Function TestTryFastFailOpen_RespectsFailOpenConfig

auth/strategy_database_test.go:287–294

TestTryFastFailOpen_RespectsFailOpenConfig verifies that when fail-open is not configured, we never fast-path — strict-auth semantics are preserved even if connectorDown is flipped by an earlier failure.

(t *testing.T)

// is not configured, we never fast-path — strict-auth semantics are
// preserved even if connectorDown is flipped by an earlier failure.
func TestTryFastFailOpen_RespectsFailOpenConfig(t *testing.T) {
	t.Parallel()
	fc := &fakeConnector{id: "test"}
	s := newTestStrategyWith(t, fc, false /* failOpenEnabled */)
	s.markConnectorDown()
	assert.Nil(t, s.tryFastFailOpen(),
		"must not fast-path when fail-open is disabled — caller must still run real DB path")
}

// TestTryFastFailOpen_HealthyConnector verifies that with fail-open enabled
// but connector healthy, we return nil (normal DB path).