Push-Zeitmail: Review-Fixes (Rate-Limit begrenzt, kein NaN-Datum, Störung ≠ gelöscht)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/pushTimeRoute.test.js

@@ -8,6 +8,8 @@ let server
 let baseUrl
 let createPushTimeToken
 let resetPushTimeRateLimitForTests
+let isRateLimited
+let rateLimitSize
 
 const gitSheet = (id, extra = {}) => ({
   $id: id, wsid: '100300', woid: '100118', workorderId: 't1', serviceType: 'GIT',
@@ -38,6 +40,8 @@ before(async () => {
   })
   const routes = await import('../server/routes/pushTime.js')
   resetPushTimeRateLimitForTests = routes.resetPushTimeRateLimitForTests
+  isRateLimited = routes.isRateLimited
+  rateLimitSize = routes.pushTimeRateLimitSizeForTests
   ;({ createPushTimeToken } = await import('../server/services/pushTimeToken.js'))
 
   const app = express()
@@ -159,3 +163,22 @@ test('Rate-Limit: 31. Anfrage → 429', async () => {
   assert.equal(r.status, 429)
   assert.match(r.html, /Zu viele Anfragen/)
 })
+
+test('Rate-Limit-Speicher bleibt begrenzt (Review-Fix)', () => {
+  const now = Date.now()
+  for (let i = 0; i < 12000; i += 1) isRateLimited(`10.0.${Math.floor(i / 250)}.${i % 250}`, now)
+  assert.ok(rateLimitSize() <= 10000, `Größe ${rateLimitSize()}`)
+  // nach Ablauf des Fensters wird aufgeräumt
+  isRateLimited('10.9.9.9', now + 16 * 60 * 1000)
+  assert.equal(rateLimitSize(), 1)
+})
+
+test('Appwrite-Störung: neutrale HTML-Seite statt „Nicht mehr vorhanden“ (Review-Fix)', async () => {
+  const t = token('open1')
+  fake.failNext({ method: 'GET', pathIncludes: '/documents/open1', status: 500 })
+  const r = await get(`/zeit/${t}`)
+  assert.equal(r.status, 503)
+  assert.match(r.headers.get('content-type'), /text\/html/)
+  assert.match(r.html, /Bitte versuch es gleich noch einmal/)
+  assert.doesNotMatch(r.html, /Nicht mehr vorhanden|fakeAppwrite/)
+})