max / makenotwork

Run the sandbox cap tests in every configuration The two per-IP cap tests were ignored unless `fast-tests` was on, which dated from when that feature swapped the rate-limit constants: under production values a test creating four sandboxes was throttled by its own setup. The limits are runtime config now and the default harness builds the relaxed profile, so the gate was holding back tests that pass. Both configurations now enumerate the same 1,244 integration tests, which was the point of moving the limits off the feature. `fast-tests` is down to argon2 parameters, a cost knob with no behaviour a feature-gated build fails to exercise; recorded at the call site so it is not re-litigated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-08-05 13:41 UTC

Signed with PGP, not checked

Commit: 9efc237c60fa5c3190262349083d3fc7ee09a532

Parent: 532688a

3 files changed, +6 insertions, -8 deletions

M server/src/auth.rs +6

			@@ -581,11 +581,17 @@
581	581		///
582	582		/// Production: 46 MiB, 2 iterations (~600ms). With `fast-tests` feature: 8 MiB, 1 iteration (~10ms).
583	583		/// Verification auto-detects params from the hash string, so no feature flag needed there.
	584	+	///
584	585		/// Synchronous Argon2id hash. CPU-bound (hundreds of ms); do NOT call from an
585	586		/// async handler, use [`hash_password_async`], which runs this on a blocking
586	587		/// thread so a burst of signups can't starve the Tokio worker pool. The sync
587	588		/// form remains `pub` only for one-time `DUMMY_HASH` initializers and
588	589		/// test/integration fixtures that seed password hashes off the request path.
	590	+	///
	591	+	/// This is the only remaining consumer of `fast-tests`, deliberately: it is a
	592	+	/// cost knob rather than a behaviour knob, so unlike the rate limits the feature
	593	+	/// swapped before, there is nothing here a feature-gated build fails to
	594	+	/// exercise. See the `[features]` comment in Cargo.toml.
589	595		pub fn hash_password(password: &str) -> Result<String, AppError> {
590	596		let salt = SaltString::generate(&mut OsRng);
591	597		#[cfg(feature = "fast-tests")]

M server/tests/workflows/lifecycle.rs -4

			@@ -272,10 +272,6 @@
272	272		// Concurrent sandbox creation: same IP → per-IP cap holds
273	273
274	274		#[tokio::test]
275		-	#[cfg_attr(
276		-	not(feature = "fast-tests"),
277		-	ignore = "only run under the fast-tests feature"
278		-	)]
279	275		async fn concurrent_sandbox_per_ip_cap_holds() {
280	276		let mut h = TestHarness::new().await;
281	277

M server/tests/workflows/sandbox.rs -4

			@@ -182,10 +182,6 @@
182	182		}
183	183
184	184		#[tokio::test]
185		-	#[cfg_attr(
186		-	not(feature = "fast-tests"),
187		-	ignore = "only run under the fast-tests feature"
188		-	)]
189	185		async fn sandbox_per_ip_cap() {
190	186		let mut h = TestHarness::new().await;
191	187