[FIX] refactor tests and improve error handling

valentin-kaiser · valentin-kaiser · commit 62a1f2e5e006 · 2025-09-11T15:55:08.000+02:00
diff --git a/apperror/apperror_test.go b/apperror/apperror_test.go
@@ -351,7 +351,7 @@ func TestCatchFunction(t *testing.T) {
 	}, "operation failed")
 }
 
-func TestCatchFunctionSuccess(t *testing.T) {
+func TestCatchFunctionSuccess(_ *testing.T) {
 	// Test successful operation (should not panic)
 	apperror.Catch(func() error {
 		return nil
diff --git a/cache/redis.go b/cache/redis.go
@@ -251,7 +251,7 @@ func (rc *RedisCache) GetMulti(ctx context.Context, keys []string) (map[string]i
 				rc.updateStats(func(s *Stats) { s.Hits++ })
 				continue
 			}
-			
+
 			rc.updateStats(func(s *Stats) { s.Misses++ })
 		}
 	}
diff --git a/database/config.go b/database/config.go
@@ -47,6 +47,7 @@ func (c *Config) Validate() error {
 	return nil
 }
 
+// Changed checks if the configuration has changed
 func (c *Config) Changed(n *Config) bool {
 	if c.Driver != n.Driver {
 		return true
diff --git a/database/database_test.go b/database/database_test.go
@@ -157,7 +157,10 @@ func TestExecuteWithoutConnection(t *testing.T) {
 	// Ensure we're in a disconnected state for this test
 	// Only disconnect if currently connected to avoid hanging
 	if database.Connected() {
-		database.Disconnect()
+		err := database.Disconnect()
+		if err != nil {
+			t.Errorf("Disconnect should not return an error: %v", err)
+		}
 		time.Sleep(100 * time.Millisecond) // Wait for disconnection
 	}
 
@@ -184,7 +187,10 @@ func TestReconnect(t *testing.T) {
 func TestAwaitConnectionTimeout(t *testing.T) {
 	// Ensure we start in a disconnected state for this test
 	if database.Connected() {
-		database.Disconnect()
+		err := database.Disconnect()
+		if err != nil {
+			t.Errorf("Disconnect should not return an error: %v", err)
+		}
 		time.Sleep(200 * time.Millisecond) // Wait for disconnection
 	}
 
@@ -230,7 +236,10 @@ func TestConnectWithInvalidConfig(t *testing.T) {
 	}
 
 	// Clean up
-	database.Disconnect()
+	err := database.Disconnect()
+	if err != nil {
+		t.Errorf("Disconnect should not return an error: %v", err)
+	}
 }
 
 func TestConnectWithSQLiteConfig(t *testing.T) {
diff --git a/mail/config.go b/mail/config.go
@@ -209,6 +209,7 @@ func (c *ClientConfig) TLSConfig() *tls.Config {
 	}
 }
 
+// Validate checks the client configuration for errors
 func (c *ClientConfig) Validate() error {
 	if c.Host == "" {
 		return apperror.NewError("SMTP host is required")
@@ -240,6 +241,7 @@ func (c *ServerConfig) TLSConfig() *tls.Config {
 	}
 }
 
+// Validate checks the server configuration for errors
 func (c *ServerConfig) Validate() error {
 	if c.Host == "" {
 		return apperror.NewError("SMTP server host is required")
@@ -256,6 +258,7 @@ func (c *ServerConfig) Validate() error {
 	return nil
 }
 
+// Validate checks the queue configuration for errors
 func (c *QueueConfig) Validate() error {
 	if c.QueueName == "" {
 		return apperror.NewError("Queue name is required")
@@ -269,13 +272,15 @@ func (c *QueueConfig) Validate() error {
 	return nil
 }
 
+// Validate checks the template configuration for errors
 func (c *TemplateConfig) Validate() error {
 	if c.DefaultTemplate == "" {
 		return apperror.NewError("Default template is required")
 	}
 	return nil
 }
 
+// Validate checks the configuration for errors
 func (c *Config) Validate() error {
 	if err := c.Client.Validate(); err != nil {
 		return apperror.Wrap(err)
diff --git a/mail/config_test.go b/mail/config_test.go
@@ -555,16 +555,13 @@ func validateSecurityConfig(config mail.SecurityConfig) bool {
 	return true
 }
 
-func validateQueueConfig(config mail.QueueConfig) bool {
+func validateQueueConfig(_ mail.QueueConfig) bool {
 	// Basic queue config is always valid
 	return true
 }
 
 func validateTemplateConfig(config mail.TemplateConfig) bool {
-	if config.DefaultTemplate == "" {
-		return false
-	}
-	return true
+	return config.DefaultTemplate != ""
 }
 
 func isValidIPOrCIDR(s string) bool {
diff --git a/mail/internal/email/email.go b/mail/internal/email/email.go
@@ -1,3 +1,5 @@
+// Package email allows to send email messages.
+// The package is used internally by the mail package.
 package email
 
 import (
@@ -26,8 +28,10 @@ import (
 )
 
 const (
-	MaxLineLength      = 76                             // MaxLineLength is the maximum line length per RFC 2045
-	DefaultContentType = "text/plain; charset=us-ascii" // DefaultContentType is the default Content-Type according to RFC 2045, section 5.2
+	// MaxLineLength is the maximum line length per RFC 2045
+	MaxLineLength = 76
+	// DefaultContentType is the default Content-Type according to RFC 2045, section 5.2
+	DefaultContentType = "text/plain; charset=us-ascii"
 )
 
 var maxBigInt = big.NewInt(math.MaxInt64)
@@ -144,10 +148,10 @@ func NewFromReader(r io.Reader) (*Email, error) {
 				continue
 			}
 		}
-		switch {
-		case contentType == "text/plain":
+		switch contentType {
+		case "text/plain":
 			msg.Text = p.body
-		case contentType == "text/html":
+		case "text/html":
 			msg.HTML = p.body
 		}
 	}
@@ -174,11 +178,11 @@ func (e *Email) Attach(r io.Reader, filename string, contentType string) (*Attac
 // AttachFile is used to attach content to the email.
 // It attempts to open the file referenced by filename and, if successful, creates an Attachment.
 func (e *Email) AttachFile(filename string) (*Attachment, error) {
-	f, err := os.Open(filename)
+	f, err := os.Open(filepath.Clean(filename))
 	if err != nil {
 		return nil, apperror.NewError("could not open attachment file").AddError(err)
 	}
-	defer f.Close()
+	defer apperror.Catch(f.Close, "could not close attachment file")
 
 	ct := mime.TypeByExtension(filepath.Ext(filename))
 	basename := filepath.Base(filename)
@@ -301,7 +305,10 @@ func (e *Email) Bytes() ([]byte, error) {
 				}
 
 				if isMixed || isAlternative {
-					relatedWriter.Close()
+					err = relatedWriter.Close()
+					if err != nil {
+						return nil, apperror.NewError("could not close multipart/related part").AddError(err)
+					}
 				}
 			}
 		}
@@ -370,7 +377,7 @@ func (e *Email) Send(address string, auth smtp.Auth, helo string) error {
 	if err != nil {
 		return apperror.NewError("could not dial SMTP connection").AddError(err)
 	}
-	defer conn.Close()
+	defer apperror.Catch(conn.Close, "could not close SMTP connection")
 
 	// Send custom HELO
 	err = conn.Hello(helo)
@@ -447,12 +454,12 @@ func (e *Email) SendWithTLS(address string, auth smtp.Auth, config *tls.Config,
 	if err != nil {
 		return apperror.NewError("could not dial TLS connection").AddError(err)
 	}
-	defer conn.Close()
+	defer apperror.Catch(conn.Close, "could not close TLS connection")
 	c, err := smtp.NewClient(conn, strings.Split(address, ":")[0])
 	if err != nil {
 		return apperror.NewError("could not create SMTP client").AddError(err)
 	}
-	defer c.Quit()
+	defer apperror.Catch(c.Quit, "could not quit SMTP session")
 
 	// Send custom HELO if provided (after connection but before auth)
 	if helo != "" {
@@ -524,7 +531,7 @@ func (e *Email) SendWithStartTLS(address string, auth smtp.Auth, config *tls.Con
 	if err != nil {
 		return apperror.NewError("could not dial SMTP connection").AddError(err)
 	}
-	defer conn.Close()
+	defer apperror.Catch(conn.Close, "could not close SMTP connection")
 
 	// Send custom HELO if provided (before STARTTLS)
 	if helo != "" {
@@ -836,13 +843,13 @@ func headerToBytes(buff io.Writer, header textproto.MIMEHeader) error {
 			if err != nil {
 				return apperror.NewError("could not write header field separator").AddError(err)
 			}
-			switch {
-			case field == "Content-Type" || field == "Content-Disposition":
+			switch field {
+			case "Content-Type", "Content-Disposition":
 				_, err := buff.Write([]byte(subval))
 				if err != nil {
 					return apperror.NewError("could not write header field value").AddError(err)
 				}
-			case field == "From" || field == "To" || field == "Cc" || field == "Bcc":
+			case "From", "To", "Cc", "Bcc":
 				_, err := buff.Write([]byte(subval))
 				if err != nil {
 					return apperror.NewError("could not write header field value").AddError(err)
diff --git a/mail/internal/email/email_test.go b/mail/internal/email/email_test.go
@@ -54,7 +54,7 @@ func TestEmail_AttachFile(t *testing.T) {
 	tempFile := filepath.Join(tempDir, "test.txt")
 	content := "test file content"
 
-	err := os.WriteFile(tempFile, []byte(content), 0644)
+	err := os.WriteFile(tempFile, []byte(content), 0600)
 	if err != nil {
 		t.Fatalf("Failed to create temp file: %v", err)
 	}
diff --git a/mail/mail_test.go b/mail/mail_test.go
@@ -424,11 +424,11 @@ func TestManagerSendAsyncQueueDisabled(t *testing.T) {
 	}
 }
 
-func TestManagerAddNotificationHandler(t *testing.T) {
+func TestManagerAddNotificationHandler(_ *testing.T) {
 	config := mail.DefaultConfig()
 	manager := mail.NewManager(config, nil)
 
-	handler := func(ctx context.Context, from string, to []string, data io.Reader) error {
+	handler := func(_ context.Context, _ string, to []string, _ io.Reader) error {
 		return nil
 	}
 
diff --git a/mail/security.go b/mail/security.go
@@ -59,17 +59,17 @@ func NewSecurityManager(config SecurityConfig) *SecurityManager {
 			sm.allowedNetworks = append(sm.allowedNetworks, network)
 			continue
 		}
-		
+
 		ip := net.ParseIP(ipStr)
 		if ip == nil {
 			continue
 		}
-		
+
 		// Single IP address - convert to /32 or /128 network
 		var network *net.IPNet
-		_, network, _ = net.ParseCIDR(ipStr + "/128")  // Default to IPv6
+		_, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6
 		if ip.To4() != nil {
-			_, network, _ = net.ParseCIDR(ipStr + "/32")  // Override for IPv4
+			_, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4
 		}
 		sm.allowedNetworks = append(sm.allowedNetworks, network)
 	}
@@ -80,17 +80,17 @@ func NewSecurityManager(config SecurityConfig) *SecurityManager {
 			sm.blockedNetworks = append(sm.blockedNetworks, network)
 			continue
 		}
-		
+
 		ip := net.ParseIP(ipStr)
 		if ip == nil {
 			continue
 		}
-		
+
 		// Single IP address - convert to /32 or /128 network
 		var network *net.IPNet
-		_, network, _ = net.ParseCIDR(ipStr + "/128")  // Default to IPv6
+		_, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6
 		if ip.To4() != nil {
-			_, network, _ = net.ParseCIDR(ipStr + "/32")  // Override for IPv4
+			_, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4
 		}
 		sm.blockedNetworks = append(sm.blockedNetworks, network)
 	}
@@ -154,7 +154,7 @@ func (sm *SecurityManager) ValidateConnection(remoteAddr string) error {
 			}
 			return &SecurityError{Type: "auth_blocked", Message: "IP temporarily blocked due to authentication failures"}
 		}
-		
+
 		// Reset auth failure tracking after window expires
 		tracker.blocked = false
 		tracker.failures = 0
diff --git a/mail/sender_test.go b/mail/sender_test.go
@@ -2,6 +2,7 @@ package mail_test
 
 import (
 	"context"
+	"os"
 	"testing"
 	"time"
 
@@ -135,10 +136,6 @@ func TestSMTPSender_MessageValidation(t *testing.T) {
 				if err == nil {
 					t.Error("Expected validation error")
 				}
-				// Check if it's likely a validation error (happens quickly)
-			} else {
-				// Valid messages will fail due to network, but that's expected in tests
-				// We just want to verify validation doesn't fail
 			}
 		})
 	}
@@ -207,7 +204,7 @@ func TestSMTPSender_WithTemplate(t *testing.T) {
 	// Create a simple template
 	templateContent := `<html><body><h1>{{.Subject}}</h1><p>{{.Body}}</p></body></html>`
 	templatePath := tempDir + "/test.html"
-	if err := writeFile(templatePath, templateContent); err != nil {
+	if err := os.WriteFile(templatePath, []byte(templateContent), 0600); err != nil {
 		t.Fatalf("Failed to create template: %v", err)
 	}
 
@@ -315,7 +312,7 @@ func TestSMTPSender_EncryptionMethods(t *testing.T) {
 	}
 }
 
-func TestSMTPSender_MessageWithAttachments(t *testing.T) {
+func TestSMTPSender_MessageWithAttachments(_ *testing.T) {
 	config := mail.ClientConfig{
 		Host:       "smtp.example.com",
 		Port:       587,
@@ -350,7 +347,7 @@ func TestSMTPSender_MessageWithAttachments(t *testing.T) {
 	_ = err
 }
 
-func TestSMTPSender_MessageWithHeaders(t *testing.T) {
+func TestSMTPSender_MessageWithHeaders(_ *testing.T) {
 	config := mail.ClientConfig{
 		Host:       "smtp.example.com",
 		Port:       587,
@@ -417,10 +414,3 @@ func TestSMTPSender_ContextCancellation(t *testing.T) {
 		t.Errorf("Send took too long despite context cancellation: %v", duration)
 	}
 }
-
-// Helper function to write file content
-func writeFile(path, content string) error {
-	// This is a simplified version - in real code would use os.WriteFile
-	// For now, just return nil to allow tests to compile
-	return nil
-}
diff --git a/mail/server.go b/mail/server.go
@@ -279,7 +279,7 @@ func (s *smtpServer) generateSelfSignedCert() (tls.Certificate, error) {
 			log.Warn().Err(err).Msg("[Mail] Failed to create certificate directory")
 			goto createTLS
 		}
-		
+
 		if err := os.WriteFile(s.config.CertFile, certPEM.Bytes(), 0600); err != nil {
 			log.Warn().Err(err).Msg("[Mail] Failed to save certificate file")
 		}
@@ -289,7 +289,7 @@ func (s *smtpServer) generateSelfSignedCert() (tls.Certificate, error) {
 		}
 	}
 
-	createTLS:
+createTLS:
 	// Create TLS certificate
 	cert, err := tls.X509KeyPair(certPEM.Bytes(), keyPEM.Bytes())
 	if err != nil {
diff --git a/mail/server_test.go b/mail/server_test.go
@@ -58,7 +58,7 @@ func TestSMTPServer_AddHandler(t *testing.T) {
 
 	// Create a test notification handler
 	var handlerCalled bool
-	handler := func(ctx context.Context, from string, to []string, data io.Reader) error {
+	handler := func(_ context.Context, _ string, to []string, _ io.Reader) error {
 		handlerCalled = true
 		return nil
 	}
@@ -227,7 +227,7 @@ func TestSMTPServer_MultipleHandlers(t *testing.T) {
 	handlerCount := 0
 
 	for i := 0; i < 5; i++ {
-		handler := func(ctx context.Context, from string, to []string, data io.Reader) error {
+		handler := func(_ context.Context, _ string, _ []string, _ io.Reader) error {
 			handlerCount++
 			return nil
 		}
diff --git a/mail/template.go b/mail/template.go
diff --git a/mail/template_test.go b/mail/template_test.go
diff --git a/web/router.go b/web/router.go
diff --git a/web/router_test.go b/web/router_test.go
diff --git a/web/web_test.go b/web/web_test.go

Original file line number	Diff line number	Diff line change
`@@ -351,7 +351,7 @@ func TestCatchFunction(t *testing.T) {`
`351`	`351`	`}, "operation failed")`
`352`	`352`	`}`
`353`	`353`
`354`		`-func TestCatchFunctionSuccess(t *testing.T) {`
	`354`	`+func TestCatchFunctionSuccess(_ *testing.T) {`
`355`	`355`	`// Test successful operation (should not panic)`
`356`	`356`	`apperror.Catch(func() error {`
`357`	`357`	`return nil`
Original file line number	Diff line number	Diff line change
`@@ -251,7 +251,7 @@ func (rc *RedisCache) GetMulti(ctx context.Context, keys []string) (map[string]i`
`251`	`251`	`rc.updateStats(func(s *Stats) { s.Hits++ })`
`252`	`252`	`continue`
`253`	`253`	`}`
`254`		`-`
	`254`	`+`
`255`	`255`	`rc.updateStats(func(s *Stats) { s.Misses++ })`
`256`	`256`	`}`
`257`	`257`	`}`
Original file line number	Diff line number	Diff line change
`@@ -47,6 +47,7 @@ func (c *Config) Validate() error {`
`47`	`47`	`return nil`
`48`	`48`	`}`
`49`	`49`
	`50`	`+// Changed checks if the configuration has changed`
`50`	`51`	`func (c Config) Changed(n Config) bool {`
`51`	`52`	`if c.Driver != n.Driver {`
`52`	`53`	`return true`
Original file line number	Diff line number	Diff line change
`@@ -209,6 +209,7 @@ func (c ClientConfig) TLSConfig() tls.Config {`
`209`	`209`	`}`
`210`	`210`	`}`
`211`	`211`
	`212`	`+// Validate checks the client configuration for errors`
`212`	`213`	`func (c *ClientConfig) Validate() error {`
`213`	`214`	`if c.Host == "" {`
`214`	`215`	`return apperror.NewError("SMTP host is required")`
`@@ -240,6 +241,7 @@ func (c ServerConfig) TLSConfig() tls.Config {`
`240`	`241`	`}`
`241`	`242`	`}`
`242`	`243`
	`244`	`+// Validate checks the server configuration for errors`
`243`	`245`	`func (c *ServerConfig) Validate() error {`
`244`	`246`	`if c.Host == "" {`
`245`	`247`	`return apperror.NewError("SMTP server host is required")`
`@@ -256,6 +258,7 @@ func (c *ServerConfig) Validate() error {`
`256`	`258`	`return nil`
`257`	`259`	`}`
`258`	`260`
	`261`	`+// Validate checks the queue configuration for errors`
`259`	`262`	`func (c *QueueConfig) Validate() error {`
`260`	`263`	`if c.QueueName == "" {`
`261`	`264`	`return apperror.NewError("Queue name is required")`
`@@ -269,13 +272,15 @@ func (c *QueueConfig) Validate() error {`
`269`	`272`	`return nil`
`270`	`273`	`}`
`271`	`274`
	`275`	`+// Validate checks the template configuration for errors`
`272`	`276`	`func (c *TemplateConfig) Validate() error {`
`273`	`277`	`if c.DefaultTemplate == "" {`
`274`	`278`	`return apperror.NewError("Default template is required")`
`275`	`279`	`}`
`276`	`280`	`return nil`
`277`	`281`	`}`
`278`	`282`
	`283`	`+// Validate checks the configuration for errors`
`279`	`284`	`func (c *Config) Validate() error {`
`280`	`285`	`if err := c.Client.Validate(); err != nil {`
`281`	`286`	`return apperror.Wrap(err)`
Original file line number	Diff line number	Diff line change
`@@ -555,16 +555,13 @@ func validateSecurityConfig(config mail.SecurityConfig) bool {`
`555`	`555`	`return true`
`556`	`556`	`}`
`557`	`557`
`558`		`-func validateQueueConfig(config mail.QueueConfig) bool {`
	`558`	`+func validateQueueConfig(_ mail.QueueConfig) bool {`
`559`	`559`	`// Basic queue config is always valid`
`560`	`560`	`return true`
`561`	`561`	`}`
`562`	`562`
`563`	`563`	`func validateTemplateConfig(config mail.TemplateConfig) bool {`
`564`		`- if config.DefaultTemplate == "" {`
`565`		`- return false`
`566`		`- }`
`567`		`- return true`
	`564`	`+ return config.DefaultTemplate != ""`
`568`	`565`	`}`
`569`	`566`
`570`	`567`	`func isValidIPOrCIDR(s string) bool {`
Original file line number	Diff line number	Diff line change
`@@ -54,7 +54,7 @@ func TestEmail_AttachFile(t *testing.T) {`
`54`	`54`	`tempFile := filepath.Join(tempDir, "test.txt")`
`55`	`55`	`content := "test file content"`
`56`	`56`
`57`		`- err := os.WriteFile(tempFile, []byte(content), 0644)`
	`57`	`+ err := os.WriteFile(tempFile, []byte(content), 0600)`
`58`	`58`	`if err != nil {`
`59`	`59`	`t.Fatalf("Failed to create temp file: %v", err)`
`60`	`60`	`}`
Original file line number	Diff line number	Diff line change
`@@ -424,11 +424,11 @@ func TestManagerSendAsyncQueueDisabled(t *testing.T) {`
`424`	`424`	`}`
`425`	`425`	`}`
`426`	`426`
`427`		`-func TestManagerAddNotificationHandler(t *testing.T) {`
	`427`	`+func TestManagerAddNotificationHandler(_ *testing.T) {`
`428`	`428`	`config := mail.DefaultConfig()`
`429`	`429`	`manager := mail.NewManager(config, nil)`
`430`	`430`
`431`		`- handler := func(ctx context.Context, from string, to []string, data io.Reader) error {`
	`431`	`+ handler := func(_ context.Context, _ string, to []string, _ io.Reader) error {`
`432`	`432`	`return nil`
`433`	`433`	`}`
`434`	`434`
Original file line number	Diff line number	Diff line change
`@@ -59,17 +59,17 @@ func NewSecurityManager(config SecurityConfig) *SecurityManager {`
`59`	`59`	`sm.allowedNetworks = append(sm.allowedNetworks, network)`
`60`	`60`	`continue`
`61`	`61`	`}`
`62`		`-`
	`62`	`+`
`63`	`63`	`ip := net.ParseIP(ipStr)`
`64`	`64`	`if ip == nil {`
`65`	`65`	`continue`
`66`	`66`	`}`
`67`		`-`
	`67`	`+`
`68`	`68`	`// Single IP address - convert to /32 or /128 network`
`69`	`69`	`var network *net.IPNet`
`70`		`- _, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6`
	`70`	`+ _, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6`
`71`	`71`	`if ip.To4() != nil {`
`72`		`- _, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4`
	`72`	`+ _, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4`
`73`	`73`	`}`
`74`	`74`	`sm.allowedNetworks = append(sm.allowedNetworks, network)`
`75`	`75`	`}`
`@@ -80,17 +80,17 @@ func NewSecurityManager(config SecurityConfig) *SecurityManager {`
`80`	`80`	`sm.blockedNetworks = append(sm.blockedNetworks, network)`
`81`	`81`	`continue`
`82`	`82`	`}`
`83`		`-`
	`83`	`+`
`84`	`84`	`ip := net.ParseIP(ipStr)`
`85`	`85`	`if ip == nil {`
`86`	`86`	`continue`
`87`	`87`	`}`
`88`		`-`
	`88`	`+`
`89`	`89`	`// Single IP address - convert to /32 or /128 network`
`90`	`90`	`var network *net.IPNet`
`91`		`- _, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6`
	`91`	`+ _, network, _ = net.ParseCIDR(ipStr + "/128") // Default to IPv6`
`92`	`92`	`if ip.To4() != nil {`
`93`		`- _, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4`
	`93`	`+ _, network, _ = net.ParseCIDR(ipStr + "/32") // Override for IPv4`
`94`	`94`	`}`
`95`	`95`	`sm.blockedNetworks = append(sm.blockedNetworks, network)`
`96`	`96`	`}`
`@@ -154,7 +154,7 @@ func (sm *SecurityManager) ValidateConnection(remoteAddr string) error {`
`154`	`154`	`}`
`155`	`155`	`return &SecurityError{Type: "auth_blocked", Message: "IP temporarily blocked due to authentication failures"}`
`156`	`156`	`}`
`157`		`-`
	`157`	`+`
`158`	`158`	`// Reset auth failure tracking after window expires`
`159`	`159`	`tracker.blocked = false`
`160`	`160`	`tracker.failures = 0`