From 50d3b43c4f3a0a2346832cd3f9c7a0ebc401919a Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 9 May 2026 12:47:48 -0500 Subject: [PATCH] test: BruteForceProtection plug skip branches for auth and socket paths --- .../plugs/brute_force_protection_test.exs | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/test/towerops_web/plugs/brute_force_protection_test.exs b/test/towerops_web/plugs/brute_force_protection_test.exs index f9e5293c..4a3c5232 100644 --- a/test/towerops_web/plugs/brute_force_protection_test.exs +++ b/test/towerops_web/plugs/brute_force_protection_test.exs @@ -122,6 +122,32 @@ defmodule ToweropsWeb.Plugs.BruteForceProtectionTest do end end + describe "call/2 skip branches" do + test "passes through immediately for authenticated users" do + user = Towerops.AccountsFixtures.user_fixture() + + conn = + build_conn() + |> assign(:current_user, user) + |> BruteForceProtection.call([]) + + refute conn.halted + # No before_send callback registered for authenticated users — they + # bypass the 404 tracker entirely. + assert conn.private[:before_send] in [nil, []] + end + + test "passes through immediately for agent socket paths" do + conn = + :get + |> Plug.Test.conn("/socket/agent/websocket") + |> BruteForceProtection.call([]) + + refute conn.halted + assert conn.private[:before_send] in [nil, []] + end + end + describe "ban status integration" do test "non-banned IP returns :allowed" do assert :allowed = BruteForce.check_ban_status("10.0.0.99")