From d4cdd567dcea5a5678002ba37d9214359b7944ea Mon Sep 17 00:00:00 2001
From: sganggs <sganggs@users.noreply.github.com>
Date: Tue, 13 Oct 2026 06:18:17 +0800
Subject: [PATCH] =?UTF-8?q?0.2.6-dev:=20the=20lobby=20flood=20test=20flood?=
 =?UTF-8?q?s=20in=20bursts=20until=20the=20server=20closes=20the=20socket?=
 =?UTF-8?q?=20and=20waits=20for=20the=20close=20with=20a=20timeout=20?=
 =?UTF-8?q?=E2=80=94=20on=20a=20heavily=20loaded=20machine=20one=20burst?=
 =?UTF-8?q?=20of=20600=20could=20be=20read=20over=20more=20than=20the=201?=
 =?UTF-8?q?=20s=20drop=20window,=20the=20socket=20was=20never=20closed=20a?=
 =?UTF-8?q?nd=20the=20unbounded=20wait=20hung=20the=20whole=20file;=20gold?=
 =?UTF-8?q?en:=20unchanged?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 test/lobby.test.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/test/lobby.test.js b/test/lobby.test.js
index 5ea05f5f..fe9823c8 100644
--- a/test/lobby.test.js
+++ b/test/lobby.test.js
@@ -577,8 +577,16 @@ describe('websocket lobby', () => {
 
   test('flooding far beyond the limit closes the socket (1008)', async () => {
     const c = await pool.player('Flood');
-    for (let i = 0; i < 600; i++) c.send({ t: 'ping', c: i, rid: null });
-    const info = await c.closed;
+    // bursts until the server closes it: the close needs more than abuseDropsPerSec drops inside one 1 s window, and on
+    // a heavily loaded machine a single burst of 600 can be read over more than a second — the old single burst then
+    // never closed the socket and `await c.closed` (no timeout) hung the whole file
+    const t0 = Date.now();
+    while (c.isOpen && Date.now() - t0 < 20000) {
+      for (let i = 0; i < 600 && c.isOpen; i++) c.send({ t: 'ping', c: i, rid: null });
+      await delay(50);
+    }
+    const info = await Promise.race([c.closed, delay(10000).then(() => null)]);
+    assert.ok(info, 'the server closed the flooding socket');
     assert.equal(info.code, 1008);
   });