feat(multiplayer): bound control-plane websocket traffic

server/api/events_test.go

@@ -0,0 +1,39 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestWebSocketHandshakeRequiresRFC6455Version(t *testing.T) {
+	service := &Service{}
+	request := httptest.NewRequest(http.MethodGet, "/v1/events", nil)
+	request.Header.Set("Upgrade", "websocket")
+	request.Header.Set("Connection", "Upgrade")
+	request.Header.Set("Sec-WebSocket-Version", "12")
+	request.Header.Set("Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	recorder := httptest.NewRecorder()
+	service.controlPlaneEvent(recorder, request)
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("version 12 status = %d, want 400", recorder.Code)
+	}
+}
+
+func TestWebSocketMessageBudgetIsBoundedAndResets(t *testing.T) {
+	start := time.Unix(1000, 0)
+	window := start
+	count := 0
+	for i := 0; i < webSocketMessageLimit; i++ {
+		if !allowWebSocketMessage(start, &window, &count) {
+			t.Fatalf("message %d was rejected within the budget", i)
+		}
+	}
+	if allowWebSocketMessage(start, &window, &count) {
+		t.Fatal("message over the WebSocket budget was accepted")
+	}
+	if !allowWebSocketMessage(start.Add(webSocketMessageWindow), &window, &count) {
+		t.Fatal("WebSocket message budget did not reset")
+	}
+}