---
id: w4/m16/t008
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m16/t006]
---

## Objective

Standing closing task: add tests that assert m16's real behavior and failure modes — not snapshots. The seams: the consent server functions (mock Hydra admin) and the route/page decision logic.

## Context

- Existing pattern: `dashboard/src/common/server-fn/__tests__/` already tests `hydra-consent.ts`'s headless paths — extend, don't duplicate.
- Failure modes worth pinning: unknown client + session ⇒ page data (not 403); approve ⇒ accept called with requested scopes + `remember: true`; deny ⇒ reject with `access_denied`; subject mismatch ⇒ refused, no accept call; foreign-origin approve ⇒ rejected; no session ⇒ login redirect with return_to; Hydra admin error ⇒ deny/error state, never accept; trusted path byte-identical (existing tests keep passing untouched); PKCE-missing still 400.

## Steps

1. Extend the server-fn tests with the decision-matrix cases above (mocked `OAuth2Api`).
2. Component test for the consent page render (client name + scopes shown, buttons wired) if cheap; skip pixel snapshots.
3. Full `yarn test` green.

## Files

- `dashboard/src/common/server-fn/__tests__/`
- `dashboard/src/features/auth/` `__tests__` (component test)

## Acceptance criteria

- [ ] Every failure mode listed in Context has an asserting test that fails if the guard is removed.
- [ ] No trivial/tautological/snapshot-everything tests; full suite green.

## Out of scope

- Live-cluster testing (t004's e2e script owns that).
