RunicGateway/website
3
0
Fork 0
Code Issues Pull Requests 1 Actions 1 Packages Projects Releases Activity

test(login): stop the backoff-guard test racing its own one-second lock #145

Merged
whitlocktech merged 1 commits from fix/login-backoff-flake into edge 2026-08-12 13:39:52 +00:00
Conversation 0 Commits 1 Files Changed 1 +7 -1
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
server/test/loginProtection.test.js
View File

@@ -60,7 +60,13 @@ test('backoffGuard returns a generic 429 while locked out', async () => {
a.post('/login', lp.backoffGuard, (req, res) => res.json({ ok: true })) a.post('/login', lp.backoffGuard, (req, res) => res.json({ ok: true }))
}) })
try { try {
lp.recordFailure('203.0.113.40') // lock the test client IP // Lock the test client IP. FIVE failures, not one: the lock is
// `BASE_MS * 2 ** (count - 1)`, so a single failure locks for exactly one
// second and this test then races the round trip. It lost that race on CI
// (200 instead of 429, request arriving 1,456 ms after the lock). Five
// failures lock for sixteen seconds, which is not a race. What is under
// test is the guard's ANSWER while locked out, and that is unchanged.
for (let i = 0; i < 5; i += 1) lp.recordFailure('203.0.113.40')
const res = await fetch(`${app.url}/login`, { const res = await fetch(`${app.url}/login`, {
method: 'POST', method: 'POST',
headers: { 'X-Forwarded-For': '203.0.113.40' }, headers: { 'X-Forwarded-For': '203.0.113.40' },