Persist privacy-safe submission rate limits

apps/api/tests/test_rate_limit.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy import create_engine, select
+from sqlalchemy.orm import Session
+
+from app.database import Base
+from app.main import _check_rate_limit
+from app.models import SubmissionAttempt
+
+
+def test_rate_limit_is_persistent_and_does_not_store_raw_client() -> None:
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    with Session(engine) as db:
+        for _ in range(5):
+            _check_rate_limit("203.0.113.42", db)
+        with pytest.raises(HTTPException) as blocked:
+            _check_rate_limit("203.0.113.42", db)
+        assert blocked.value.status_code == 429
+        attempts = list(db.scalars(select(SubmissionAttempt)))
+        assert len(attempts) == 5
+        assert all(item.client_hash != "203.0.113.42" and len(item.client_hash) == 64 for item in attempts)
+        assert all(item.created_at.replace(tzinfo=timezone.utc) <= datetime.now(timezone.utc) for item in attempts)