---
id: w4/m4/t008
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m4/t006]
---

## Objective

Round out coverage for the authorization behavior: the checker matrix (nil / allow / deny / error × the three adapters), the openfgaChecker impl against a fake FGA server (check semantics, preshared header, cache behavior, fail-closed), model-script idempotency, and a deliberate fail-open mutation check.

## Context

- Standing closing task. Seams: fake `Checker` for adapter tests (like `fakeKeyStore`), `httptest` FGA server for the impl (like `fakeHydraAdmin`).
- Negative cases matter most: deny must be 403 (not 500), checker outage must be 503 (never pass-through), and a mutated fail-open `authorize` must fail the suite loudly (mutation check done locally, as m2 did for the auth gate).

## Steps

1. Table-driven adapter tests over the verb→permission map.
2. `openfgaChecker` impl tests (allowed/denied/timeout/5xx/cache-hit counting).
3. Mutation check: flip fail-closed to fail-open locally, confirm the suite fails, revert (without `git checkout` on uncommitted files — restore by re-editing).

## Files

- `operator/internal/api/authz_test.go` (new)

## Acceptance criteria

- [ ] All matrix cases assert status codes and subjects; `make test` green.
- [ ] The fail-open mutation makes the suite fail (verified and reverted).

## Out of scope

- E2E against real OpenFGA (t005 owns that); load testing check latency.
