test(middleware): lock rapid-request tracker reset in TestIsRapidRequest

internal/middleware/security_logging.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"os"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -220,18 +221,29 @@ func isSuspiciousUserAgent(userAgent string) bool {
 	return false
 }
 
-var requestCounts = make(map[string]int)
+type rapidRequestTracker struct {
-var lastReset = time.Now()
+	mu        sync.Mutex
+	counts    map[string]int
+	lastReset time.Time
+}
+
+var rapidRequests = rapidRequestTracker{
+	counts:    make(map[string]int),
+	lastReset: time.Now(),
+}
 
 func isRapidRequest(ip string) bool {
+	rapidRequests.mu.Lock()
+	defer rapidRequests.mu.Unlock()
+
 	now := time.Now()
 
-	if now.Sub(lastReset) > time.Minute {
+	if now.Sub(rapidRequests.lastReset) > time.Minute {
-		requestCounts = make(map[string]int)
+		rapidRequests.counts = make(map[string]int)
-		lastReset = now
+		rapidRequests.lastReset = now
 	}
 
-	requestCounts[ip]++
+	rapidRequests.counts[ip]++
 
-	return requestCounts[ip] > 100
+	return rapidRequests.counts[ip] > 100
 }

internal/middleware/security_logging_test.go

@@ -453,8 +453,10 @@ func TestIsSuspiciousUserAgent(t *testing.T) {
 
 func TestIsRapidRequest(t *testing.T) {
 
-	requestCounts = make(map[string]int)
+	rapidRequests.mu.Lock()
-	lastReset = time.Now()
+	rapidRequests.counts = make(map[string]int)
+	rapidRequests.lastReset = time.Now()
+	rapidRequests.mu.Unlock()
 
 	ip := "192.168.1.1"