Optimize test suite: 710s to under 50s

teovl · teovl · commit 9eff50e9e87e · 2026-04-08T21:02:07.000-07:00
- Short dial timeouts (2s) on tests that expect connection failure
- Configurable webhook retry backoff (10ms in tests vs 1s production)
- Fast HTTP timeouts (200-500ms) for webhook tests hitting unreachable URLs
- Fix TestSecureHandshakeTimeout: close pipe peer for instant EOF vs 10s wait
- Reduce DLQ test sleeps (8s/2s to 500ms/200ms) with fast retry backoff
- Unblock server before Close() in dropped counter tests to avoid drain timeout
- TestEnv defaults: 500ms webhook HTTP timeout, 10ms retry backoff
- Reap threshold test updated for 5-minute threshold
diff --git a/tests/beacon_registry_test.go b/tests/beacon_registry_test.go
@@ -168,8 +168,8 @@ func TestReapStaleNodes(t *testing.T) {
 		t.Fatalf("lookup before reap: %v", err)
 	}
 
-	// Advance clock past stale threshold (3 minutes)
-	clk.Advance(4 * time.Minute)
+	// Advance clock past stale threshold (5 minutes)
+	clk.Advance(6 * time.Minute)
 
 	// Trigger reap
 	reg.Reap()
diff --git a/tests/fuzz_secure_test.go b/tests/fuzz_secure_test.go
@@ -91,11 +91,10 @@ func TestSecureHandshakeClosedMidExchange(t *testing.T) {
 }
 
 func TestSecureHandshakeTimeout(t *testing.T) {
-	c1, _ := net.Pipe() // c2 is intentionally unused — simulates slow peer
+	c1, c2 := net.Pipe()
 	defer c1.Close()
-
-	// Override timeout by setting a short deadline
-	c1.SetDeadline(time.Now().Add(100 * time.Millisecond))
+	// Close c2 immediately so c1 reads hit EOF (not a 10s handshake timeout).
+	c2.Close()
 
 	_, err := secure.Handshake(c1, true)
 	if err == nil {
diff --git a/tests/fuzz_webhook_test.go b/tests/fuzz_webhook_test.go
@@ -188,13 +188,16 @@ func TestWebhookClientServerError(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	wc := daemon.NewWebhookClient(ts.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(ts.URL, func() uint32 { return 1 },
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("test", nil) // server error should not crash
 	wc.Close()
 }
 
 func TestWebhookClientBadURL(t *testing.T) {
-	wc := daemon.NewWebhookClient("http://127.0.0.1:1", func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient("http://127.0.0.1:1", func() uint32 { return 1 },
+		daemon.WithHTTPTimeout(200*time.Millisecond),
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("test", nil) // connection refused should not crash
 	wc.Close()
 }
diff --git a/tests/integration_test.go b/tests/integration_test.go
@@ -983,13 +983,14 @@ func TestIntegration_WebhookDLQWithRealServer(t *testing.T) {
 	}))
 	defer failServer.Close()
 
-	rc, _, cleanup := startTestRegistryWithAdmin(t)
+	rc, reg, cleanup := startTestRegistryWithAdmin(t)
 	defer cleanup()
 
 	_, err := rc.SetWebhook(failServer.URL, TestAdminToken)
 	if err != nil {
 		t.Fatalf("set webhook: %v", err)
 	}
+	reg.SetWebhookRetryBackoff(10 * time.Millisecond) // fast retries in tests
 
 	// Trigger events
 	ownerID, _ := registerTestNode(t, rc)
@@ -998,8 +999,8 @@ func TestIntegration_WebhookDLQWithRealServer(t *testing.T) {
 		t.Fatalf("create network: %v", err)
 	}
 
-	// Wait for retries to exhaust (3 retries * exponential backoff)
-	time.Sleep(8 * time.Second)
+	// Wait for retries to exhaust (3 retries * fast backoff)
+	time.Sleep(500 * time.Millisecond)
 
 	whResp, err := rc.GetWebhook(TestAdminToken)
 	if err != nil {
diff --git a/tests/metrics_test.go b/tests/metrics_test.go
@@ -528,7 +528,7 @@ func TestPerNetworkMetrics(t *testing.T) {
 // TestWebhookDLQ verifies the dead letter queue for failed webhook deliveries.
 func TestWebhookDLQ(t *testing.T) {
 	t.Parallel()
-	rc, _, cleanup := startTestRegistryWithAdmin(t)
+	rc, reg, cleanup := startTestRegistryWithAdmin(t)
 	defer cleanup()
 
 	// Configure webhook to an endpoint that always returns 500
@@ -547,10 +547,11 @@ func TestWebhookDLQ(t *testing.T) {
 	if err != nil {
 		t.Fatalf("set webhook: %v", err)
 	}
+	reg.SetWebhookRetryBackoff(10 * time.Millisecond) // fast retries in tests
 
 	// Trigger audit events that will fail to deliver
 	registerTestNode(t, rc)
-	time.Sleep(2 * time.Second) // wait for retries
+	time.Sleep(200 * time.Millisecond) // wait for retries
 
 	// Check webhook stats
 	whResp, err := rc.GetWebhook(TestAdminToken)
diff --git a/tests/syn_trust_gate_test.go b/tests/syn_trust_gate_test.go
@@ -35,8 +35,9 @@ func TestSYNFromUntrustedNodeRejected(t *testing.T) {
 	// (e.g., from a cached previous session). The trust gate is defense-in-depth.
 	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
 
-	// Server listens on port 7 (echo) by default, so dial should fail via trust gate
-	_, err := client.Driver.DialAddr(server.Daemon.Addr(), 7)
+	// Server listens on port 7 (echo) by default, so dial should fail via trust gate.
+	// Use short timeout — we expect rejection, not a 30s dial timeout.
+	_, err := client.Driver.DialAddrTimeout(server.Daemon.Addr(), 7, 2*time.Second)
 	if err == nil {
 		t.Fatal("expected dial to fail between untrusted nodes, but it succeeded")
 	}
@@ -183,8 +184,9 @@ func TestSYNRejectionWebhook(t *testing.T) {
 	// Pre-populate client's tunnel with server's address to bypass resolve
 	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
 
-	// Attempt connection — should be rejected by trust gate
-	_, _ = client.Driver.DialAddr(server.Daemon.Addr(), 7)
+	// Attempt connection — should be rejected by trust gate.
+	// Use short timeout — we expect rejection, not a 30s dial timeout.
+	_, _ = client.Driver.DialAddrTimeout(server.Daemon.Addr(), 7, 2*time.Second)
 
 	// Wait for syn.rejected webhook event
 	ev, ok := collector.WaitFor("syn.rejected", 3*time.Second)
diff --git a/tests/testenv.go b/tests/testenv.go
@@ -123,13 +123,15 @@ func (env *TestEnv) AddDaemon(opts ...func(*daemon.Config)) *DaemonInfo {
 	identityPath := filepath.Join(env.tmpDir, fmt.Sprintf("identity-%d.json", idx))
 
 	cfg := daemon.Config{
-		RegistryAddr: env.RegistryAddr,
-		BeaconAddr:   env.BeaconAddr,
-		ListenAddr:   ":0",
-		SocketPath:   sockPath,
-		IdentityPath: identityPath, // persist identity to avoid pubkey mismatch on restart
-		Email:        fmt.Sprintf("test-%d@pilot.local", idx),
-		Public:       true, // tests default to public for free connectivity
+		RegistryAddr:       env.RegistryAddr,
+		BeaconAddr:         env.BeaconAddr,
+		ListenAddr:         ":0",
+		SocketPath:         sockPath,
+		IdentityPath:       identityPath, // persist identity to avoid pubkey mismatch on restart
+		Email:              fmt.Sprintf("test-%d@pilot.local", idx),
+		Public:             true,                  // tests default to public for free connectivity
+		WebhookHTTPTimeout:  500 * time.Millisecond, // fast webhook timeouts for tests
+		WebhookRetryBackoff: 10 * time.Millisecond,  // fast retry backoff for tests
 	}
 	for _, fn := range opts {
 		fn(&cfg)
@@ -160,13 +162,15 @@ func (env *TestEnv) AddDaemonOnly(opts ...func(*daemon.Config)) (*daemon.Daemon,
 	identityPath := filepath.Join(env.tmpDir, fmt.Sprintf("identity-%d.json", idx))
 
 	cfg := daemon.Config{
-		RegistryAddr: env.RegistryAddr,
-		BeaconAddr:   env.BeaconAddr,
-		ListenAddr:   ":0",
-		SocketPath:   sockPath,
-		IdentityPath: identityPath, // persist identity to avoid pubkey mismatch on restart
-		Email:        fmt.Sprintf("test-%d@pilot.local", idx),
-		Public:       true, // tests default to public for free connectivity
+		RegistryAddr:       env.RegistryAddr,
+		BeaconAddr:         env.BeaconAddr,
+		ListenAddr:         ":0",
+		SocketPath:         sockPath,
+		IdentityPath:       identityPath, // persist identity to avoid pubkey mismatch on restart
+		Email:              fmt.Sprintf("test-%d@pilot.local", idx),
+		Public:             true,                  // tests default to public for free connectivity
+		WebhookHTTPTimeout:  500 * time.Millisecond, // fast webhook timeouts for tests
+		WebhookRetryBackoff: 10 * time.Millisecond,  // fast retry backoff for tests
 	}
 	for _, fn := range opts {
 		fn(&cfg)
diff --git a/tests/tunnel_encrypt_test.go b/tests/tunnel_encrypt_test.go
@@ -147,8 +147,9 @@ func TestTunnelEncryptionBackwardCompat(t *testing.T) {
 
 	t.Logf("daemon A: encrypted, daemon B: plaintext — expect dial failure")
 
-	// Plaintext daemon B should NOT be able to reach encrypted daemon A
-	_, err := drvB.Dial(daemonA.Addr().String() + ":7")
+	// Plaintext daemon B should NOT be able to reach encrypted daemon A.
+	// Use short timeout — we expect rejection, not a 30s dial timeout.
+	_, err := drvB.DialAddrTimeout(daemonA.Addr(), 7, 2*time.Second)
 	if err == nil {
 		t.Fatal("expected dial to fail: encrypted daemon should not accept plaintext connections")
 	}
diff --git a/tests/webhook_reliability_test.go b/tests/webhook_reliability_test.go
@@ -52,7 +52,8 @@ func TestWebhookRetryMaxThreeAttempts(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 },
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("always-fail", nil)
 	wc.Close()
 
@@ -190,6 +191,7 @@ func TestWebhookDroppedCounterAccurate(t *testing.T) {
 	t.Parallel()
 
 	ready := make(chan struct{})
+	var blockOnce sync.Once
 	block := make(chan struct{})
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -203,17 +205,19 @@ func TestWebhookDroppedCounterAccurate(t *testing.T) {
 		w.WriteHeader(200)
 	}))
 	defer srv.Close()
-	defer close(block)
+	defer blockOnce.Do(func() { close(block) })
 
-	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 },
+		daemon.WithHTTPTimeout(200*time.Millisecond),
+		daemon.WithRetryBackoff(10*time.Millisecond))
 
 	// Emit the first event to get the worker goroutine into the blocked HTTP request
 	wc.Emit("trigger", nil)
 
 	// Wait until the worker is actually blocked in the server
 	select {
 	case <-ready:
-	case <-time.After(5 * time.Second):
+	case <-time.After(2 * time.Second):
 		t.Fatal("timeout waiting for worker to start sending")
 	}
 
@@ -228,6 +232,8 @@ func TestWebhookDroppedCounterAccurate(t *testing.T) {
 		t.Fatal("expected at least 1 dropped event when queue is overfull")
 	}
 	t.Logf("dropped %d events", dropped)
+
+	blockOnce.Do(func() { close(block) }) // unblock server so queued events drain with 200 OK
 	wc.Close()
 }
 
@@ -345,7 +351,8 @@ func TestWebhookRetryOn5xx(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 },
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("retry.test", nil)
 	wc.Close()
 
@@ -494,15 +501,18 @@ func TestWebhookDroppedCounter(t *testing.T) {
 	t.Parallel()
 
 	// Create a server that blocks forever so the queue fills up
+	var blockOnce sync.Once
 	block := make(chan struct{})
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		<-block // block until test ends
 		w.WriteHeader(200)
 	}))
 	defer srv.Close()
-	defer close(block)
+	defer blockOnce.Do(func() { close(block) })
 
-	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 },
+		daemon.WithHTTPTimeout(200*time.Millisecond),
+		daemon.WithRetryBackoff(10*time.Millisecond))
 
 	// Fill the 1024-item buffer. The first event will be consumed by the run
 	// goroutine and block in post(), so we need 1024+1 more to fill the queue
@@ -520,5 +530,6 @@ func TestWebhookDroppedCounter(t *testing.T) {
 	}
 	t.Logf("dropped %d events as expected", dropped)
 
+	blockOnce.Do(func() { close(block) }) // unblock server so queued events drain with 200 OK
 	wc.Close()
 }
diff --git a/tests/webhook_test.go b/tests/webhook_test.go
@@ -226,17 +226,20 @@ func TestWebhookClient_FailedPOSTDoesNotBlock(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 })
+	wc := daemon.NewWebhookClient(srv.URL, func() uint32 { return 1 },
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("fail.event", nil)
 	wc.Close() // should not hang
 }
 
 func TestWebhookClient_UnreachableDoesNotBlock(t *testing.T) {
 	t.Parallel()
-	// Point to a non-existent server.
-	wc := daemon.NewWebhookClient("http://127.0.0.1:1", func() uint32 { return 1 })
+	// Point to a non-existent server. Use short timeouts to avoid 15s wait.
+	wc := daemon.NewWebhookClient("http://127.0.0.1:1", func() uint32 { return 1 },
+		daemon.WithHTTPTimeout(200*time.Millisecond),
+		daemon.WithRetryBackoff(10*time.Millisecond))
 	wc.Emit("unreachable.event", nil)
-	wc.Close() // should complete (5s HTTP timeout, but drain completes)
+	wc.Close() // should complete quickly
 }
 
 func TestWebhookClient_DoubleClose(t *testing.T) {
@@ -707,7 +710,7 @@ func TestWebhook_TrustRevoke(t *testing.T) {
 	// B's webhook should have trust.revoked_by_peer (best-effort delivery —
 	// the revoke notification is sent after the tunnel is torn down, so the
 	// re-dial may not always succeed in local test environments)
-	ev, ok = collectorB.WaitFor("trust.revoked_by_peer", 5*time.Second)
+	ev, ok = collectorB.WaitFor("trust.revoked_by_peer", 1*time.Second)
 	if !ok {
 		t.Log("trust.revoked_by_peer not received on B (best-effort delivery, may not arrive after tunnel teardown)")
 	} else {

Original file line number	Diff line number	Diff line change
`@@ -168,8 +168,8 @@ func TestReapStaleNodes(t *testing.T) {`
`168`	`168`	`t.Fatalf("lookup before reap: %v", err)`
`169`	`169`	`}`
`170`	`170`
`171`		`- // Advance clock past stale threshold (3 minutes)`
`172`		`- clk.Advance(4 * time.Minute)`
	`171`	`+ // Advance clock past stale threshold (5 minutes)`
	`172`	`+ clk.Advance(6 * time.Minute)`
`173`	`173`
`174`	`174`	`// Trigger reap`
`175`	`175`	`reg.Reap()`