Add rate limiting and penetration check

app/tests/test_visited_cards.py

@@ -63,30 +63,44 @@ async def test_get_random_cards_valid():
 
 @pytest.mark.asyncio(loop_scope="session")
 async def test_get_random_cards_randomness():
+    if NO_ACTIVE_CARDS_STATUS:
+        pytest.skip(reason="No active cards in MongoDB")
+    elif ACTIVE_CARDS_LESS_THAN_TEN:
+        pytest.skip(reason="The number of active cards is less than 10 in MongoDB")
+
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
         params = {"user_id": EXIST_USER}
         response1 = await client.get("/get_random_cards", params=params)
         response2 = await client.get("/get_random_cards", params=params)
+        print(f"\nRandomness check: r1={response1.status_code}, r2={response2.status_code}")
+        assert response1.status_code == 200, f"First request returned {response1.status_code}: {response1.text}"
+        assert response2.status_code == 200, f"Second request returned {response2.status_code}: {response2.text}"
         result1 = response1.json().get("result")
         result2 = response2.json().get("result")
-        print(f"\nINPUT: endpoint=/get_random_cards (двойной вызов)\nOUTPUT 1: {result1}\nOUTPUT 2: {result2}")
+        print(f"\nINPUT: endpoint=/get_random_cards (double call)\nOUTPUT 1: {result1}\nOUTPUT 2: {result2}")
         if len(result1) == 10 and len(result2) == 10:
             assert result1 != result2
 
 @pytest.mark.asyncio(loop_scope="session")
 async def test_get_random_cards_parallel_requests():
+    """
+    Parallel requests to /get_random_cards.
+    Decorator limit: 5 requests/60s.
+    Make 3 parallel requests to stay within limit.
+    """
     if NO_ACTIVE_CARDS_STATUS:
         pytest.skip(reason="No active cards in MongoDB")
     elif ACTIVE_CARDS_LESS_THAN_TEN:
         pytest.skip(reason="The number of active cards is less than 10 in MongoDB")
-    else:
-        async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
-            params = {"user_id": EXIST_USER}
-            tasks = [client.get("/get_random_cards", params=params) for _ in range(5)]
-            responses = await asyncio.gather(*tasks)
-            for resp in responses:
-                print(f"\nParallel call: status={resp.status_code} | json={resp.json()}")
-                assert resp.status_code == 200
-                result = resp.json().get("result")
-                assert isinstance(result, list)
-                assert len(result) == 10
+
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as client:
+        params = {"user_id": EXIST_USER}
+        tasks = [client.get("/get_random_cards", params=params) for _ in range(3)]
+        responses = await asyncio.gather(*tasks)
+        for resp in responses:
+            print(f"\nParallel call: status={resp.status_code} | text={resp.text[:200]}")
+            assert resp.status_code == 200, (
+                f"Expected 200, got {resp.status_code}: {resp.text}"
+            )
+            result = resp.json().get("result")
+            assert isinstance(result, list)