oups

internal/panel/auth/rate_limiter_test.go

@@ -0,0 +1,82 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestRateLimiterAllow(t *testing.T) {
+	r := NewRateLimiter()
+	if !r.Allow("user1") {
+		t.Error("fresh user should be allowed")
+	}
+}
+
+func TestRateLimiterLockAfterMaxAttempts(t *testing.T) {
+	r := NewRateLimiter()
+	id := "user2"
+	for i := 0; i < maxAttempts-1; i++ {
+		locked := r.Record(id)
+		if locked {
+			t.Fatalf("should not be locked before max attempts (attempt %d)", i+1)
+		}
+		if !r.Allow(id) {
+			t.Fatalf("should be allowed before lock (attempt %d)", i+1)
+		}
+	}
+	locked := r.Record(id)
+	if !locked {
+		t.Error("should be locked after max attempts")
+	}
+	if r.Allow(id) {
+		t.Error("locked user should not be allowed")
+	}
+}
+
+func TestRateLimiterReset(t *testing.T) {
+	r := NewRateLimiter()
+	id := "user3"
+	for i := 0; i < maxAttempts; i++ {
+		r.Record(id) //nolint
+	}
+	if r.Allow(id) {
+		t.Error("should be locked before reset")
+	}
+	r.Reset(id)
+	if !r.Allow(id) {
+		t.Error("should be allowed after reset")
+	}
+}
+
+func TestRateLimiterWindowReset(t *testing.T) {
+	r := NewRateLimiter()
+	id := "user4"
+	// Simulate 4 attempts within window then manually expire the window
+	for i := 0; i < maxAttempts-1; i++ {
+		r.Record(id) //nolint
+	}
+	// Manually expire the window
+	r.mu.Lock()
+	r.entries[id].firstAt = time.Now().Add(-windowMinutes*time.Minute - time.Second)
+	r.mu.Unlock()
+
+	// Next attempt should reset the window, not lock
+	locked := r.Record(id)
+	if locked {
+		t.Error("should not lock after window expired")
+	}
+}
+
+func TestRateLimiterRemainingLock(t *testing.T) {
+	r := NewRateLimiter()
+	id := "user5"
+	if r.RemainingLock(id) != 0 {
+		t.Error("no lock expected for fresh user")
+	}
+	for i := 0; i < maxAttempts; i++ {
+		r.Record(id) //nolint
+	}
+	if r.RemainingLock(id) == 0 {
+		t.Error("lock expected after max attempts")
+	}
+}