[SOLUTION] Add gateway auth middleware tests for $50 bounty#37
[SOLUTION] Add gateway auth middleware tests for $50 bounty#37feezy1357 wants to merge 2 commits into
Conversation
Adds comprehensive tests for AuthMiddleware, RateLimitMiddleware, token bucket, middleware ordering, and the full middleware chain. - AuthMiddleware tests: missing/empty/valid/invalid tokens - RateLimitMiddleware tests: under/over limit, per-client buckets - Middleware ordering: auth before rate limiting - Token bucket unit tests: initial state, refill, empty - Token extraction: Bearer, API-Key, precedence Fixes jackjin1997#2
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new test file for the gateway package covering AuthMiddleware, RateLimitMiddleware, middleware ordering, extractToken, and token bucket behavior, with helper functions for JSON response generation and decoding. ChangesGateway middleware test suite
Estimated code review effort: 2 (Simple) | ~15 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Adds comprehensive recovery and regression tests: - Reject truncated headers/payloads without panicking - Reject excessive payload lengths with clear errors - Reject unsupported versions - Verify checksum mismatch yields clear errors - Assert failed decode doesn't corrupt decoder state - Confirm valid frame after invalid input still decodable - Deterministic tests runnable on all platforms Fixes Peter7896#2
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
market/gateway/middleware_test.go (2)
282-355: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSimplified chain diverges from the documented production order.
The comment at Line 324 describes the full production order (Recovery → RequestID → Logging → CORS → Auth → RateLimit → Metrics → Context → Handler), but the test only exercises Recovery, RequestID, Auth, and RateLimit. This is fine as an ordering smoke test, but the comment slightly overstates what's actually verified here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@market/gateway/middleware_test.go` around lines 282 - 355, The comment in TestFullMiddlewareChain overstates the middleware coverage because the handler chain only includes RecoveryMiddleware, RequestIDMiddleware, AuthMiddleware, and RateLimitMiddleware. Update the test comment to describe it as a partial ordering smoke test, or expand the chain to include the missing middleware symbols (Logging, CORS, Metrics, Context) if you want to verify the full documented production order.
134-274: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueMinor: each
RateLimitMiddlewarecall leaks a ticker goroutine.Per context snippet 2,
RateLimitMiddlewarestarts atime.NewTicker(5*time.Minute)cleanup goroutine that's never stopped. Multiple tests in this file (Lines 134-274) invokeRateLimitMiddlewaredirectly, each spawning an un-stoppable background goroutine for the life of the test binary. Not a correctness issue for a short-lived test process, but worth noting if this pattern is reused in longer-running test suites.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@market/gateway/middleware_test.go` around lines 134 - 274, `RateLimitMiddleware` currently starts a cleanup ticker goroutine that is never stopped, and these tests create several middleware instances. Update the middleware implementation so the ticker can be stopped or the goroutine can exit cleanly, and ensure `RateLimitMiddleware` does not leave background work running after use; if needed, add a shutdown/cleanup path tied to the middleware’s ticker lifecycle so repeated calls from `TestRateLimitMiddleware_*` don’t leak goroutines.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@market/gateway/middleware_test.go`:
- Around line 3-10: The test file has an unused `strings` import that prevents
compilation, so remove it from the import block in `middleware_test.go` unless a
real code reference is added elsewhere. Verify the remaining imports used by
`TestMiddleware` and related helpers still compile cleanly with `go test
./market/gateway`.
- Around line 70-100: The test is checking values on the original request
instead of the request passed through AuthMiddleware, so the context assertions
will stay nil. Update TestAuthMiddleware_ValidBearerToken to capture the request
received by testHandler and assert ContextKeyUserID, ContextKeySessionID, and
ContextKeyAuthMethod on that forwarded request (the one created via
Request.WithContext inside AuthMiddleware), not on req.
---
Nitpick comments:
In `@market/gateway/middleware_test.go`:
- Around line 282-355: The comment in TestFullMiddlewareChain overstates the
middleware coverage because the handler chain only includes RecoveryMiddleware,
RequestIDMiddleware, AuthMiddleware, and RateLimitMiddleware. Update the test
comment to describe it as a partial ordering smoke test, or expand the chain to
include the missing middleware symbols (Logging, CORS, Metrics, Context) if you
want to verify the full documented production order.
- Around line 134-274: `RateLimitMiddleware` currently starts a cleanup ticker
goroutine that is never stopped, and these tests create several middleware
instances. Update the middleware implementation so the ticker can be stopped or
the goroutine can exit cleanly, and ensure `RateLimitMiddleware` does not leave
background work running after use; if needed, add a shutdown/cleanup path tied
to the middleware’s ticker lifecycle so repeated calls from
`TestRateLimitMiddleware_*` don’t leak goroutines.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f8177a27-e631-45fe-8ecb-481967b23e5d
📒 Files selected for processing (1)
market/gateway/middleware_test.go
| import ( | ||
| "encoding/json" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "strings" | ||
| "testing" | ||
| "time" | ||
| ) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Unused import breaks compilation.
strings is imported but never referenced anywhere in this file (only mentioned inside comments at Lines 123-124). Go will fail to compile with imported and not used: "strings", which breaks the entire test file, not just one test — this directly blocks the go test ./market/gateway requirement called out in the PR objectives.
🐛 Proposed fix
import (
"encoding/json"
"net/http"
"net/http/httptest"
- "strings"
"testing"
"time"
)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| import ( | |
| "encoding/json" | |
| "net/http" | |
| "net/http/httptest" | |
| "strings" | |
| "testing" | |
| "time" | |
| ) | |
| import ( | |
| "encoding/json" | |
| "net/http" | |
| "net/http/httptest" | |
| "testing" | |
| "time" | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@market/gateway/middleware_test.go` around lines 3 - 10, The test file has an
unused `strings` import that prevents compilation, so remove it from the import
block in `middleware_test.go` unless a real code reference is added elsewhere.
Verify the remaining imports used by `TestMiddleware` and related helpers still
compile cleanly with `go test ./market/gateway`.
| func TestAuthMiddleware_ValidBearerToken(t *testing.T) { | ||
| handler := AuthMiddleware(testHandler()) | ||
|
|
||
| req := httptest.NewRequest(http.MethodGet, "/api/v1/market", nil) | ||
| req.Header.Set("Authorization", "Bearer valid-token-12345") | ||
| rec := httptest.NewRecorder() | ||
| handler.ServeHTTP(rec, req) | ||
|
|
||
| if rec.Code != http.StatusOK { | ||
| t.Errorf("expected status 200, got %d", rec.Code) | ||
| } | ||
|
|
||
| // Verify user context was set | ||
| userID := req.Context().Value(ContextKeyUserID) | ||
| if userID == nil { | ||
| t.Error("expected user ID in context, got nil") | ||
| } | ||
| if userID.(string) != "user_stub" { | ||
| t.Errorf("expected user ID 'user_stub', got %v", userID) | ||
| } | ||
|
|
||
| sessionID := req.Context().Value(ContextKeySessionID) | ||
| if sessionID == nil { | ||
| t.Error("expected session ID in context, got nil") | ||
| } | ||
|
|
||
| authMethod := req.Context().Value(ContextKeyAuthMethod) | ||
| if authMethod.(string) != "bearer" { | ||
| t.Errorf("expected auth method 'bearer', got %v", authMethod) | ||
| } | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Context assertions check the wrong object — will fail even after fixing compilation.
http.Request.WithContext returns a shallow copy of the request rather than mutating the receiver. In AuthMiddleware, the modified context is only attached to the copy passed to next.ServeHTTP, and this test's testHandler discards that request without exposing it. As a result, req.Context().Value(ContextKeyUserID) at Line 83 still refers to the original, unmodified context and will read nil, causing the test to fail.
Capture the request actually seen by the wrapped handler instead:
🐛 Proposed fix
func TestAuthMiddleware_ValidBearerToken(t *testing.T) {
- handler := AuthMiddleware(testHandler())
+ var capturedReq *http.Request
+ inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ capturedReq = r
+ w.WriteHeader(http.StatusOK)
+ })
+ handler := AuthMiddleware(inner)
req := httptest.NewRequest(http.MethodGet, "/api/v1/market", nil)
req.Header.Set("Authorization", "Bearer valid-token-12345")
rec := httptest.NewRecorder()
handler.ServeHTTP(rec, req)
if rec.Code != http.StatusOK {
t.Errorf("expected status 200, got %d", rec.Code)
}
// Verify user context was set
- userID := req.Context().Value(ContextKeyUserID)
+ userID := capturedReq.Context().Value(ContextKeyUserID)Apply the same fix pattern to the other sessionID/authMethod lookups (Lines 91-99).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@market/gateway/middleware_test.go` around lines 70 - 100, The test is
checking values on the original request instead of the request passed through
AuthMiddleware, so the context assertions will stay nil. Update
TestAuthMiddleware_ValidBearerToken to capture the request received by
testHandler and assert ContextKeyUserID, ContextKeySessionID, and
ContextKeyAuthMethod on that forwarded request (the one created via
Request.WithContext inside AuthMiddleware), not on req.
1 participant
Solution for [$50 BOUNTY] Add gateway auth middleware tests
Changes
Added comprehensive test coverage for
market/gateway/middleware.go:AuthMiddleware tests:
RateLimitMiddleware tests:
Middleware ordering tests:
Token bucket unit tests:
Token extraction tests:
Verification
All tests use standard library
net/http/httptestand require no external dependencies.Closes #2
Summary by CodeRabbit