From 5c5025fb7bf8159a81e8ef2a0e05c4dc714bce78 Mon Sep 17 00:00:00 2001 From: mfwolffe Date: Thu, 3 Sep 2026 01:26:04 -0400 Subject: [PATCH] auth: widen constant-time login margin against CI timing noise --- internal/web/handlers/auth/auth_test.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/web/handlers/auth/auth_test.go b/internal/web/handlers/auth/auth_test.go index 9529d514..b0f65d31 100644 --- a/internal/web/handlers/auth/auth_test.go +++ b/internal/web/handlers/auth/auth_test.go @@ -680,7 +680,16 @@ func TestLogin_ConstantTime(t *testing.T) { existing := measure("dave") missing := measure("does-not-exist") - if missing < hashCost/2 { + // A shortcut that skips hashing makes the missing-user request + // ~1 ms. Compare against the cheaper of the two reference costs + // (a bare hash, or a full existing-user login which includes one) + // with a wide margin, because on a loaded CI runner either + // reference can be inflated several-fold by neighbouring tests. + ref := hashCost + if existing < ref { + ref = existing + } + if missing < ref/4 { t.Fatalf("missing-user login skipped the hash: missing=%v hash=%v existing=%v", missing, hashCost, existing) } // Still reject an egregious divergence in either direction; the