Report queued tasks the scheduling pass never considers

A task in retry backoff was filtered out before the candidate loop, so it recorded no rejection at all: queued, apparently assignable, and silent. That is the exact shape that made F5 take a live session to diagnose. It now reports "retry backoff until <time>". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-26 23:42:26 +04:00
parent 0ead6d2d02
commit 4fbf3ac966
18 changed files with 1163 additions and 165 deletions
@@ -0,0 +1,94 @@
+package authn
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"orchestra/internal/authz"
+	"testing"
+)
+
+func TestHTTPSessionLoginLookupAndLogout(t *testing.T) {
+	users, _ := openTestStore(t)
+	if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
+		t.Fatal(err)
+	}
+	h := HTTP{Users: users, Sessions: &authz.Sessions{}}
+
+	login := httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(`{"username":"kami","password":"correct horse battery"}`))
+	w := httptest.NewRecorder()
+	h.Session(w, login)
+	if w.Code != http.StatusOK {
+		t.Fatalf("login status=%d body=%s", w.Code, w.Body)
+	}
+	response := w.Result()
+	cookies := response.Cookies()
+	if len(cookies) != 1 || cookies[0].Name != authz.SessionCookie || !cookies[0].HttpOnly {
+		t.Fatalf("cookies=%+v", cookies)
+	}
+	var account User
+	if err := json.Unmarshal(w.Body.Bytes(), &account); err != nil || account.Username != "kami" {
+		t.Fatalf("account=%+v err=%v", account, err)
+	}
+
+	lookup := httptest.NewRequest(http.MethodGet, authz.SessionPath, nil)
+	lookup.AddCookie(cookies[0])
+	w = httptest.NewRecorder()
+	h.Session(w, lookup)
+	if w.Code != http.StatusOK || !bytes.Contains(w.Body.Bytes(), []byte(`"username":"kami"`)) {
+		t.Fatalf("lookup status=%d body=%s", w.Code, w.Body)
+	}
+
+	logout := httptest.NewRequest(http.MethodDelete, authz.SessionPath, nil)
+	logout.AddCookie(cookies[0])
+	w = httptest.NewRecorder()
+	h.Session(w, logout)
+	if w.Code != http.StatusNoContent || h.Sessions.Valid(cookies[0].Value) {
+		t.Fatalf("logout status=%d valid=%v", w.Code, h.Sessions.Valid(cookies[0].Value))
+	}
+}
+
+func TestHTTPLoginDoesNotRevealUnknownUsername(t *testing.T) {
+	users, _ := openTestStore(t)
+	if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
+		t.Fatal(err)
+	}
+	h := HTTP{Users: users, Sessions: &authz.Sessions{}}
+	for _, body := range []string{
+		`{"username":"kami","password":"wrong password"}`,
+		`{"username":"unknown","password":"wrong password"}`,
+	} {
+		w := httptest.NewRecorder()
+		h.Session(w, httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(body)))
+		if w.Code != http.StatusUnauthorized || w.Body.String() != "invalid credentials\n" {
+			t.Fatalf("status=%d body=%q", w.Code, w.Body.String())
+		}
+	}
+}
+
+func TestHTTPAccountUpdateRevokesExistingSessions(t *testing.T) {
+	users, _ := openTestStore(t)
+	if _, _, err := users.SetPassword("operator", "original password"); err != nil {
+		t.Fatal(err)
+	}
+	sessions := &authz.Sessions{}
+	h := HTTP{Users: users, Sessions: sessions}
+	value, err := sessions.IssueFor("operator")
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPut, "/v1/ui/account", bytes.NewBufferString(`{"current_password":"original password","username":"kami","new_password":"replacement password"}`))
+	req.AddCookie(&http.Cookie{Name: authz.SessionCookie, Value: value})
+	w := httptest.NewRecorder()
+	h.Account(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body)
+	}
+	if sessions.Valid(value) {
+		t.Fatal("credential update retained an old browser session")
+	}
+	if _, err := users.Authenticate("kami", "replacement password"); err != nil {
+		t.Fatalf("updated login: %v", err)
+	}
+}