vocdoni / saas-backend / 29321625102

62%

Build Type

push

github

Committed by emmdim

Commit Message

test: add regression tests and polish for auth vuln fixes

- log non-ErrNotFound storage errors from VerificationCodeCheckAndAddAttempt in both
  the verify-account and password-reset handlers (matches the existing lookup pattern)
- generalize ErrVerificationMaxAttempts message (drop "resend") now that it is also
  returned on the code-guessing path
- add db unit test for VerificationCodeCheckAndAddAttempt (increment-to-cap, fail-closed
  once reached, ErrNotFound vs cap-reached, per-type isolation)
- add api regression test that a reset code locks after the guess cap and the correct
  code is then refused with the password left unchanged
- add regression test that the JWT exp claim is a sane ~15-day value (seconds), guarding
  against the nanosecond encoding that made tokens never expire

Coverage Stats

0 of 6 new or added lines in 1 file covered. (0.0%)

144 existing lines in 3 files now uncovered.

10381 of 16504 relevant lines covered (62.9%)

45.0 hits per line