224400 Enable throttling on GET route (#7703)

config/initializers/rack_attack.rb

@@ -51,6 +51,10 @@ def remote_ip
     req.ip if req.path.starts_with?('/check_in/v0') && (req.post? || req.get?)
   end
 
+  throttle('medical_copays/ip', limit: 20, period: 1.minute) do |req|
+    req.ip if req.path.starts_with?('/v0/medical_copays') && req.get?
+  end
+
   # Source: https://github.com/kickstarter/rack-attack#x-ratelimit-headers-for-well-behaved-clients
   Rack::Attack.throttled_response = lambda do |env|
     rate_limit = env['rack.attack.match_data']

spec/middleware/rack/attack_spec.rb

@@ -94,6 +94,28 @@ def app
     end
   end
 
+  describe 'medical_copays/ip' do
+    before do
+      allow_any_instance_of(MedicalCopays::VBS::Service).to receive(:get_copays).and_return([])
+    end
+
+    context 'when more than 20 requests' do
+      before do
+        20.times do
+          get '/v0/medical_copays', headers: headers
+
+          expect(last_response.status).to eq(401)
+        end
+      end
+
+      it 'throttles with status 429' do
+        get '/v0/medical_copays', headers: headers
+
+        expect(last_response.status).to eq(429)
+      end
+    end
+  end
+
   describe 'facility_locator/ip' do
     let(:endpoint) { '/facilities_api/v1/ccp/provider' }
     let(:headers) { { 'X-Real-Ip' => '1.2.3.4' } }