test: BruteForceProtection plug skip branches for auth and socket paths

test/towerops_web/plugs/brute_force_protection_test.exs

@@ -122,6 +122,32 @@ defmodule ToweropsWeb.Plugs.BruteForceProtectionTest do
     end
   end
 
+  describe "call/2 skip branches" do
+    test "passes through immediately for authenticated users" do
+      user = Towerops.AccountsFixtures.user_fixture()
+
+      conn =
+        build_conn()
+        |> assign(:current_user, user)
+        |> BruteForceProtection.call([])
+
+      refute conn.halted
+      # No before_send callback registered for authenticated users — they
+      # bypass the 404 tracker entirely.
+      assert conn.private[:before_send] in [nil, []]
+    end
+
+    test "passes through immediately for agent socket paths" do
+      conn =
+        :get
+        |> Plug.Test.conn("/socket/agent/websocket")
+        |> BruteForceProtection.call([])
+
+      refute conn.halted
+      assert conn.private[:before_send] in [nil, []]
+    end
+  end
+
   describe "ban status integration" do
     test "non-banned IP returns :allowed" do
       assert :allowed = BruteForce.check_ban_status("10.0.0.99")