fix(oidc) :: pin both directions of the discovery staleness test (#1425)

Author: 81reap

tests/oidc/mod.rs

@@ -263,6 +263,13 @@ fn get_query_param(url: &Url, name: &str) -> String {
         .to_string()
 }
 
+async fn settle_background_refreshes() {
+    for _ in 0..10 {
+        tokio::task::yield_now().await;
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+}
+
 const REDIRECT_COUNT_COOKIE: &str = "sqlpage_oidc_redirect_count";
 const MAX_OIDC_REDIRECTS: u8 = 3;
 
@@ -741,9 +748,21 @@ async fn test_slow_discovery_does_not_block_authenticated_requests() {
         request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
     assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
 
+    settle_background_refreshes().await;
+    let count_before = provider.discovery_count();
+
+    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
+    assert_eq!(resp.status(), StatusCode::OK);
+    settle_background_refreshes().await;
+    assert_eq!(
+        provider.discovery_count(),
+        count_before,
+        "a fresh OIDC snapshot must not trigger a refresh, \
+         otherwise every request hammers the identity provider"
+    );
+
     // Advance time so the OIDC snapshot appears stale.
     // The next request triggers a background refresh.
-    let count_before = provider.discovery_count();
     tokio::time::pause();
     tokio::time::advance(Duration::from_secs(3601)).await;
     // Resume real time so the DB pool and background refresh work normally.
@@ -755,7 +774,7 @@ async fn test_slow_discovery_does_not_block_authenticated_requests() {
     assert_eq!(resp.status(), StatusCode::OK);
 
     // Let the background refresh task complete.
-    tokio::task::yield_now().await;
+    settle_background_refreshes().await;
     assert!(
         provider.discovery_count() > count_before,
         "OIDC provider metadata was not refreshed"