---
id: w4/m2/t006
title: Test coverage — meaningful tests for the behavior this milestone shipped
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m2/t004]
---

## Objective

Round out Go test coverage for the auth middleware beyond t001/t002's basics: mode selection, fail-closed behavior, credential precedence (bearer before session), and startup validation. Tests must assert real behavior and failure modes — never trivial, tautological, or snapshot-everything tests.

## Context

- Standing closing task. Test seams: fake Hydra introspection + fake Kratos `whoami` servers (httptest), table-driven over mode × credential × expected status.
- Runs under `make test` (unit + envtest) from `operator/`.

## Steps

1. Table-driven middleware tests: {static, ory} × {valid bearer, inactive bearer, valid session, expired session, nothing} → expected status.
2. Fail-closed tests: introspection timeout / 5xx → request rejected, not passed through.
3. Startup validation test: `ory` mode with missing URLs errors.

## Files

- `operator/internal/api/auth_test.go` (or extend `api_test.go`)

## Acceptance criteria

- [ ] All table cases assert status codes and (where applicable) identity context; `make test` green.
- [ ] A deliberately broken fail-closed case fails the suite (mutation check done locally).

## Out of scope

- E2E against a real cluster (t004 covers that); load testing.
