---
id: w7/m3/t007
title: "Test coverage — meaningful tests for limiting, reset, per-caller isolation, caps"
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m3/t005]
---

## Objective

Add meaningful tests for the behavior this milestone shipped: a caller over budget gets 429 + `Retry-After` while another caller stays 200 (per-caller isolation), the bucket refills over time, exempted endpoints keep their own budget, and the body/range/SSE caps refuse what they must. Tests assert real behavior and failure modes, never tautologies.

## Context

- Standing closing task (`.claude/commands/pm.md`).
- httptest against the assembled router in `lego/backend/internal/api` covers all three adapters through one mux; fake clock (or injected limiter) for refill without sleeps.
- Failure modes worth pinning: unauthenticated fallback keys off IP; a revoked key's bucket doesn't leak to the next caller; SSE over-cap closes cleanly.

## Steps

1. Limiter unit tests (isolation, refill, eviction).
2. Router-level tests: 429 envelope + header on REST/GraphQL/MCP paths; webhook exemption; 413 body; 400 range; SSE cap.
3. `go test ./...` from `lego/backend/`.

## Files

- `lego/backend/internal/api/` tests (+ `logs`/`metrics` cap tests)

## Acceptance criteria

- [ ] Tests fail if the 429 envelope, `Retry-After`, or per-caller keying regresses
- [ ] Caps covered: body 413, range 400/clamp, SSE refusal
- [ ] `go test ./...` passes without time.Sleep-based flakiness

## Out of scope

- Load/perf testing (not a unit concern)
