add tests

tests/e2e/Services/Account/AccountBase.php

@@ -443,4 +443,47 @@ trait AccountBase
 
         $this->assertEquals($session['headers']['status-code'], 429);
     }
+
+    #[Group('abuseEnabled')]
+    public function testEmailAbuseLimit(): void
+    {
+        if (System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') === 'disabled') {
+            $this->markTestSkipped('Abuse checks are disabled.');
+        }
+
+        $email = 'abuse.email.' . bin2hex(random_bytes(8)) . '@example.com';
+        $password = 'password';
+        $baseHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ];
+
+        $account = $this->client->call(Client::METHOD_POST, '/account', $baseHeaders, [
+            'userId' => ID::unique(),
+            'email' => $email,
+            'password' => $password,
+            'name' => 'Email Abuse Test',
+        ]);
+
+        $this->assertEquals(201, $account['headers']['status-code']);
+
+        // Successful requests up to the limit should all pass
+        for ($i = 0; $i < 20; $i++) {
+            $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+                'email' => $email,
+                'password' => $password,
+            ]);
+
+            $this->assertEquals(201, $session['headers']['status-code'], 'Request ' . ($i + 1) . ' of ' . $emailAbuseLimit . ' should succeed.');
+        }
+
+        // The next request should be rate limited
+        $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+            'email' => $email,
+            'password' => $password,
+        ]);
+
+        $this->assertEquals(429, $session['headers']['status-code']);
+    }
 }