test(auth): deflake login rate-limit burst test under CPU load #10

fabi · 2026-06-16T18:04:50Z

fabi commented

2026-06-16 18:04:50 +00:00

Second load-induced flake (failed run #38). Fire empty-password logins (rate-limited before the 400 short-circuit, no argon2) so the burst drains the bucket faster than the 1/sec refill regardless of box load. Deterministic; bucket math still unit-tested separately.

fabi added 1 commit 2026-06-16 18:04:51 +00:00

test(auth): deflake login rate-limit burst test under CPU load

deploy / test-backend (pull_request) Has been cancelled

Details

deploy / test-frontend (pull_request) Has been cancelled

Details

deploy / build-and-push (pull_request) Has been cancelled

Details

deploy / deploy (pull_request) Has been cancelled

Details

a8bdc1a615

login_rate_limited_under_burst_pressure fired 30 wrong-password logins
sequentially; each runs argon2 (~1s under heavy CI load), which let the
per_sec=1 token-bucket refill keep exact pace with the loop so the bucket
never emptied and no 429 appeared (failed in run #38 while the box was
slammed). Fire empty-password logins instead: login checks the rate limiter
BEFORE short-circuiting empty creds with a 400, so each attempt still
consumes a token but skips argon2/DB and is near-instant — the burst drains
the bucket far faster than the 1/sec refill regardless of load. Bucket math
is already unit-tested in rate_limit.rs; this only proves the route is wired.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fabi merged commit 8445f338f6 into main

2026-06-16 18:04:54 +00:00

fabi referenced this issue from a commit

2026-06-16 18:04:55 +00:00

test(auth): deflake login rate-limit burst test under CPU load (#10)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: fabi/Mangalord#10