---
id: w1/m11/t005
title: Test coverage — meaningful tests for the custom-domains surface
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m11/t002, w1/m11/t003]
---

## Objective

Meaningful tests for what shipped: add/list/delete round-trips (including deleting the primary host), hostname validation rejects garbage, status resolver's pending→ready flip, authz gate on every new verb (`TestAuthzGuardsEveryVerb` must cover them), and three-surface parity. Assert real behavior and failure modes; no snapshot-everything.

## Acceptance criteria

- [ ] Failure modes covered: duplicate add, delete of unknown domain (404), unauthorized caller (403), missing cert Secret → pending status.
- [ ] `go test ./...` green in `lego/backend`.
