---
id: w1/m16/t006
title: Test coverage — meaningful tests for groups + linking + secret-file projection
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m16/t004]
---

## Objective

Standing test-coverage task: add meaningful tests for the milestone's load-bearing behavior — environment-group CRUD, link/unlink re-projecting linked services' `<name>-env` Secrets, and secret-file projection into the Secret + `/etc/secrets` mount. Tests should catch regressions in the projection and precedence logic, not just exercise happy-path CRUD.

## Context

- Backend tests run from `lego/backend` (`go test ./...`); operator/envtest via `make test` from `lego/operator/`.
- Highest-value cases: editing a linked group re-projects **every** linked service; unlink removes the group's vars; group-vs-service var precedence resolves deterministically; a secret file lands in the Secret as a file entry and mounts at `/etc/secrets/<name>` without leaking into env vars.
- Fail-closed (503 when `BEX_OPENBAO_URL` unset) and authz (403 for a tuple-less key) are cheap, high-signal cases already established for env vars — mirror them.

## Steps

1. Group CRUD + link/unlink Core tests, asserting re-projection of every linked service.
2. Var-precedence test (group vs service-local key collision).
3. Secret-file projection test: file entry in the `<name>-env` Secret + `/etc/secrets/<name>` mount, env vars unaffected.
4. Fail-closed (503) + authz (403) tests for the new verbs.
5. Dashboard tests for the Env-Groups view + Environment-tab controls.

## Files

- `lego/backend/internal/secrets/*_test.go` — Core + projection tests.
- `lego/operator/` — envtest for the `/etc/secrets` volumeMount, if the mount is reconciled operator-side.
- `dashboard/` — component/UI tests for the new views.

## Acceptance criteria

- [ ] Group CRUD + link/unlink re-projection covered (edit re-projects all linked services; unlink removes vars).
- [ ] Var-precedence collision covered.
- [ ] Secret-file projection + mount covered (file mounts, env vars unaffected).
- [ ] Fail-closed (503) + authz (403) covered for the new verbs.
- [ ] `make test` + dashboard tests green.

## Out of scope

- E2E (`make test-e2e`) — CI territory, not run casually.
