test(matrix): misc route coverage — incidents/confirm-deletion/usage-wall/webhook-inspector/experiments (exempt→mapped)#258
Merged
Conversation
…wall/webhook-inspector/experiments (exempt→mapped)
Closes the last real-flow wave of the route-coverage tail: the five "misc"
routes that lived in route_donebar_guard_test.go's routeCoverageExemptions
with a TODO pointer and no mapped test now move exempt→mapped, backed by a new
DB-backed handler-integration suite (misc_routes_block_integration_test.go,
TestMiscBlock_*) that drives each route through the SAME middleware chain
router.go wires against a real migrated Postgres:
- GET /api/v1/incidents → TestMiscBlock_Incidents_PublicFeed
public status-page feed contract ({ok,items,total,status_page}, no auth).
- GET /auth/email/confirm-deletion → TestMiscBlock_ConfirmDeletionRedirect_TokenBranches
tokenized email-link redirect (token IS the credential): present token →
302 to dashboard with token carried verbatim; missing/blank → canonical
400 missing_token envelope.
- GET /api/v1/usage/wall → TestMiscBlock_UsageWall_RealDBContract
RequireAuth chain + real Postgres: 401 unauth, near_wall=true + flattened
metadata + cache headers, team-tier short-circuit, team-scoped isolation.
- GET /api/v1/webhooks/:token/requests → TestMiscBlock_WebhookInspector_TokenScopedAndIsolated
receive→store→inspect round-trip: token-as-bearer reads only its own
captures (cross-token isolation), invalid→400, unknown→404, cross-team
session→403.
- POST /api/v1/experiments/converted → TestExperimentsConverted_WritesAuditRow
already DB-backed + production-router covered by experiments_test.go; the
row points there rather than duplicating the audit round-trip.
Helpers are prefixed misc* (no redefinition of miniRedis/doJSON/decodeBody/
requireTestDB). After the move, the remaining routeCoverageExemptions hold only
legitimately-exempt routes (OPTIONS/CORS preflight, app.All verb fan-out,
static content, GitHub-App OAuth/HMAC callbacks, internal/operator + admin-
console, SES/Brevo provider webhooks) plus the W3 billing/api-keys/audit + W4
stack-env real flows that carry their own matrix-wave TODO pointers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the last real-flow wave of the route-coverage tail. The five "misc" routes that lived in
route_donebar_guard_test.go'srouteCoverageExemptions(TODO pointer, no mapped test) move exempt→mapped, each pointed at real DB-backed integration coverage.New suite:
internal/handlers/misc_routes_block_integration_test.go(TestMiscBlock_*) — drives each route through the SAME middleware chainrouter.gowires (RequireAuth / OptionalAuth / bare public) against a real migrated Postgres (+ Redis for the inspector round-trip).GET /api/v1/incidentsTestMiscBlock_Incidents_PublicFeedGET /auth/email/confirm-deletionTestMiscBlock_ConfirmDeletionRedirect_TokenBranchesmissing_tokenGET /api/v1/usage/wallTestMiscBlock_UsageWall_RealDBContractGET /api/v1/webhooks/:token/requestsTestMiscBlock_WebhookInspector_TokenScopedAndIsolatedPOST /api/v1/experiments/convertedTestExperimentsConverted_WritesAuditRowexperiments_test.go; row points thereScope
One self-contained PR: new test file + guard-map move. No handler-source edits. Helpers prefixed
misc*(no redefinition ofminiRedis/doJSON/decodeBody/requireTestDB).Rebased onto
origin/masterafter #257 (billing/api-keys/audit) merged into the same guard file — both disjoint move-sets preserved, guards green.Post-move exemption audit
Remaining
routeCoverageExemptionsare all legitimately exempt:webhook/receive/:tokennon-GET/POST verb fan-out (app.All; POST round-trip mapped)Real-flow routes still exempt — W3 billing invoices/usage/payment/change-plan/promo + W4
PATCH /stacks/:slug/env— carry their own matrix-wave TODO pointers and are out of this wave's scope.Gate
make gate— green except the documented pre-existing flakes (TestLinkGitHubID,TestGetExpiredDeployments,TestGetDeploymentsExpiringSoon,TestQueue_*NATS-503; all in untouchedinternal/models/ NATS-dependent, identical on clean origin/master). AllTestMiscBlock_*+ the router done-bar guards pass.🤖 Generated with Claude Code