签入版本

tests/unit/middleware/test_middleware_order.py

@@ -0,0 +1,30 @@
+"""中间件注册顺序：限流须在 DB 会话/操作日志之外（更外层），
+否则被限流的请求仍先开 DB 会话、仍写操作日志，DoS 时放大 DB 与日志负担。"""
+from core.app import create_app
+
+
+def _middleware_names(app):
+    """按执行顺序（列表最前 = 最外层/先执行）提取各中间件名。"""
+    names = []
+    for m in app.user_middleware:
+        dispatch = getattr(m, 'kwargs', {}).get('dispatch')
+        if dispatch is not None:
+            names.append(getattr(dispatch, '__name__', str(dispatch)))
+        else:
+            names.append(getattr(m.cls, '__name__', str(m)))
+    return names
+
+
+def test_rate_limit_runs_before_db_session_and_operation_log():
+    names = _middleware_names(create_app())
+    # 限流必须比 DB 会话 / 操作日志更外层（先执行），拒绝请求不进入 DB 与日志
+    assert 'rate_limit_middleware' in names
+    assert names.index('rate_limit_middleware') < names.index('db_session_middleware')
+    assert names.index('rate_limit_middleware') < names.index('operation_log_middleware')
+
+
+def test_cors_is_outermost():
+    names = _middleware_names(create_app())
+    # CORS 在最外层，直接返回的响应也带 CORS 头
+    assert 'CORSMiddleware' in names
+    assert names.index('CORSMiddleware') == 0