Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/middleware/logbound_test.go

@@ -10,8 +10,10 @@ package middleware_test
 //     the client's choosing.
 //   - CSRF's 403 rejection, at WARN, also registered ahead of
 //     RequireAuth.
-//   - The rate limiters' 429 rejection, at WARN, on the
-//     unauthenticated receiver among others.
+//   - The rate limiters' 429 rejection, at WARN. On the receiver
+//     route it names the route pattern rather than the path, and
+//     the limiters that log a path sit behind RequireAuth, so its cap
+//     is defensive.
 //   - RequireAuth's own unauthenticated-request line, at DEBUG.
 //   - RecordLoginFailure's throttle rejection, at WARN. Its cap is
 //     defensive rather than load-bearing today: chi pins the one
@@ -41,6 +43,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/middleware"
+	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
 )
 
 // bodyLimitBytes is the MaxBodySize cap these tests install. Any
@@ -155,9 +158,9 @@ func capturingBoundMiddleware(
 		ReceiverRateLimit: receiverLimitPerMinute,
 	}
 
-	sess := newTestSessionManager(cfg, log, nil)
+	sess := newTestSessionManager(t, cfg)
 
-	return middleware.NewForTest(log, cfg, sess), buf
+	return middlewaretest.New(t, log, cfg, sess), buf
 }
 
 // unreachable is a next-handler that fails the test if the middleware
@@ -260,15 +263,21 @@ func logSites() map[string]logSite {
 			) http.Handler {
 				t.Helper()
 
-				return m.CSRF()(unreachable(t))
+				return m.CSRF(http.HandlerFunc(forbidden))(
+					unreachable(t),
+				)
 			},
 			send:       postNoToken,
 			wantStatus: http.StatusForbidden,
 		},
-		// The per-entrypoint receiver limiter, unauthenticated. Its
-		// bucket is keyed on the path, so the first request through a
-		// fresh path is served and only the ones after it are
-		// rejected; sendUntilLimited absorbs that.
+		// The 429 line every limiter but the aggregate one shares.
+		// Mounted outside any route, as here, it logs the path, as
+		// it does for the limiters behind RequireAuth; on
+		// ReceiverRoute it names the pattern instead. The
+		// per-entrypoint receiver limiter's bucket is keyed on the
+		// path, so the first request through a fresh path is served
+		// and only the ones after it are rejected; sendUntilLimited
+		// absorbs that.
 		"receiver rate limit 429": {
 			build: func(
 				t *testing.T, m *middleware.Middleware,
@@ -383,7 +392,7 @@ func TestLogLines_ClientChosenPathDoesNotSizeTheLine(t *testing.T) {
 						t, newHandler,
 					)
 
-					path := "/source/" +
+					path := "/hook/" +
 						oversizedPathSegment(fill) + "/edit"
 
 					assert.Equal(
@@ -434,7 +443,7 @@ func TestLoginThrottle_LogLineDoesNotTrackPathSize(t *testing.T) {
 				req := httptest.NewRequestWithContext(
 					context.Background(),
 					http.MethodPost,
-					"/source/"+
+					"/hook/"+
 						oversizedPathSegment(fill)+"/login",
 					nil,
 				)
@@ -499,7 +508,7 @@ func TestMaxBodySize_FloodOfOversizePathsDoesNotGrowTheLog(
 							http.StatusRequestEntityTooLarge,
 							postOversize(
 								h,
-								"/source/"+segment(i)+"/edit",
+								"/hook/"+segment(i)+"/edit",
 							),
 						)
 					}