From 5da3095d064243333269e9e659df6a8d358093c5 Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 25 Aug 2026 02:13:07 +0300 Subject: [PATCH] test: stop the argon2 password tests timing out under load MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three cases in password.service.test.ts fail whenever the machine is busy: × should produce different hashes for the same input (salt) 5068ms × should return true when plain password matches hash 5084ms × should return false when plain password does not match 5147ms Each hashes twice, and argon2 is deliberately CPU-hard, so two hashes exceed the suite's 5s default timeout on a loaded runner. Reproducible on demand by running two unit suites concurrently: 3 failures, every time, in both. The cost is the point of the algorithm, so the timeout moves rather than the work - lowering the argon2 parameters would test a configuration production never uses. Scoped to this describe block so 5s stays the default everywhere else, where it is a useful guard on genuinely fast unit tests. After the change the same concurrent run passes 708/708 in both suites. Co-Authored-By: Claude Opus 5 --- .../unit/infrastructure/security/password.service.test.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/unit/infrastructure/security/password.service.test.ts b/tests/unit/infrastructure/security/password.service.test.ts index 10a9bc1..3901489 100644 --- a/tests/unit/infrastructure/security/password.service.test.ts +++ b/tests/unit/infrastructure/security/password.service.test.ts @@ -1,7 +1,12 @@ import { describe, expect, it } from "vitest"; import { PasswordService } from "@infrastructure/security/password.service"; -describe("PasswordService", () => { +// argon2 is deliberately CPU-hard, so a single hash can take seconds on a +// loaded machine. Several of these cases hash twice and exceed the suite's 5s +// default, which made them fail whenever the runner was busy - reproducible by +// running two suites concurrently. The cost is the point of the algorithm, so +// the timeout moves rather than the work. +describe("PasswordService", { timeout: 30_000 }, () => { const svc = new PasswordService(); describe("hash", () => {