middleware tests construct cookie stores by hand, so they no longer match the production store #154

New Issue

clawbot · 2026-08-14T06:17:56+02:00

clawbot commented

2026-08-14 06:17:56 +02:00

Disclosed by the review of #132, which judged it below the bar for rework there.

#132 moved the production store onto store.MaxAge(...) so the securecookie codecs share the 7-day cap. internal/middleware/middleware_test.go:67 and :850 still build lookalike stores by assigning store.Options directly, which leaves their codecs at gorilla's 30-day default.

The cause is reachability, not oversight: NewStore is exported through internal/session/export_test.go, so package middleware cannot reach the production constructor and has to hand-roll one.

No false green today — nothing in middleware asserts on codec age — but the divergence is invisible and will silently outlive the next change to store construction.

Definition of done

NewStore moves from internal/session/export_test.go into the existing internal/session/testing.go so other packages can use it.
internal/middleware/middleware_test.go:67 and :850 construct their stores through it.
No test in the repo constructs a cookie store by assigning store.Options.

Implementation requirements

Branch from next, PR based on next, single commit, title ending (closes #N).
Do not modify TODO.md.
Gate on make check plus the Docker lint path with the cache defeated (#119).

Disclosed by the review of https://git.eeqj.de/sneak/webhooker/pulls/132, which judged it below the bar for rework there. https://git.eeqj.de/sneak/webhooker/pulls/132 moved the production store onto `store.MaxAge(...)` so the securecookie codecs share the 7-day cap. `internal/middleware/middleware_test.go:67` and `:850` still build lookalike stores by assigning `store.Options` directly, which leaves their codecs at gorilla's 30-day default. The cause is reachability, not oversight: `NewStore` is exported through `internal/session/export_test.go`, so package `middleware` cannot reach the production constructor and has to hand-roll one. No false green today — nothing in `middleware` asserts on codec age — but the divergence is invisible and will silently outlive the next change to store construction. ## Definition of done - `NewStore` moves from `internal/session/export_test.go` into the existing `internal/session/testing.go` so other packages can use it. - `internal/middleware/middleware_test.go:67` and `:850` construct their stores through it. - No test in the repo constructs a cookie store by assigning `store.Options`. ## Implementation requirements - Branch from `next`, PR based on `next`, single commit, title ending ` (closes #N)`. - Do not modify `TODO.md`. - Gate on `make check` plus the Docker lint path with the cache defeated (https://git.eeqj.de/sneak/webhooker/issues/119).

clawbot self-assigned this 2026-08-14 06:17:56 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#154