more unit tests

Author: joecorall

internal/helper/google_test.go

@@ -124,3 +124,23 @@ func TestFetchGoogleCrawlerIPs(t *testing.T) {
 		t.Fatalf("unexpected CIDRs: got %v want %v", got, want)
 	}
 }
+
+func TestFetchGoogleCrawlerIPsError(t *testing.T) {
+	log := slog.New(slog.NewTextHandler(os.Stdout, nil))
+
+	okServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"prefixes":[{"ipv4Prefix":"8.8.8.0/24"}]}`))
+	}))
+	defer okServer.Close()
+
+	errServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	defer errServer.Close()
+
+	_, err := FetchGoogleCrawlerIPs(log, okServer.Client(), []string{okServer.URL, errServer.URL})
+	if err == nil {
+		t.Fatal("expected error when one endpoint returns non-200")
+	}
+}

main_test.go

@@ -1629,3 +1629,148 @@ func TestPojChallengeGeneration(t *testing.T) {
 		t.Errorf("Expected PoJ JS URL in challenge page")
 	}
 }
+
+func TestPerformHealthCheckSuccessResetsFailures(t *testing.T) {
+	config := CreateConfig()
+	config.SiteKey = "test"
+	config.SecretKey = "test"
+	config.ProtectRoutes = []string{"/"}
+	config.CaptchaProvider = "turnstile"
+	config.PeriodSeconds = 3600
+	config.FailureThreshold = 2
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	bc, err := NewCaptchaProtect(ctx, nil, config, "test")
+	if err != nil {
+		t.Fatalf("Failed to create CaptchaProtect: %v", err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	bc.captchaConfig.js = server.URL
+	bc.recordHealthCheckFailure()
+
+	bc.performHealthCheck()
+
+	bc.mu.RLock()
+	defer bc.mu.RUnlock()
+	if bc.healthCheckFailureCount != 0 {
+		t.Fatalf("expected failure count reset to 0, got %d", bc.healthCheckFailureCount)
+	}
+	if bc.circuitState != circuitClosed {
+		t.Fatalf("expected circuit to be closed, got %v", bc.circuitState)
+	}
+}
+
+func TestPerformHealthCheckFailurePaths(t *testing.T) {
+	tests := []struct {
+		name      string
+		jsURL     string
+		status    int
+		expectErr bool
+	}{
+		{
+			name:   "404 considered failure",
+			status: http.StatusNotFound,
+		},
+		{
+			name:   "503 considered failure",
+			status: http.StatusServiceUnavailable,
+		},
+		{
+			name:      "invalid URL request creation failure",
+			jsURL:     "://invalid-url",
+			expectErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := CreateConfig()
+			config.SiteKey = "test"
+			config.SecretKey = "test"
+			config.ProtectRoutes = []string{"/"}
+			config.CaptchaProvider = "turnstile"
+			config.PeriodSeconds = 3600
+			config.FailureThreshold = 1
+
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			bc, err := NewCaptchaProtect(ctx, nil, config, "test")
+			if err != nil {
+				t.Fatalf("Failed to create CaptchaProtect: %v", err)
+			}
+
+			if tt.expectErr {
+				bc.captchaConfig.js = tt.jsURL
+			} else {
+				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+					w.WriteHeader(tt.status)
+				}))
+				defer server.Close()
+				bc.captchaConfig.js = server.URL
+			}
+
+			bc.performHealthCheck()
+
+			bc.mu.RLock()
+			defer bc.mu.RUnlock()
+			if bc.healthCheckFailureCount != 1 {
+				t.Fatalf("expected failure count 1, got %d", bc.healthCheckFailureCount)
+			}
+			if bc.circuitState != circuitOpen {
+				t.Fatalf("expected circuit to open, got %v", bc.circuitState)
+			}
+		})
+	}
+}
+
+func TestVerifyChallengePagePojFallbackUsesOneHourTTL(t *testing.T) {
+	config := CreateConfig()
+	config.SiteKey = "test-key"
+	config.SecretKey = "test-secret"
+	config.ProtectRoutes = []string{"/"}
+	config.CaptchaProvider = "turnstile"
+	config.PeriodSeconds = 3600
+	config.FailureThreshold = 1
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	bc, err := NewCaptchaProtect(ctx, nil, config, "test")
+	if err != nil {
+		t.Fatalf("Failed to create CaptchaProtect: %v", err)
+	}
+
+	// Open the circuit so PoJ becomes active fallback provider.
+	bc.recordHealthCheckFailure()
+
+	form := url.Values{}
+	form.Add("poj-captcha-response", "ok")
+	form.Add("destination", "%2F")
+	req := httptest.NewRequest(http.MethodPost, "/challenge", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rr := httptest.NewRecorder()
+	clientIP := "203.0.113.10"
+
+	status := bc.verifyChallengePage(rr, req, clientIP)
+	if status != http.StatusFound {
+		t.Fatalf("expected status %d, got %d", http.StatusFound, status)
+	}
+
+	item, found := bc.verifiedCache.Items()[clientIP]
+	if !found {
+		t.Fatalf("expected %s to be in verified cache", clientIP)
+	}
+
+	remaining := time.Until(time.Unix(0, item.Expiration))
+	if remaining < 50*time.Minute || remaining > 70*time.Minute {
+		t.Fatalf("expected PoJ fallback TTL around 1h, got %s", remaining)
+	}
+}