src/core/middleware/middleware_ratelimiter.go defines seven limiter middlewares. Only LimitPwd and LimitForgotPwd are tested, plus LimitOtp as of #114. LimitROPC, LimitActivate, LimitResetPwd and LimitDCR have none, so nothing pins their keys, their budgets, or that they pass a request through when the limiter is disabled. This is a file whose whole purpose is bounding brute force and abuse.
#114 is the demonstration of what that costs. A branch in LimitOtp answered every request with an unreadable auth context with a blank 200 OK and an empty body, and it sat there undetected because no test exercised the function at all.
Two of the four are worth a case each beyond the obvious. LimitROPC returns early for grant_type != password, and its ParseForm failure branch calls next and skips the limit entirely; both are also covered by #107, so coordinate with that before writing them. LimitActivate and LimitResetPwd key on r.URL.Query().Get("email"), which is the empty string when the parameter is absent, collapsing every such request into one shared bucket.
Follow the shape already in the file: a run closure, t.Run subtests, and a "disabled limiter never blocks" case in each. AuthHelper has one method, so any stub needed is three lines and no generated mock is involved.
src/core/middleware/middleware_ratelimiter.godefines seven limiter middlewares. OnlyLimitPwdandLimitForgotPwdare tested, plusLimitOtpas of #114.LimitROPC,LimitActivate,LimitResetPwdandLimitDCRhave none, so nothing pins their keys, their budgets, or that they pass a request through when the limiter is disabled. This is a file whose whole purpose is bounding brute force and abuse.#114 is the demonstration of what that costs. A branch in
LimitOtpanswered every request with an unreadable auth context with a blank200 OKand an empty body, and it sat there undetected because no test exercised the function at all.Two of the four are worth a case each beyond the obvious.
LimitROPCreturns early forgrant_type != password, and itsParseFormfailure branch callsnextand skips the limit entirely; both are also covered by #107, so coordinate with that before writing them.LimitActivateandLimitResetPwdkey onr.URL.Query().Get("email"), which is the empty string when the parameter is absent, collapsing every such request into one shared bucket.Follow the shape already in the file: a
runclosure,t.Runsubtests, and a "disabled limiter never blocks" case in each.AuthHelperhas one method, so any stub needed is three lines and no generated mock is involved.