wtclaude ec2b530be7 test(login): stop the backoff-guard test racing its own one-second lock ...

A single recordFailure() locks for BASE_MS * 2 ** 0 — exactly one second — and
the test then does a real HTTP round trip against it. On CI that round trip took
1,456 ms and the guard correctly answered 200, failing the run for a reason that
has nothing to do with what the test is about.

Five failures lock for sixteen seconds. The subject is the guard's answer while
locked out, which is unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-08-12 08:16:59 -05:00

..

_helper.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

_setup.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

adminModules.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

adminTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

adminUsers.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

announceJobs.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

announceLegs.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

appeals.pure.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appeals.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appLinks.test.js

feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist

2026-07-20 18:37:17 -05:00

authController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

authMe.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

authTrustedDevice.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

bootOrder.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

botInternalKey.test.js

Isolate internal bot-config route from the public listener (#33)

2026-07-04 17:35:07 -05:00

botScore.test.js

Add Bot Activity admin panel: banned-IP view + recent events + emergency unban

2026-07-03 02:31:25 -05:00

brandAssets.test.js

feat(theming): brand-asset overrides and a cached, settings-aware HTML shell

2026-08-07 20:09:56 -05:00

checkModuleIdentifiers.test.js

refactor(modules)!: de-UO core's copy, and enforce it (phase 3, slice 4)

2026-08-11 21:41:18 -05:00

csp.test.js

feat(security): soak the tightened CSP on report-only, with a same-origin sink

2026-07-27 15:19:26 -05:00

emailConfig.model.test.js

Modernize email: Gmail OAuth2 sending, configured under Settings

2026-07-07 22:29:27 -05:00

honeypot.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

htmlShell.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

inviteController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

invites.test.js

feat(provisioning): game-account signup, admin email invites, unlink (2.0)

2026-07-17 15:50:49 -05:00

loginProtection.test.js

test(login): stop the backoff-guard test racing its own one-second lock

2026-08-12 08:16:59 -05:00

mailer.test.js

Modernize email: Gmail OAuth2 sending, configured under Settings

2026-07-07 22:29:27 -05:00

mobileAuthBridge.model.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

mobileDeviceSessions.test.js

feat(auth): Active Devices — view/revoke mobile sessions

2026-07-20 17:01:47 -05:00

mobileSession.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

mobileSsoBridge.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

moderation.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

moderation.test.js

fix(moderation): windowValue must not fall back to the 30d total on a null column

2026-07-22 13:14:02 -05:00

moduleArchive.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleClientChunk.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

moduleDeclared.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

moduleDocsSpec.test.js

feat(modules): merge module OpenAPI fragments into /api/docs.json (phase 3, slice 5)

2026-08-11 22:57:37 -05:00

moduleInstall.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleLifecycle.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleLoader.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

moduleRegistries.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

modules.model.test.js

fix(modules): three defects a real install exposed (phase 4, slice 1)

2026-08-12 03:48:27 -05:00

moduleSchema.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

navOverrides.test.js

feat(theming): dropdown sections and added links in the public header

2026-08-08 00:42:19 -05:00

notificationsRoutes.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pages.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

passwordResetController.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

passwordResets.test.js

feat(auth): self-service password reset (backend + web)

2026-07-19 03:57:13 -05:00

playerAccounts.test.js

Fix player getAccount has_password: read the raw row, not sanitized req.user

2026-07-06 05:11:36 -05:00

playerRouteAccess.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

providers.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

publicBrand.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

publicController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

publicModules.test.js

feat(modules): publish the installed-module list at /api/v1/public/modules

2026-08-10 22:03:22 -05:00

publicVersion.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pushDispatch.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

recoveryCodes.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

registry.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

requireInternalKey.test.js

Isolate internal bot-config route from the public listener (#33)

2026-07-04 17:35:07 -05:00

routeManifest.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

secretBox.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

selfTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

session.test.js

Fix SSO flow-token / session type confusion (#32)

2026-07-04 21:54:58 -05:00

settingsGameSignup.test.js

refactor(client): delete the UO client half (phase 3, slice 3)

2026-08-11 18:39:55 -05:00

settingsTheming.test.js

feat(theming): wire the three navs and add the admin nav builder

2026-08-08 00:02:33 -05:00

ssoCallback.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00

ssoState.test.js

Enforce TOTP second factor on SSO login (#31)

2026-07-04 22:17:35 -05:00

ssoTrustedDevice.test.js

feat(auth): honor and establish trusted devices on the SSO login paths

2026-07-28 01:01:12 -05:00

themeResolve.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

totp.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

trustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

trustProxy.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

usernamePolicy.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00