Disable sensitive challenge rate limit for test

server/im_http.go

@@ -62,6 +62,7 @@ const (
 	imVerificationResendAfterSeconds     = 60
 	imVerificationMaxAttempts            = 5
 	imVerificationCreateRateWindow       = time.Hour
+	imSensitiveChallengeRateLimitEnabled = false
 	imActionTokenExpiresInSeconds        = 300
 	imIndependentPasswordMaxAttempts     = 5
 	imIndependentPasswordLockSeconds     = 300
@@ -6245,6 +6246,7 @@ func currentUserPhone(tenantID types.TenantID, uid types.Uid) (string, error) {
 func createSensitiveChallenge(wrt http.ResponseWriter, req *http.Request, principal *imPrincipal, action, phone string) {
 	now := time.Now().UTC().Round(time.Millisecond)
 	phoneHash := hashIMSecret(principal.TenantID, "sensitive_action", phone, "phone")
+	if imSensitiveChallengeRateLimitEnabled {
 		active, err := store.Verifications.GetActive(principal.TenantID, "sensitive_action", phoneHash, now)
 		if err != nil && !errors.Is(err, types.ErrNotFound) {
 			writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)
@@ -6269,6 +6271,7 @@ func createSensitiveChallenge(wrt http.ResponseWriter, req *http.Request, princi
 			})
 			return
 		}
+	}
 	challengeID, err := randomIMToken(18)
 	if err != nil {
 		writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)

server/im_http_test.go

@@ -2194,12 +2194,13 @@ func TestServeIMSecurityChallengeVerifyIssuesActionToken(t *testing.T) {
 	}
 }
 
-func TestServeIMSecurityChallengeCreateReturnsActiveChallengeBeforeRateLimit(t *testing.T) {
+func TestServeIMSecurityChallengeCreateSkipsRateLimitWhenDisabled(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 	expectIMBearer(t, ctrl, "token-1", 7, 42)
 	oldUsers := store.Users
 	oldVerifications := store.Verifications
+	oldSender := sendIMVerificationCode
 	now := time.Now().UTC()
 	users := mock_store.NewMockUsersPersistenceInterface(ctrl)
 	users.EXPECT().Get(types.TenantID(7), types.Uid(42)).Return(&types.User{
@@ -2220,9 +2221,11 @@ func TestServeIMSecurityChallengeCreateReturnsActiveChallengeBeforeRateLimit(t *
 	}}
 	store.Users = users
 	store.Verifications = verifications
+	sendIMVerificationCode = func(_ types.TenantID, _, _, _, _ string) error { return nil }
 	defer func() {
 		store.Users = oldUsers
 		store.Verifications = oldVerifications
+		sendIMVerificationCode = oldSender
 	}()
 
 	req := httptest.NewRequest(http.MethodPost, "/v1/im/security/challenges",
@@ -2232,15 +2235,11 @@ func TestServeIMSecurityChallengeCreateReturnsActiveChallengeBeforeRateLimit(t *
 
 	serveIMSecurityChallenges(rec, req)
 
-	if rec.Code != http.StatusTooManyRequests {
+	if rec.Code != http.StatusOK {
-		t.Fatalf("status: got %d, want %d; body=%s", rec.Code, http.StatusTooManyRequests, rec.Body.String())
+		t.Fatalf("status: got %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
 	}
-	data := decodeIMHTTPResponse(t, rec).Details.(map[string]any)
+	if verifications.created == nil || verifications.created.Action != "close_youth_mode" {
-	if data["challenge_id"] != "challenge-active" {
+		t.Fatalf("expected a new challenge while sensitive challenge rate limit is disabled: %#v", verifications.created)
-		t.Fatalf("expected active challenge id, got %#v", data)
-	}
-	if verifications.created != nil {
-		t.Fatalf("should not create a new challenge while resend is cooling down: %#v", verifications.created)
 	}
 }