hits 429 — cleanup evicts A's stale bucket
-    const windowMs = 60_000;
-    app = buildApp({ perIpPerMinute: 1, windowMs });
-    await app.ready();
-
-    const origin = Date.now();
-    const dateSpy = jest.spyOn(Date, "now").mockReturnValue(origin);
-
-    try {
-      // Exhaust IP A's budget at t=0.
-      await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "11.0.0.1" },
-      });
-
-      // Advance virtual time past the window so IP A's bucket is now stale.
-      dateSpy.mockReturnValue(origin + windowMs + 1);
-
-      // Exhaust IP B's budget (fresh window).
-      await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "11.0.0.2" },
-      });
-
-      // IP B's 2nd request triggers 429 → calls evictStaleBuckets → deletes IP A's stale bucket.
-      const res = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "11.0.0.2" },
-      });
-
-      expect(res.statusCode).toBe(429);
-      // Cleanup ran — IP A's stale bucket was deleted. IP A can now make fresh requests.
-      const resA = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": "11.0.0.1" },
-      });
-      expect(resA.statusCode).toBe(200);
-    } finally {
-      dateSpy.mockRestore();
-    }
-  });
-
-  it("triggers periodic cleanup after 100 requests in a single window", async () => {
-    // Cover `requestsSinceLastClean >= CLEAN_INTERVAL_REQUESTS` true arm (line 93)
-    // 100 requests from distinct IPs fill the bucket store; the 101st triggers eviction
-    app = buildApp({ perIpPerMinute: 200 }); // high limit so no 429 for first 100 requests
-    await app.ready();
-
-    // Send 100 requests from distinct IPs to advance requestsSinceLastClean to 100.
-    for (let i = 0; i < 100; i++) {
-      await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": `10.${Math.floor(i / 255)}.${i % 255}.1` },
-      });
-    }
-
-    // The 101st request (any IP) crosses the CLEAN_INTERVAL_REQUESTS threshold.
-    const res = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "10.1.0.99" },
-    });
-    // Cleanup fired — the route still responds normally.
-    expect(res.statusCode).toBe(200);
-  });
-
-  it("caps total distinct buckets at maxBuckets, evicting the oldest-inserted entry on overflow (#5111/#4780 AC-3)", async () => {
-    // A caller minting a fresh identity every request (e.g. a spoofed
-    // X-Forwarded-For under trustProxy:true) must not grow the in-house
-    // buckets Map without bound — independent of the EXISTING time-based
-    // eviction (which only fires on stale/expired windows). This test
-    // never lets any window expire, so ONLY the new entry-count cap can
-    // be responsible for keeping distinct-bucket growth bounded. A small
-    // maxBuckets is passed explicitly so the test doesn't need thousands
-    // of injected requests to reach the real production default.
-    const maxBuckets = 3;
-    app = buildApp({ perIpPerMinute: 200, maxBuckets });
-    await app.ready();
-
-    for (let i = 0; i < maxBuckets; i++) {
-      const res = await app.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": `172.16.0.${i}` },
-      });
-      expect(res.statusCode).toBe(200);
-      expect(__bucketCount()).toBe(i + 1);
-    }
-
-    // A 4th distinct identity must not push the store past maxBuckets —
-    // the oldest-inserted bucket is evicted to make room.
-    const overflowRes = await app.inject({
-      method: "GET",
-      url: "/test",
-      headers: { "x-forwarded-for": "203.0.113.99" },
-    });
-    expect(overflowRes.statusCode).toBe(200);
-    expect(__bucketCount()).toBe(maxBuckets);
-  });
-
-  it("exposes DEFAULT_PER_IP_PER_MINUTE_STRICT as the pre-#4730 per-scope default (10/min)", () => {
-    expect(DEFAULT_PER_IP_PER_MINUTE_STRICT).toBe(10);
-  });
-});
-
-/**
- * Cross-isolate demonstration (#5040 AC-1).
- *
- * The middleware's `buckets` store is module-scoped (see the module
- * docstring's SINGLE-REPLICA CAVEAT) — it is per-process state, not a
- * shared external store. On the real deployment target this means: each
- * serverless isolate that cold-loads this module gets its own empty Map,
- * so the same visitor IP is tracked independently per isolate rather than
- * against one shared counter.
- *
- * This process cannot spin up two real Vercel isolates (no live target —
- * see #5040's issue comment + docs/specs/5111-limiter-surface-spec.md §8
- * for the exact probe attempted and why it could not reach one as of
- * 2026-09-15). What IS fully within this process's control is the root
- * mechanism itself: module-scoped state does not survive a fresh module
- * load. `jest.isolateModules` gives each block below its own Jest module
- * registry, so requiring the middleware module inside each returns a
- * DISTINCT module instance with its own private `buckets` Map — the same
- * state-isolation shape a serverless cold start produces (a fresh module
- * load with an empty Map), reproduced deterministically in-process.
- *
- * This demonstrates — rather than merely asserts, per AC-1's own wording —
- * that the per-IP limit, UNDER THE MEMORY STORE, does NOT hold across
- * separate execution contexts: the same IP, already rate-limited to
- * exhaustion on one instance, is granted a fresh budget on another. This
- * pins the memory store's own documented trade-off (the SINGLE-REPLICA
- * CAVEAT) now that a database deployment defaults to the shared store
- * instead (#5040 D1/D4) — this test makes that trade-off provable rather
- * than only claimed in a comment, and will fail (correctly) if the memory
- * store's isolation is ever accidentally narrowed.
- *
- * What this test does NOT demonstrate: whether the LIVE deployment
- * actually runs more than one concurrent isolate for a given route today,
- * nor the database store's own cross-isolate behavior — that is
- * `rate-limit-cross-isolate.db.test.ts`'s job (#5040 AC-1).
- */
-describe("cross-isolate limit — the memory store does not hold by design (#5040, SINGLE-REPLICA CAVEAT)", () => {
-  it("the same IP, exhausted on one module instance, is freshly allowed on an independently-loaded instance", async () => {
-    const perIpPerMinute = 5;
-    const ip = "198.51.100.7";
-
-    let isolateAppA: ReturnType<typeof buildApp> | undefined;
-    let isolateAppB: ReturnType<typeof buildApp> | undefined;
-
-    // Each isolateModules block gets a fresh require cache: requiring the
-    // middleware module inside it yields a module instance distinct from
-    // the top-level `rateLimitMiddleware` import used by every other test
-    // in this file (and distinct from each other).
-    jest.isolateModules(() => {
-      const isolateA: typeof import("../rate-limit") = require("../rate-limit");
-      const app = Fastify({ trustProxy: true });
-      app.register(isolateA.rateLimitMiddleware, { perIpPerMinute });
-      app.get("/test", async () => ({ ok: true }));
-      isolateAppA = app;
-    });
-
-    jest.isolateModules(() => {
-      const isolateB: typeof import("../rate-limit") = require("../rate-limit");
-      const app = Fastify({ trustProxy: true });
-      app.register(isolateB.rateLimitMiddleware, { perIpPerMinute });
-      app.get("/test", async () => ({ ok: true }));
-      isolateAppB = app;
-    });
-
-    if (!isolateAppA || !isolateAppB) {
-      throw new Error("isolateModules did not synchronously assign both apps");
-    }
-
-    await isolateAppA.ready();
-    await isolateAppB.ready();
-
-    try {
-      // Exhaust isolate A's per-IP budget entirely.
-      for (let i = 0; i < perIpPerMinute; i++) {
-        const res = await isolateAppA.inject({
-          method: "GET",
-          url: "/test",
-          headers: { "x-forwarded-for": ip },
-        });
-        expect(res.statusCode).toBe(200);
-      }
-      const exhaustedOnA = await isolateAppA.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": ip },
-      });
-      expect(exhaustedOnA.statusCode).toBe(429);
-
-      // The SAME ip, already 429'd on A, hits an independently-loaded
-      // instance (B) for the first time — B's own buckets Map has never
-      // seen this IP, so it is granted a full fresh budget rather than
-      // being held to the aggregate limit across A+B. This is the
-      // cross-isolate gap: (perIpPerMinute × isolate count) requests
-      // succeed in aggregate for one IP, not perIpPerMinute.
-      const firstOnB = await isolateAppB.inject({
-        method: "GET",
-        url: "/test",
-        headers: { "x-forwarded-for": ip },
-      });
-      expect(firstOnB.statusCode).toBe(200);
-    } finally {
-      await isolateAppA.close();
-      await isolateAppB.close();
-    }
-  });
-});
-
-// #6019 AC-2 — the `pathOnly` split (#5970 security review, finding 1): a
-// route may carry its credential in the query string
-// (`/v1/requests/:id/confirm?token=…` does), and a 429 is a line an attacker
-// can provoke at will by tripping the limiter — logging the raw target would
-// let them farm credentials out of the operator's own log that way.
-describe("rate-limit warn log — no query-string credential (#5970)", () => {
-  it("scrubs the query string from the logged path on a 429", async () => {
-    __resetBuckets();
-    const logLines: Array<Record<string, unknown>> = [];
-    const app = Fastify({
-      trustProxy: true,
-      logger: {
-        level: "warn",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-    app.register(rateLimitMiddleware, { perIpPerMinute: 1 });
-    app.get("/v1/requests/:id/confirm", async () => ({ ok: true }));
-    await app.ready();
-
-    try {
-      const url = "/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN";
-      const headers = { "x-forwarded-for": "1.2.3.4" };
-      await app.inject({ method: "GET", url, headers });
-      const limited = await app.inject({ method: "GET", url, headers });
-      expect(limited.statusCode).toBe(429);
-
-      const logged = logLines.find((line) => line["msg"] === "rate_limited");
-      expect(logged?.["path"]).toBe("/v1/requests/callbk_1/confirm");
-      const text = JSON.stringify(logLines);
-      expect(text).not.toContain("SUPERSECRETTOKEN");
-      expect(text).not.toContain("token=");
-    } finally {
-      await app.close();
-    }
-  });
-});
-
-// #7394 — per-visitor leads limit for a server-to-server spoke
-// (docs/specs/7394-the-leads-rate-limit-scope-spec.md). Every route below is
-// `POST /v1/leads/submit` unless a case says otherwise, so it is in
-// `FORWARDED_VISITOR_ROUTES`. "The key" is one 64-character key passed
-// through `buildTrustedKeyDigests`.
-describe("per-visitor forwarding, scope namespace and per-scope env limit (#7394)", () => {
-  const KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
-  const SPOKE_HOST = "198.51.100.7";
-  const LEADS_SUBMIT = "/v1/leads/submit";
-  const ENV_KEYS = [
-    "AILK_RATE_LIMIT_LEADS_PER_MINUTE",
-    "AILK_RATE_LIMIT_LEADS_PER_KEY_PER_MINUTE",
-    "AILK_RATE_LIMIT_PER_IP_PER_MINUTE",
-  ] as const;
-  const priorEnv = new Map<string, string | undefined>(
-    ENV_KEYS.map((name) => [name, process.env[name]]),
-  );
-
-  const noWarn = () => undefined;
-  const digests = () => buildTrustedKeyDigests(KEY, noWarn);
-
-  let app: FastifyInstance | undefined;
-  let logLines: Array<Record<string, unknown>>;
-
-  function forwardApp(
-    opts: RateLimitOptions,
-    routes: readonly string[] = [LEADS_SUBMIT],
-  ): FastifyInstance {
-    const instance = Fastify({
-      trustProxy: true,
-      logger: {
-        level: "warn",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-    instance.register(rateLimitMiddleware, opts);
-    for (const url of routes) instance.post(url, async () => ({ ok: true }));
-    return instance;
-  }
-
-  function keyed(visitorIp: string, key: string = KEY): Record<string, string> {
-    return {
-      "x-forwarded-for": SPOKE_HOST,
-      "x-ailk-visitor-forward-key": key,
-      "x-ailk-visitor-ip": visitorIp,
-    };
-  }
-
-  async function post(
-    headers: Record<string, string>,
-    url: string = LEADS_SUBMIT,
-  ): Promise<number> {
-    if (!app) throw new Error("no app");
-    const res = await app.inject({ method: "POST", url, headers });
-    return res.statusCode;
-  }
-
-  function rateLimitedLines(): Array<Record<string, unknown>> {
-    return logLines.filter((line) => line["msg"] === "rate_limited");
-  }
-
-  beforeEach(() => {
-    __resetBuckets();
-    logLines = [];
-    for (const name of ENV_KEYS) delete process.env[name];
-  });
-
-  afterEach(async () => {
-    if (app) await app.close();
-    app = undefined;
-  });
-
-  afterAll(() => {
-    for (const [name, value] of priorEnv) {
-      if (value === undefined) delete process.env[name];
-      else process.env[name] = value;
-    }
-  });
-
-  describe("AC-1 — AILK_RATE_LIMIT_<SCOPE>_PER_MINUTE overrides the code value", () => {
-    async function firstRefused(): Promise<number> {
-      const headers = { "x-forwarded-for": "203.0.113.50" };
-      for (let i = 1; i <= 50; i++) {
-        if ((await post(headers)) === 429) return i;
-      }
-      return -1;
-    }
-
-    it("the env var wins over perIpPerMinute", async () => {
-      process.env.AILK_RATE_LIMIT_LEADS_PER_MINUTE = "3";
-      app = forwardApp({ scope: "leads", perIpPerMinute: 10 });
-      await app.ready();
-      expect(await firstRefused()).toBe(4);
-    });
-
-    it("with the env var unset, the code value applies", async () => {
-      app = forwardApp({ scope: "leads", perIpPerMinute: 10 });
-      await app.ready();
-      expect(await firstRefused()).toBe(11);
-    });
-
-    it("an invalid env var is ignored, with one warning naming the variable", async () => {
-      process.env.AILK_RATE_LIMIT_LEADS_PER_MINUTE = "abc";
-      app = forwardApp({ scope: "leads", perIpPerMinute: 10 });
-      await app.ready();
-      expect(await firstRefused()).toBe(11);
-      const warnings = logLines.filter((line) =>
-        String(line["msg"]).includes("AILK_RATE_LIMIT_LEADS_PER_MINUTE"),
-      );
-      expect(warnings).toHaveLength(1);
-    });
-
-    it.each(["0", "-5", "2.5", "1000000"])(
-      "ignores the out-of-range value %s",
-      async (value) => {
-        process.env.AILK_RATE_LIMIT_LEADS_PER_MINUTE = value;
-        app = forwardApp({ scope: "leads", perIpPerMinute: 10 });
-        await app.ready();
-        expect(await firstRefused()).toBe(11);
-      },
-    );
-
-    it("does not read AILK_RATE_LIMIT_PER_IP_PER_MINUTE for a named scope with a code value", async () => {
-      process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE = "2";
-      app = forwardApp({ scope: "leads", perIpPerMinute: 10 });
-      await app.ready();
-      expect(await firstRefused()).toBe(11);
-    });
-  });
-
-  describe("AC-2 — a named scope gets its own bucket namespace", () => {
-    function twoScopes(second: RateLimitOptions): FastifyInstance {
-      const instance = Fastify({ trustProxy: true });
-      instance.register(async (child) => {
-        child.register(rateLimitMiddleware, { perIpPerMinute: 10 });
-        child.post("/a", async () => ({ ok: true }));
-      });
-      instance.register(async (child) => {
-        child.register(rateLimitMiddleware, second);
-        child.post("/b", async () => ({ ok: true }));
-      });
-      return instance;
-    }
-    const headers = { "x-forwarded-for": "203.0.113.60" };
-
-    it("ten /a requests do not spend the leads scope's budget", async () => {
-      app = twoScopes({ scope: "leads", perIpPerMinute: 10 });
-      await app.ready();
-      for (let i = 0; i < 10; i++) expect(await post(headers, "/a")).toBe(200);
-      for (let i = 0; i < 10; i++) expect(await post(headers, "/b")).toBe(200);
-      expect(await post(headers, "/b")).toBe(429);
-    });
-
-    it("two unnamed registrations still share their count, as at the pin", async () => {
-      app = twoScopes({ perIpPerMinute: 10 });
-      await app.ready();
-      for (let i = 0; i < 10; i++) expect(await post(headers, "/a")).toBe(200);
-      expect(await post(headers, "/b")).toBe(429);
-    });
-  });
-
-  describe("AC-3 — a keyed lead write is counted per visitor", () => {
-    it("limits each forwarded visitor separately behind one spoke host", async () => {
-      app = forwardApp({
-        scope: "leads",
-        perIpPerMinute: 10,
-        perKeyPerMinute: 300,
-        trustedKeyDigests: digests(),
-      });
-      await app.ready();
-      for (let i = 0; i < 10; i++) expect(await post(keyed("203.0.113.1"))).toBe(200);
-      expect(await post(keyed("203.0.113.1"))).toBe(429);
-      expect(await post(keyed("203.0.113.2"))).toBe(200);
-    });
-  });
-
-  describe("AC-4 — the visitor header is ignored without the key, or off the lead writes", () => {
-    const WRONG_SAME_LENGTH = "f".repeat(64);
-    const ONE_CHAR_CHANGED = `${KEY.slice(0, -1)}0`;
-
-    async function elevenDistinctVisitors(
-      headersFor: (visitorIp: string) => Record<string, string>,
-      url: string = LEADS_SUBMIT,
-    ): Promise<number[]> {
-      const codes: number[] = [];
-      for (let i = 1; i <= 11; i++) codes.push(await post(headersFor(`203.0.113.${i}`), url));
-      return codes;
-    }
-
-    const base = {
-      scope: "leads",
-      perIpPerMinute: 10,
-      perKeyPerMinute: 300,
-    } as const;
-
-    it.each([
-      [
-        "(i) no key",
-        (ip: string) => ({ "x-forwarded-for": SPOKE_HOST, "x-ailk-visitor-ip": ip }),
-      ],
-      ["(ii) a wrong key of the same length", (ip: string) => keyed(ip, WRONG_SAME_LENGTH)],
-      ["(iii) the right key with one character changed", (ip: string) => keyed(ip, ONE_CHAR_CHANGED)],
-    ])("%s: the eleventh request is 429", async (_label, headersFor) => {
-      app = forwardApp({ ...base, trustedKeyDigests: digests() });
-      await app.ready();
-      const codes = await elevenDistinctVisitors(headersFor);
-      expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-      expect(codes[10]).toBe(429);
-    });
-
-    it("(iv) the valid key, but no trustedKeyDigests passed: the eleventh request is 429", async () => {
-      app = forwardApp(base);
-      await app.ready();
-      const codes = await elevenDistinctVisitors((ip) => keyed(ip));
-      expect(codes[10]).toBe(429);
-    });
-
-    // `POST /v1/project-listings` joined the list with #7479; the resume
-    // link's verification write shares its scope and stays off the list.
-    it("(v) the valid key on POST /v1/project-listings/drafts/:id/verify-email in the same scope: the eleventh request is 429", async () => {
-      app = forwardApp({ ...base, trustedKeyDigests: digests() }, [
-        LEADS_SUBMIT,
-        "/v1/project-listings/drafts/:id/verify-email",
-      ]);
-      await app.ready();
-      const codes = await elevenDistinctVisitors(
-        (ip) => keyed(ip),
-        "/v1/project-listings/drafts/listing_abc/verify-email",
-      );
-      expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-      expect(codes[10]).toBe(429);
-    });
-  });
-
-  // #7633 conductor amendment (the relay's security review, #7644): once a
-  // site relays its visitors' booking calls, every one reaches the hub from
-  // the site's server. The two relayed schedule routes join the keyed-visitor
-  // list, each under its own method only.
-  describe("the two relayed schedule routes count each keyed visitor separately (#7633)", () => {
-    const AVAILABILITY = "/v1/schedule/availability";
-    const BOOK = "/v1/schedule/book";
-    const EVENT_META = "/v1/schedule/event-meta";
-
-    /** A schedule-shaped scope: the four routes, each under GET and POST. */
-    function scheduleApp(): FastifyInstance {
-      const instance = Fastify({ trustProxy: true });
-      instance.register(rateLimitMiddleware, {
-        scope: "schedule",
-        perIpPerMinute: 10,
-        perKeyPerMinute: 300,
-        trustedKeyDigests: digests(),
-      });
-      for (const url of [AVAILABILITY, BOOK, EVENT_META, "/v1/schedule/meeting-types"]) {
-        instance.get(url, async () => ({ ok: true }));
-        instance.post(url, async () => ({ ok: true }));
-      }
-      return instance;
-    }
-
-    async function call(
-      method: "GET" | "POST",
-      url: string,
-      headers: Record<string, string>,
-    ): Promise<number> {
-      if (!app) throw new Error("no app");
-      const res = await app.inject({ method, url, headers });
-      return res.statusCode;
-    }
-
-    it.each<["GET" | "POST", string]>([
-      ["GET", AVAILABILITY],
-      ["POST", BOOK],
-    ])("%s %s: two visitors behind one site key are counted separately", async (method, url) => {
-      app = scheduleApp();
-      await app.ready();
-      for (let i = 0; i < 10; i++) {
-        expect(await call(method, url, keyed("203.0.113.1"))).toBe(200);
-      }
-      expect(await call(method, url, keyed("203.0.113.1"))).toBe(429);
-      expect(await call(method, url, keyed("203.0.113.2"))).toBe(200);
-    });
-
-    it.each<["GET" | "POST", string]>([
-      ["POST", AVAILABILITY],
-      ["GET", BOOK],
-      ["GET", EVENT_META],
-      ["GET", "/v1/schedule/meeting-types"],
-    ])("%s %s is not on the list: the key is ignored and the eleventh distinct visitor is 429", async (method, url) => {
-      app = scheduleApp();
-      await app.ready();
-      const codes: number[] = [];
-      for (let i = 1; i <= 11; i++) {
-        codes.push(await call(method, url, keyed(`203.0.113.${i}`)));
-      }
-      expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-      expect(codes[10]).toBe(429);
-    });
-
-    it("lists each route under its own method", () => {
-      expect(FORWARDED_VISITOR_ROUTES).toEqual([
-        { method: "POST", url: "/v1/leads/submit" },
-        { method: "POST", url: "/v1/leads/subscribe" },
-        { method: "POST", url: "/v1/leads/callback" },
-        { method: "GET", url: AVAILABILITY },
-        { method: "POST", url: BOOK },
-        { method: "POST", url: "/v1/consent/cookie" },
-        { method: "POST", url: "/v1/consent/unsubscribe" },
-        { method: "POST", url: "/v1/project-listings" },
-        { method: "PATCH", url: "/v1/project-listings/drafts/:id" },
-        { method: "POST", url: "/v1/project-listings/drafts/:id/submit" },
-        { method: "GET", url: "/v1/deliverables/open/:slug" },
-      ]);
-    });
-  });
-
-  // #8438 D5/D9 — the cookie banner's log and the unsubscribe landing. Each
-  // is registered in its OWN scope (`consent`, `unsubscribe`), exactly as
-  // server.ts does, and both are on the forwarded-visitor list.
-  describe("the consent routes count each keyed visitor separately, in scopes of their own (#8438)", () => {
-    const COOKIE = "/v1/consent/cookie";
-    const UNSUBSCRIBE = "/v1/consent/unsubscribe";
-
-    function consentApp(): FastifyInstance {
-      const instance = Fastify({ trustProxy: true });
-      for (const [scope, url] of [
-        ["consent", COOKIE],
-        ["unsubscribe", UNSUBSCRIBE],
-      ] as const) {
-        instance.register(async (scoped) => {
-          scoped.register(rateLimitMiddleware, {
-            scope,
-            perIpPerMinute: 10,
-            trustedKeyDigests: digests(),
-          });
-          scoped.post(url, async () => ({ ok: true }));
-        });
-      }
-      return instance;
-    }
-
-    async function post(url: string, headers: Record<string, string>): Promise<number> {
-      if (!app) throw new Error("no app");
-      return (await app.inject({ method: "POST", url, headers })).statusCode;
-    }
-
-    it.each([COOKIE, UNSUBSCRIBE])("%s: two visitors behind one site key are counted separately", async (url) => {
-      app = consentApp();
-      await app.ready();
-      for (let i = 0; i < 10; i++) {
-        expect(await post(url, keyed("203.0.113.1"))).toBe(200);
-      }
-      expect(await post(url, keyed("203.0.113.1"))).toBe(429);
-      expect(await post(url, keyed("203.0.113.2"))).toBe(200);
-    });
-
-    it("an exhausted consent bucket leaves unsubscribe answering", async () => {
-      app = consentApp();
-      await app.ready();
-      for (let i = 0; i < 10; i++) await post(COOKIE, keyed("203.0.113.1"));
-      expect(await post(COOKIE, keyed("203.0.113.1"))).toBe(429);
-      expect(await post(UNSUBSCRIBE, keyed("203.0.113.1"))).toBe(200);
-    });
-  });
-
-  describe("AC-5 — visitor IP validation and normalisation", () => {
-    function identityApp(): FastifyInstance {
-      const instance = Fastify({ trustProxy: true });
-      const trusted = digests();
-      instance.post(LEADS_SUBMIT, async (req) => resolveRateLimitIdentity(req, trusted));
-      return instance;
-    }
-
-    async function identityFor(visitorIp: string): Promise<unknown> {
-      if (!app) throw new Error("no app");
-      const res = await app.inject({ method: "POST", url: LEADS_SUBMIT, headers: keyed(visitorIp) });
-      return res.json();
-    }
-
-    it.each(["not-an-ip", "203.0.113.1, 198.51.100.1", "a".repeat(46), "fe80::1%eth0", ""])(
-      "falls back to req.ip for %j",
-      async (visitorIp) => {
-        app = identityApp();
-        await app.ready();
-        expect(await identityFor(visitorIp)).toEqual({ identity: SPOKE_HOST, keyIndex: null });
-      },
-    );
-
-    it("maps an IPv4-mapped IPv6 address to its IPv4 form", async () => {
-      app = identityApp();
-      await app.ready();
-      expect(await identityFor("::ffff:203.0.113.9")).toEqual({
-        identity: "v0,203.0.113.9",
-        keyIndex: 0,
-      });
-    });
-
-    it.each(["2001:db8:1:2::1", "2001:DB8:1:2::ffff"])(
-      "groups the IPv6 address %s by its /64",
-      async (visitorIp) => {
-        app = identityApp();
-        await app.ready();
-        expect(await identityFor(visitorIp)).toEqual({
-          identity: "v0,2001:0db8:0001:0002::/64",
-          keyIndex: 0,
-        });
-      },
-    );
-
-    it("keeps a valid IPv4 address as it is", async () => {
-      app = identityApp();
-      await app.ready();
-      expect(await identityFor(" 203.0.113.10 ")).toEqual({
-        identity: "v0,203.0.113.10",
-        keyIndex: 0,
-      });
-    });
-
-    it("ignores the key on a method other than POST", async () => {
-      const trusted = digests();
-      app = Fastify({ trustProxy: true });
-      app.get(LEADS_SUBMIT, async (req) => resolveRateLimitIdentity(req, trusted));
-      await app.ready();
-      const res = await app.inject({ method: "GET", url: LEADS_SUBMIT, headers: keyed("203.0.113.1") });
-      expect(res.json()).toEqual({ identity: SPOKE_HOST, keyIndex: null });
-    });
-  });
-
-  describe("AC-6 — buildTrustedKeyDigests keeps positions and never logs an entry", () => {
-    it("drops a short entry with one warning, keeps empty slots, and digests the real key", () => {
-      const warn = jest.fn();
-      const slots = buildTrustedKeyDigests(`short, ,${KEY}`, warn);
-      expect(slots).toHaveLength(3);
-      expect(slots[0]).toBeNull();
-      expect(slots[1]).toBeNull();
-      expect(Buffer.isBuffer(slots[2])).toBe(true);
-      expect(warn).toHaveBeenCalledTimes(1);
-      const message = String(warn.mock.calls[0]?.[0]);
-      expect(message).toContain("AILK_VISITOR_FORWARD_KEYS");
-      expect(message).not.toContain("short");
-    });
-
-    it("returns [] and warns nothing when the variable is unset or empty", () => {
-      const warn = jest.fn();
-      expect(buildTrustedKeyDigests(undefined, warn)).toEqual([]);
-      expect(buildTrustedKeyDigests("", warn)).toEqual([]);
-      expect(warn).not.toHaveBeenCalled();
-    });
-
-    it("counts a request presenting the short entry under req.ip", async () => {
-      app = forwardApp({
-        scope: "leads",
-        perIpPerMinute: 1,
-        trustedKeyDigests: buildTrustedKeyDigests(`short, ,${KEY}`, noWarn),
-      });
-      await app.ready();
-      expect(await post(keyed("203.0.113.1", "short"))).toBe(200);
-      expect(await post(keyed("203.0.113.2", "short"))).toBe(429);
-    });
-
-    it("gives the third entry's visitors a v2, identity and their own buckets", async () => {
-      const trusted = buildTrustedKeyDigests(`short, ,${KEY}`, noWarn);
-      app = Fastify({ trustProxy: true });
-      app.register(async (child) => {
-        child.register(rateLimitMiddleware, {
-          scope: "leads",
-          perIpPerMinute: 10,
-          trustedKeyDigests: trusted,
-        });
-        child.post(LEADS_SUBMIT, async (req) => resolveRateLimitIdentity(req, trusted));
-      });
-      await app.ready();
-      const first = await app.inject({ method: "POST", url: LEADS_SUBMIT, headers: keyed("203.0.113.1") });
-      expect((first.json() as { identity: string }).identity).toBe("v2,203.0.113.1");
-      for (let i = 0; i < 9; i++) expect(await post(keyed("203.0.113.1"))).toBe(200);
-      expect(await post(keyed("203.0.113.1"))).toBe(429);
-      expect(await post(keyed("203.0.113.2"))).toBe(200);
-    });
-  });
-
-  describe("AC-10 — the 429 log line names the bucket and key position, never the key", () => {
-    it("logs the namespaced identity, bucket and keyIndex for a visitor-bucket 429", async () => {
-      app = forwardApp({
-        scope: "leads",
-        perIpPerMinute: 10,
-        perKeyPerMinute: 300,
-        trustedKeyDigests: digests(),
-      });
-      await app.ready();
-      for (let i = 0; i < 10; i++) await post(keyed("203.0.113.1"));
-      expect(await post(keyed("203.0.113.1"))).toBe(429);
-
-      const [line] = rateLimitedLines();
-      expect(line?.["ip"]).toBe("v0,203.0.113.1");
-      expect(line?.["bucket"]).toBe("visitor");
-      expect(line?.["keyIndex"]).toBe(0);
-      const text = JSON.stringify(logLines);
-      expect(text).not.toContain(KEY);
-      expect(text).not.toContain("forward-key");
-    });
-  });
-
-  describe("AC-11 — each key has its own ceiling", () => {
-    const options = (): RateLimitOptions => ({
-      scope: "leads",
-      perIpPerMinute: 10,
-      perKeyPerMinute: 5,
-      trustedKeyDigests: digests(),
-    });
-
-    it("refuses the sixth keyed request across distinct visitors, with bucket: key", async () => {
-      app = forwardApp(options());
-      await app.ready();
-      for (let i = 1; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      const sixth = await app.inject({
-        method: "POST",
-        url: LEADS_SUBMIT,
-        headers: keyed("203.0.113.6"),
-      });
-      expect(sixth.statusCode).toBe(429);
-      const retryAfter = Number(sixth.headers["retry-after"]);
-      expect(retryAfter).toBeGreaterThanOrEqual(1);
-      expect(retryAfter).toBeLessThanOrEqual(60);
-      const [line] = rateLimitedLines();
-      expect(line?.["bucket"]).toBe("key");
-      expect(line?.["keyIndex"]).toBe(0);
-      expect(line?.["ip"]).toBe("v0,203.0.113.6");
-
-      // A request with no key, from a seventh visitor, is unaffected.
-      expect(await post({ "x-forwarded-for": "203.0.113.7" })).toBe(200);
-    });
-
-    it("reads AILK_RATE_LIMIT_LEADS_PER_KEY_PER_MINUTE over the option", async () => {
-      process.env.AILK_RATE_LIMIT_LEADS_PER_KEY_PER_MINUTE = "7";
-      app = forwardApp(options());
-      await app.ready();
-      for (let i = 1; i <= 7; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      expect(await post(keyed("203.0.113.8"))).toBe(429);
-    });
-
-    it("does not read the per-visitor variable for the per-key ceiling", async () => {
-      process.env.AILK_RATE_LIMIT_LEADS_PER_MINUTE = "50";
-      app = forwardApp(options());
-      await app.ready();
-      for (let i = 1; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      expect(await post(keyed("203.0.113.6"))).toBe(429);
-    });
-
-    it("visitor churn past maxBuckets cannot evict the key bucket and reset its ceiling", async () => {
-      app = forwardApp({ ...options(), maxBuckets: 3 });
-      await app.ready();
-      for (let i = 1; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      // Each refused request still adds a visitor bucket; with maxBuckets 3
-      // the oldest entries are evicted over and over.
-      for (let i = 6; i <= 20; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(429);
-    });
-
-    it("a key over its ceiling opens no new visitor bucket, so it cannot evict another scope's counter (security review R-1)", async () => {
-      app = Fastify({ trustProxy: true });
-      app.register(async (child) => {
-        child.register(rateLimitMiddleware, { perIpPerMinute: 1, maxBuckets: 10 });
-        child.post("/v1/auth/email", async () => ({ ok: true }));
-      });
-      app.register(async (child) => {
-        child.register(rateLimitMiddleware, { ...options(), maxBuckets: 10 });
-        child.post(LEADS_SUBMIT, async () => ({ ok: true }));
-      });
-      await app.ready();
-      const victim = { "x-forwarded-for": "198.51.100.99" };
-      expect(await post(victim, "/v1/auth/email")).toBe(200);
-      expect(await post(victim, "/v1/auth/email")).toBe(429);
-
-      for (let i = 1; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      for (let i = 6; i <= 60; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(429);
-
-      // The victim's exhausted counter survived the keyed churn.
-      expect(await post(victim, "/v1/auth/email")).toBe(429);
-    });
-
-    it("a key over its ceiling still counts a visitor whose bucket is already open", async () => {
-      app = forwardApp({ ...options(), perIpPerMinute: 2 });
-      await app.ready();
-      expect(await post(keyed("203.0.113.1"))).toBe(200);
-      for (let i = 2; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      // Key now at its ceiling of 5; visitor 1 has an open bucket at count 1.
-      expect(await post(keyed("203.0.113.1"))).toBe(429);
-      const [line] = rateLimitedLines();
-      expect(line?.["bucket"]).toBe("key");
-      // Visitor 1's own bucket was counted (now 2), so a third request trips
-      // the visitor bucket even once the key bucket is ignored.
-      expect(await post(keyed("203.0.113.1"))).toBe(429);
-      expect(rateLimitedLines()[1]?.["bucket"]).toBe("visitor");
-    });
-
-    it("defaults the per-key ceiling to 300 when no option is passed", async () => {
-      app = forwardApp({ scope: "leads", perIpPerMinute: 10, trustedKeyDigests: digests() });
-      await app.ready();
-      const codes: number[] = [];
-      for (let i = 0; i < 301; i++) {
-        codes.push(await post(keyed(`10.${Math.floor(i / 250)}.${i % 250}.1`)));
-      }
-      expect(codes.slice(0, 300).every((code) => code === 200)).toBe(true);
-      expect(codes[300]).toBe(429);
-    });
-  });
-
-  describe("AC-12 — no unkeyed req.ip can reach a keyed bucket", () => {
-    const options = (): RateLimitOptions => ({
-      scope: "leads",
-      perIpPerMinute: 10,
-      perKeyPerMinute: 5,
-      trustedKeyDigests: digests(),
-    });
-
-    it("unkeyed traffic shaped like a keyed bucket key adds nothing to the per-key bucket", async () => {
-      app = forwardApp(options());
-      await app.ready();
-      for (const forwarded of ["key:0", "key", "v0:203.0.113.1", "v0"]) {
-        for (let i = 0; i < 6; i++) await post({ "x-forwarded-for": forwarded });
-      }
-      for (let i = 1; i <= 5; i++) expect(await post(keyed(`203.0.113.${i}`))).toBe(200);
-      expect(await post(keyed("203.0.113.6"))).toBe(429);
-    });
-
-    it("ten unkeyed requests from v0:203.0.113.1 do not stop that keyed visitor", async () => {
-      app = forwardApp(options());
-      await app.ready();
-      for (let i = 0; i < 10; i++) await post({ "x-forwarded-for": "v0:203.0.113.1" });
-      expect(await post(keyed("203.0.113.1"))).toBe(200);
-    });
-  });
-
-  describe("registration guards", () => {
-    it.each(["Leads", "1leads", "le-ads", ""])("rejects the scope name %j", async (scope) => {
-      app = forwardApp({ scope });
-      await expect(app.ready()).rejects.toThrow(/scope/);
-    });
-
-    it("rejects trustedKeyDigests without a scope", async () => {
-      app = forwardApp({ trustedKeyDigests: digests() });
-      await expect(app.ready()).rejects.toThrow(/scope/);
-    });
-
-    it("lets a caller-supplied ipFromRequest win over the forwarded identity", async () => {
-      app = forwardApp({
-        scope: "leads",
-        perIpPerMinute: 1,
-        trustedKeyDigests: digests(),
-        ipFromRequest: () => "fixed",
-      });
-      await app.ready();
-      expect(await post(keyed("203.0.113.1"))).toBe(200);
-      expect(await post(keyed("203.0.113.2"))).toBe(429);
-    });
-  });
-});
-
-describe("the sign-up evidence read is counted per site key (#8805)", () => {
-  const SIGN_UP = "/v1/consent/sign-up";
-  const WEB_EGRESS = "198.51.100.20";
-  const VALID = "ailk_spk_valid-site-key";
-  const SPOKE_ID = "spoke_01920000-0000-7000-8000-0000000000b1";
-  const ENV_KEYS = [
-    "AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_MINUTE",
-    "AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE",
-  ] as const;
-  const priorEnv = new Map<string, string | undefined>(
-    ENV_KEYS.map((name) => [name, process.env[name]]),
-  );
-
-  let app: FastifyInstance | undefined;
-  let verify: jest.Mock<Promise<string | null>, [unknown]>;
-  let logLines: Array<Record<string, unknown>>;
-
-  function signUpApp(opts: Partial<RateLimitOptions> = {}): FastifyInstance {
-    const instance = Fastify({
-      trustProxy: true,
-      logger: {
-        level: "warn",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-    instance.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      perKeyPerMinute: 25,
-      scope: "signupevidence",
-      siteKeyOf: siteKeyReader(verify),
-      ...opts,
-    });
-    instance.get(SIGN_UP, async () => ({ ok: true }));
-    instance.get("/v1/other", async () => ({ ok: true }));
-    return instance;
-  }
-
-  async function statuses(
-    count: number,
-    headers: Record<string, string>,
-    url: string = SIGN_UP,
-  ): Promise<number[]> {
-    if (!app) throw new Error("no app");
-    const codes: number[] = [];
-    for (let i = 0; i < count; i++) {
-      const res = await app.inject({ method: "GET", url, headers });
-      codes.push(res.statusCode);
-    }
-    return codes;
-  }
-
-  const keyed = (ip: string = WEB_EGRESS, key: string = VALID) => ({
-    "x-forwarded-for": ip,
-    "x-ailk-spoke-key": key,
-  });
-
-  beforeEach(() => {
-    __resetBuckets();
-    logLines = [];
-    for (const name of ENV_KEYS) delete process.env[name];
-    verify = jest.fn((req: unknown) => {
-      const headers = (req as { headers: Record<string, unknown> }).headers;
-      return Promise.resolve(
-        headers["x-ailk-spoke-key"] === VALID ? SPOKE_ID : null,
-      );
-    });
-  });
-
-  afterEach(async () => {
-    if (app) await app.close();
-    app = undefined;
-  });
-
-  afterAll(() => {
-    for (const [name, value] of priorEnv) {
-      if (value === undefined) delete process.env[name];
-      else process.env[name] = value;
-    }
-  });
-
-  it("lists GET /v1/consent/sign-up as the one site-keyed route", () => {
-    expect(SITE_KEYED_ROUTES).toEqual([{ method: "GET", url: SIGN_UP }]);
-  });
-
-  it("names a per-key default well above the per-IP 10", () => {
-    expect(DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE).toBe(120);
-  });
-
-  it("admits keyed requests from one IP past 10 a minute, up to the key ceiling, then 429", async () => {
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(26, keyed());
-    expect(codes.slice(0, 25).every((code) => code === 200)).toBe(true);
-    expect(codes[25]).toBe(429);
-  });
-
-  it("refuses the eleventh keyless request from one IP with 429", async () => {
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(11, { "x-forwarded-for": WEB_EGRESS });
-    expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-    expect(codes[10]).toBe(429);
-    expect(verify).not.toHaveBeenCalled();
-  });
-
-  it("keeps an invalid key on the per-IP 10 a minute", async () => {
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(11, keyed(WEB_EGRESS, "ailk_spk_forged"));
-    expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-    expect(codes[10]).toBe(429);
-  });
-
-  it("an anonymous caller spoofing the web's X-Forwarded-For cannot spend the keyed budget", async () => {
-    app = signUpApp();
-    await app.ready();
-    // The spoofer fills the per-IP bucket of the web's own egress address…
-    const spoofed = await statuses(30, { "x-forwarded-for": WEB_EGRESS });
-    expect(spoofed[10]).toBe(429);
-    // …and with a forged key too.
-    await statuses(30, keyed(WEB_EGRESS, "ailk_spk_forged"));
-    // The keyed caller behind that address still has its whole budget.
-    const codes = await statuses(25, keyed());
-    expect(codes.every((code) => code === 200)).toBe(true);
-  });
-
-  it("many web instances behind one egress share the key bucket, not an IP bucket", async () => {
-    app = signUpApp();
-    await app.ready();
-    const codes: number[] = [];
-    for (let i = 0; i < 26; i++) {
-      codes.push(...(await statuses(1, keyed(`203.0.113.${i + 1}`))));
-    }
-    expect(codes.slice(0, 25).every((code) => code === 200)).toBe(true);
-    expect(codes[25]).toBe(429);
-  });
-
-  it("a verification failure counts the request per IP, never unlimited", async () => {
-    verify.mockRejectedValue(new Error("db down: postgres://secret"));
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(11, keyed());
-    expect(codes[10]).toBe(429);
-    const line = logLines.find(
-      (l) => l["event"] === "rate_limit_site_key_unverified",
-    );
-    expect(line).toBeDefined();
-    expect(JSON.stringify(logLines)).not.toContain("postgres://secret");
-    expect(JSON.stringify(logLines)).not.toContain(VALID);
-  });
-
-  it("a lookup that outlasts its timeout counts the request per IP", async () => {
-    verify.mockImplementation(() => new Promise<string | null>(() => undefined));
-    app = signUpApp({ siteKeyOf: siteKeyReader(verify, 5) });
-    await app.ready();
-    const codes = await statuses(11, keyed());
-    expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
-    expect(codes[10]).toBe(429);
-    expect(
-      logLines.some((l) => l["event"] === "rate_limit_site_key_unverified"),
-    ).toBe(true);
-  });
-
-  it("ignores a key on any route but the sign-up evidence read", async () => {
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(11, keyed(), "/v1/other");
-    expect(codes[10]).toBe(429);
-    expect(verify).not.toHaveBeenCalled();
-  });
-
-  it("verifies the key once per request, however many limiters read it", async () => {
-    const reader = siteKeyReader(verify);
-    app = signUpApp({ siteKeyOf: reader });
-    // A second reader of the same request, as the server-wide limiter is.
-    app.addHook("onRequest", async (req) => {
-      await reader(req);
-    });
-    await app.ready();
-    await statuses(3, keyed());
-    expect(verify).toHaveBeenCalledTimes(3);
-  });
-
-  it("reads AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE over the code value", async () => {
-    process.env.AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE = "12";
-    app = signUpApp();
-    await app.ready();
-    const codes = await statuses(13, keyed());
-    expect(codes.slice(0, 12).every((code) => code === 200)).toBe(true);
-    expect(codes[12]).toBe(429);
-  });
-
-  it("logs a keyed 429 with bucket site and the spoke id, never the key", async () => {
-    app = signUpApp({ perKeyPerMinute: 1 });
-    await app.ready();
-    await statuses(2, keyed());
-    const line = logLines.find((l) => l["msg"] === "rate_limited");
-    expect(line).toMatchObject({
-      ip: `site,${SPOKE_ID}`,
-      bucket: "site",
-    });
-    expect(JSON.stringify(logLines)).not.toContain(VALID);
-  });
-
-  it("rejects siteKeyOf without a scope", async () => {
-    app = signUpApp({ scope: undefined });
-    await expect(app.ready()).rejects.toThrow(/scope/);
-  });
-});