mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-17 04:37:48 +00:00
lukaszraczylo
6d96e8869b
- fail-on-old regression tests for every shipped fix (R-rounds) - fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards - coverage-closing contract tests (health-check backend, TLS-posture reuse) - r154 ID-token fixture built from parts to avoid false-positive secret scan
36 lines
1.2 KiB
Go
36 lines
1.2 KiB
Go
package traefikoidc
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// TestBearerFailureTrackerSweepBoundsMemory guards the R117 sweep: under a
|
|
// flood of distinct source IPs (each failing once and never returning), the
|
|
// tracker must not grow unboundedly. The sweep runs when the map exceeds
|
|
// defaultBearerEntrySweepThreshold and drops stale entries, keeping memory
|
|
// bounded. A tracker without the sweep would reach ~N entries.
|
|
func TestBearerFailureTrackerSweepBoundsMemory(t *testing.T) {
|
|
bt := newBearerFailureTracker(20, time.Minute, time.Minute)
|
|
|
|
const n = 5000
|
|
for i := 0; i < n; i++ {
|
|
bt.recordFailure(fmt.Sprintf("10.0.%d.%d", (i/256)%256, i%256))
|
|
}
|
|
|
|
bt.mu.Lock()
|
|
size := len(bt.entries)
|
|
bt.mu.Unlock()
|
|
|
|
t.Logf("bearer tracker map size after %d distinct sources: %d", n, size)
|
|
// The sweep keeps the map bounded well below the raw source count;
|
|
// without it the map would hold ~n entries.
|
|
if size >= n {
|
|
t.Fatalf("bearer failure tracker grew to %d entries (one per source); sweep must bound it (n=%d)", size, n)
|
|
}
|
|
if size > defaultBearerEntrySweepThreshold+16 {
|
|
t.Fatalf("bearer failure tracker map size %d exceeds sweep bound %d+slack", size, defaultBearerEntrySweepThreshold)
|
|
}
|
|
}
|