From 5da6793e268bfcf6de3b4a70fb28715b4cfc8726 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Mon, 30 Mar 2026 10:28:04 +0200
Subject: [PATCH] Revert "fix tests"

This reverts commit fe3c1f74bf968855cd6f33c89fbad6afb46a2599.
---
 app/controllers/api/account.php               |  8 ++--
 .../Account/AccountCustomClientTest.php       | 45 +++++++++++++++++++
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 5c96650101..328be7ff46 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -962,7 +962,7 @@ Http::patch('/v1/account/sessions/:sessionId')
 Http::post('/v1/account/sessions/email')
     ->alias('/v1/account/sessions')
     ->desc('Create email password session')
-    ->groups(['api', 'account', 'auth', 'session'])
+    ->groups(['api', 'account', 'auth', 'session', 'outgoingEmail'])
     ->label('event', 'users.[userId].sessions.[sessionId].create')
     ->label('scope', 'sessions.write')
     ->label('auth.type', 'email-password')
@@ -1269,7 +1269,7 @@ Http::post('/v1/account/sessions/anonymous')
 Http::post('/v1/account/sessions/token')
     ->desc('Create session')
     ->label('event', 'users.[userId].sessions.[sessionId].create')
-    ->groups(['api', 'account', 'session'])
+    ->groups(['api', 'account', 'session', 'outgoingEmail'])
     ->label('scope', 'sessions.write')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2698,7 +2698,7 @@ Http::post('/v1/account/tokens/email')
 Http::put('/v1/account/sessions/magic-url')
     ->desc('Update magic URL session')
     ->label('event', 'users.[userId].sessions.[sessionId].create')
-    ->groups(['api', 'account', 'session'])
+    ->groups(['api', 'account', 'session', 'outgoingEmail'])
     ->label('scope', 'sessions.write')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2748,7 +2748,7 @@ Http::put('/v1/account/sessions/magic-url')
 Http::put('/v1/account/sessions/phone')
     ->desc('Update phone session')
     ->label('event', 'users.[userId].sessions.[sessionId].create')
-    ->groups(['api', 'account', 'session'])
+    ->groups(['api', 'account', 'session', 'outgoingEmail'])
     ->label('scope', 'sessions.write')
     ->label('audits.event', 'session.create')
     ->label('audits.resource', 'user/{response.userId}')
diff --git a/tests/e2e/Services/Account/AccountCustomClientTest.php b/tests/e2e/Services/Account/AccountCustomClientTest.php
index 107dceaa5e..e4e3ebacf7 100644
--- a/tests/e2e/Services/Account/AccountCustomClientTest.php
+++ b/tests/e2e/Services/Account/AccountCustomClientTest.php
@@ -3,6 +3,7 @@
 namespace Tests\E2E\Services\Account;
 
 use Appwrite\Tests\Retry;
+use PHPUnit\Framework\Attributes\Group;
 use Tests\E2E\Client;
 use Tests\E2E\Scopes\ProjectCustom;
 use Tests\E2E\Scopes\Scope;
@@ -11,6 +12,7 @@ use Utopia\Database\DateTime;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Datetime as DatetimeValidator;
+use Utopia\System\System;
 
 use function sleep;
 
@@ -4150,4 +4152,47 @@ class AccountCustomClientTest extends Scope
 
         $this->assertEquals(401, $verification3['headers']['status-code']);
     }
+
+    #[Group('abuseEnabled')]
+    public function testEmailAbuseLimit(): void
+    {
+        if (System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') === 'disabled') {
+            $this->markTestSkipped('Abuse checks are disabled.');
+        }
+
+        $email = 'abuse.email.' . bin2hex(random_bytes(8)) . '@example.com';
+        $password = 'password';
+        $baseHeaders = [
+            'origin' => 'http://localhost',
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ];
+
+        $account = $this->client->call(Client::METHOD_POST, '/account', $baseHeaders, [
+            'userId' => ID::unique(),
+            'email' => $email,
+            'password' => $password,
+            'name' => 'Email Abuse Test',
+        ]);
+
+        $this->assertEquals(201, $account['headers']['status-code']);
+
+        // Successful requests up to the limit should all pass
+        for ($i = 0; $i < 20; $i++) {
+            $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+                'email' => $email,
+                'password' => $password,
+            ]);
+
+            $this->assertEquals(201, $session['headers']['status-code'], 'Request ' . ($i + 1) . ' of 20 should succeed.');
+        }
+
+        // The next request should be rate limited
+        $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', $baseHeaders, [
+            'email' => $email,
+            'password' => $password,
+        ]);
+
+        $this->assertEquals(429, $session['headers']['status-code']);
+    }
 }