step 10.6: done

2026-10-22 23:55:28 +11:00
parent e862f3cc21
commit 9a31c7c460
4 changed files with 12 additions and 10 deletions
@@ -58,8 +58,8 @@ function fetchJson(base, path, options = {}) {
 test('rate limiter: login limiter is active and adds headers', async () => {
  const baseUrl = await setup();
  try {
-    // Send 10 bad logins — all should return 401 (max=1000 in test env)
-    for (let i = 0; i < 10; i++) {
+    // Send 9 bad logins — all should return 401 (max=10 in test env)
+    for (let i = 0; i < 9; i++) {
      const res = await fetchJson(baseUrl, '/api/auth/login', {
        method: 'POST',
        body: { username: 'nonexistent', password: 'wrong' },