name: "rate limit"

# any branch is useful for testing before a PR is submitted
on:
  push:
    paths-ignore:
      - "doc/**"
  pull_request:
    paths-ignore:
      - "doc/**"

permissions:
  contents: read

env:
  PNPM_HOME: ~/.pnpm-store

jobs:
  ratelimit:
    # run on pushes to any branch
    # run on PRs from external forks
    if: |
      (github.event_name != 'pull_request')
      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
    name: test
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v7
      - uses: actions/cache@v6
        name: Cache pnpm store
        with:
          path: ${{ env.PNPM_HOME }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-
      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false
      - name: Use Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      -
        name: docker network
        run: docker network create --subnet=172.23.0.0/16 ep_net
      -
        name: build docker image
        run: |
          docker build -f Dockerfile -t epl-debian-slim --build-arg NODE_ENV=develop .
          docker build -f src/tests/ratelimit/Dockerfile.nginx -t nginx-latest .
          docker build -f src/tests/ratelimit/Dockerfile.anotherip -t anotherip .
      -
        name: run docker images
        run: |
          docker run --name etherpad-docker -p 9000:9001 --rm --network ep_net --ip 172.23.42.2 -e 'TRUST_PROXY=true' epl-debian-slim &
          docker run --name nginx-docker -p 8081:80 --rm --network ep_net --ip 172.23.42.1 -d nginx-latest
          docker run --rm --network ep_net --ip 172.23.42.3 --name anotherip -dt anotherip
      -
        name: install dependencies and create symlink for ep_etherpad-lite
        run: pnpm install --frozen-lockfile
      -
        # The etherpad container is started in the background above; without
        # this wait the test step can hit nginx before etherpad is listening
        # and nginx returns 502, failing the run on a cold cache. Poll the
        # nginx-proxied endpoint (which is also what the test hits) until it
        # stops returning 5xx.
        name: Wait for etherpad behind nginx to be ready
        run: |
          # ~60s budget: 30 iterations × (1s curl timeout + 1s sleep).
          # Cold-start of the etherpad container is well under that.
          for i in $(seq 1 30); do
            if curl -fsS -o /dev/null --max-time 1 http://127.0.0.1:8081/; then
              echo "etherpad is ready behind nginx"
              exit 0
            fi
            sleep 1
          done
          echo "ERROR: etherpad behind nginx did not become ready in time"
          echo "--- docker ps ---"
          docker ps -a || true
          echo "--- nginx-docker logs ---"
          docker logs nginx-docker || true
          echo "--- etherpad-docker logs ---"
          docker logs etherpad-docker || true
          exit 1
      -
        name: run rate limit test
        run: |
          cd src/tests/ratelimit
          ./testlimits.sh