---
id: w4/m1/t009
title: Test coverage — meaningful tests for the behavior this milestone shipped
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m1/t007]
---

## Objective

Add meaningful, repeatable checks for what m1 shipped: manifests render and validate, and the auth substrate behaves (identity persistence, token issuance). Tests must assert real behavior and failure modes — no tautological or snapshot-everything tests.

## Context

- Standing closing task. For a GitOps milestone the test surface is: `kustomize build` renders base + local overlay; server-side dry-run validates; `scripts/auth-verify.sh` (t006) passes as the behavioral check.
- Negative cases matter: `auth-secrets.sh` fails cleanly on a missing `.env` key; token request with a wrong client secret is rejected.

## Steps

1. Add a validation script or CI step: `kustomize build` both base and `overlays/local` must succeed.
2. Extend `scripts/auth-verify.sh` with negative assertions (bad client secret → no token; introspection of a garbage token → `active: false`).
3. Wire into whatever check pipeline the repo uses for manifests (or document the manual invocation in the milestone).

## Files

- `scripts/auth-verify.sh`
- CI/validation config as applicable

## Acceptance criteria

- [ ] Rendering validation fails the build when a manifest is broken (verified by intentionally breaking one locally).
- [ ] Negative auth cases assert rejection, not just happy path.

## Out of scope

- Go unit tests for bex-api middleware (w4/m2's closing task covers those).
