server/test/loginProtection.test.js

@@ -60,7 +60,13 @@ test('backoffGuard returns a generic 429 while locked out', async () => {
     a.post('/login', lp.backoffGuard, (req, res) => res.json({ ok: true }))
   })
   try {
-    lp.recordFailure('203.0.113.40') // lock the test client IP
+    // Lock the test client IP. FIVE failures, not one: the lock is
+    // `BASE_MS * 2 ** (count - 1)`, so a single failure locks for exactly one
+    // second and this test then races the round trip. It lost that race on CI
+    // (200 instead of 429, request arriving 1,456 ms after the lock). Five
+    // failures lock for sixteen seconds, which is not a race. What is under
+    // test is the guard's ANSWER while locked out, and that is unchanged.
+    for (let i = 0; i < 5; i += 1) lp.recordFailure('203.0.113.40')
     const res = await fetch(`${app.url}/login`, {
       method: 'POST',
       headers: { 'X-Forwarded-For': '203.0.113.40' },