From 45929f4df766560f62e09f2bfc7fcf92cd3b31c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Fri, 27 Mar 2026 16:20:42 +0100
Subject: [PATCH] add tests

---
 tests/e2e/Services/Account/AccountBase.php | 43 ++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/tests/e2e/Services/Account/AccountBase.php b/tests/e2e/Services/Account/AccountBase.php
index a81da60968..b15362e48d 100644
--- a/tests/e2e/Services/Account/AccountBase.php
+++ b/tests/e2e/Services/Account/AccountBase.php
@@ -443,4 +443,47 @@ trait AccountBase
 
         $this->assertEquals($session['headers']['status-code'], 429);
     }
+
+    #[Group('abuseEnabled')]
+    public function testEmailAbuseLimit(): void
+    {
+        if (System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') === 'disabled') {
+            $this->markTestSkipped('Abuse checks are disabled.');
+        }
+
+        $email = 'abuse.email.' . bin2hex(random_bytes(8)) . '@example.com';
+        $password = 'password';
+        $baseHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ];
+
+        $account = $this->client->call(Client::METHOD_POST, '/account', $baseHeaders, [
+            'userId' => ID::unique(),
+            'email' => $email,
+            'password' => $password,
+            'name' => 'Email Abuse Test',
+        ]);
+
+        $this->assertEquals(201, $account['headers']['status-code']);
+
+        // Successful requests up to the limit should all pass
+        for ($i = 0; $i < 20; $i++) {
+            $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+                'email' => $email,
+                'password' => $password,
+            ]);
+
+            $this->assertEquals(201, $session['headers']['status-code'], 'Request ' . ($i + 1) . ' of ' . $emailAbuseLimit . ' should succeed.');
+        }
+
+        // The next request should be rate limited
+        $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+            'email' => $email,
+            'password' => $password,
+        ]);
+
+        $this->assertEquals(429, $session['headers']['status-code']);
+    }
 }