---
id: w7/m5/t007
title: Test coverage — meaningful tests for allowlist projection + surface round-trip
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m5/t005]
---

## Objective

Add meaningful tests for the behavior this milestone shipped: the operator projects `ipAllowList` into a Traefik TCP `ipAllowList` middleware on the public route (and removes it when empty), and the field round-trips on the API surfaces. Assert real behavior and failure modes — not snapshots.

## Context

- Operator: `lego/operator/internal/controller/keyvalue_test.go` — extend for the middleware projection; assert middleware present with the given CIDRs when public + non-empty, absent when empty or internal-only.
- Backend: the KeyValue adapter tests (`lego/backend/internal/keyvalue/…`) — assert `ipAllowList` set-and-read round-trips on at least REST + GraphQL; MCP create carries it.

## Steps

1. Operator test: KeyValue with `ipAllowList` + public ⇒ SNI route carries the `ipAllowList` middleware with those CIDRs; empty ⇒ no middleware; internal-only ⇒ unaffected.
2. Backend test: create/update with `ipAllowList`, read it back on REST + GraphQL; MCP `create_key_value` accepts it.
3. `cd lego/operator && go test ./internal/controller/...` and `cd lego/backend && go test ./...`.

## Files

- `lego/operator/internal/controller/keyvalue_test.go`
- `lego/backend/internal/keyvalue/*_test.go`

## Acceptance criteria

- [ ] A test fails if the allowlist stops being projected onto the public route (or isn't removed on empty).
- [ ] A test fails if `ipAllowList` stops round-tripping on REST/GraphQL/MCP.
- [ ] No tautological/snapshot-everything tests.

## Out of scope

- Live cluster verification (covered by the DoD at closeout).
