Blame · Line-by-line history

`login-lockout.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

Normal view Raw

27d5fd3Claude	1	import { describe, expect, test } from "bun:test";
	2	import {
	3	evaluateLockout,
	4	retryAfterMinutes,
	5	LOGIN_FAIL_LIMIT,
	6	LOGIN_LOCKOUT_MS,
	7	} from "../lib/login-lockout";
	8
	9	const NOW = new Date("2026-06-12T12:00:00Z");
	10
	11	function minutesAgo(min: number): Date {
	12	return new Date(NOW.getTime() - min * 60_000);
	13	}
	14
	15	describe("evaluateLockout", () => {
	16	test("not locked with zero failures", () => {
	17	const s = evaluateLockout({ failureCount: 0, newestFailureAt: null, now: NOW });
	18	expect(s.locked).toBe(false);
	19	expect(s.retryAfterMs).toBe(0);
	20	});
	21
	22	test("not locked below the failure limit", () => {
	23	const s = evaluateLockout({
	24	failureCount: LOGIN_FAIL_LIMIT - 1,
	25	newestFailureAt: minutesAgo(1),
	26	now: NOW,
	27	});
	28	expect(s.locked).toBe(false);
	29	});
	30
	31	test("locked at the limit with a fresh failure", () => {
	32	const s = evaluateLockout({
	33	failureCount: LOGIN_FAIL_LIMIT,
	34	newestFailureAt: minutesAgo(1),
	35	now: NOW,
	36	});
	37	expect(s.locked).toBe(true);
	38	expect(s.retryAfterMs).toBe(LOGIN_LOCKOUT_MS - 60_000);
	39	});
	40
	41	test("lockout EXPIRES 15 minutes after the newest failure", () => {
	42	// This is the regression case: previously the lockout never expired
	43	// because blocked attempts were recorded as new failures.
	44	const s = evaluateLockout({
	45	failureCount: LOGIN_FAIL_LIMIT + 5,
	46	newestFailureAt: minutesAgo(16),
	47	now: NOW,
	48	});
	49	expect(s.locked).toBe(false);
	50	expect(s.retryAfterMs).toBe(0);
	51	});
	52
	53	test("boundary: exactly LOCKOUT_MS after newest failure is unlocked", () => {
	54	const s = evaluateLockout({
	55	failureCount: LOGIN_FAIL_LIMIT,
	56	newestFailureAt: new Date(NOW.getTime() - LOGIN_LOCKOUT_MS),
	57	now: NOW,
	58	});
	59	expect(s.locked).toBe(false);
	60	});
	61
	62	test("many failures but missing newest timestamp fails open", () => {
	63	const s = evaluateLockout({
	64	failureCount: 100,
	65	newestFailureAt: null,
	66	now: NOW,
	67	});
	68	expect(s.locked).toBe(false);
	69	});
	70	});
	71
	72	describe("retryAfterMinutes", () => {
	73	test("rounds up and is at least 1", () => {
	74	expect(
	75	retryAfterMinutes({ locked: true, failureCount: 10, retryAfterMs: 61_000 })
	76	).toBe(2);
	77	expect(
	78	retryAfterMinutes({ locked: true, failureCount: 10, retryAfterMs: 1 })
	79	).toBe(1);
	80	expect(
	81	retryAfterMinutes({ locked: false, failureCount: 0, retryAfterMs: 0 })
	82	).toBe(1);
	83	});
	84	});