Function TestTryFastFailOpen_DownProbeOnePerInterval

auth/strategy_database_test.go:313–348

TestTryFastFailOpen_DownProbeOnePerInterval is the core load-shedding test. It asserts that across N concurrent callers while connectorDown is latched, exactly ONE is elected as the probe (returns nil → real DB path) per probe interval; everyone else gets the fast-path emergency user. This is what b

(t *testing.T)

// user. This is what bounds per-request DB load during a sustained
// outage to ~1 query/sec instead of full request rate.
func TestTryFastFailOpen_DownProbeOnePerInterval(t *testing.T) {
	t.Parallel()
	fc := &fakeConnector{id: "test"}
	s := newTestStrategyWith(t, fc, true)

	// Latch down and force the timestamp far in the past so every caller
	// sees the probe window as expired.
	s.markConnectorDown()
	s.connectorDownSince.Store(time.Now().Add(-1 * time.Hour).UnixNano())

	var probes atomic.Int64
	var fastPathed atomic.Int64

	const concurrency = 200
	var wg sync.WaitGroup
	start := make(chan struct{})
	for i := 0; i < concurrency; i++ {
		wg.Add(1)
		go func() {
			defer wg.Done()
			<-start
			if u := s.tryFastFailOpen(); u != nil {
				fastPathed.Add(1)
			} else {
				probes.Add(1)
			}
		}()
	}
	close(start)
	wg.Wait()

	assert.Equal(t, int64(1), probes.Load(),
		"exactly one caller must be elected as the probe per interval; got %d", probes.Load())
	assert.Equal(t, int64(concurrency-1), fastPathed.Load(),
		"all other callers must fast-path; got %d", fastPathed.Load())
}

// TestTryFastFailOpen_DownWithinWindow verifies that during the cooldown
// window (downSince fresh), ALL callers fast-path — no probes are elected