#!/bin/bash

# Simple rate limit testing script for Immich-Folio
# It fires 15 rapid POST requests to the /api/auth endpoint.

ENDPOINT="http://localhost:3000/api/auth"
PAYLOAD='{"slug": "test", "password": "wrong"}'

echo "======================================"
echo "🛡️ Starting Rate-Limit Pentest..."
echo "Target: $ENDPOINT"
echo "Expected behavior: First 10 requests should be 40x (e.g. 401/400), subsequent requests should be 429."
echo "======================================"

for i in {1..15}
do
  echo -n "Request #$i: "
  
  # Fetch the HTTP status code
  HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d "$PAYLOAD" $ENDPOINT)
  
  if [ "$HTTP_STATUS" == "429" ]; then
    echo "🚨 HTTP 429 (Too Many Requests) -> RATE LIMIT TRIGGERED!"
  else
    echo "🟢 HTTP $HTTP_STATUS -> Allowed"
  fi
  
  # Sleep a tiny bit to avoid completely saturating local resources, but fast enough to hit the 10 RPM limit
  sleep 0.2
done

echo "======================================"
echo "Pentest completed! ✨"