---
id: w1/m9/t006
title: Test coverage — meaningful tests for tenant onboarding + workspace scoping
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m9/t004]
---

## Objective

Add meaningful tests for the behavior this milestone shipped: idempotent/race-safe tenant mint, key↔tenant binding (including the FGA-failure rollback), workspace-scoped authorize and list/get filtering, and the store-off fallback. Tests must assert real behavior and failure modes — no trivial, tautological, or snapshot-everything tests.

## Acceptance criteria

- [ ] Failure modes covered: concurrent first login, FGA write failure on mint (no orphaned Hydra client), cross-tenant Get → 403, store-off → default-workspace behavior unchanged.
- [ ] `go test ./...` green in `lego/backend`.
