---
id: w6/m4/t009
title: Unit test coverage for label stamps and purgers
worker: worker6
status: done
estimate: 40m
depends_on: [w6/m4/t007]
---

## Objective

Add meaningful unit tests (below the t006 integration test) asserting real behavior and failure modes for the label fixes and purger implementations — not trivial/tautological tests.

## Context

- t006 covers the end-to-end integration path; this task covers fast unit-level coverage for each individual piece.
- `lego/backend/internal/postgres/ownerid_test.go` already exists — extend it rather than creating a parallel file if it's the natural home for the Postgres label-stamp assertion.

## Steps

1. Unit test: `CreatePostgres` stamps both labels with the correct tenant id value.
2. Unit test: `CreateKeyValue` stamps both labels with the correct tenant id value.
3. Unit test: `ListPostgres`/`ListKeyValues` with a non-empty `ownerID` return only that tenant's resources (not another tenant's, not everything).
4. Unit test: each purger (`secrets`, `postgres`, `keyvalue`) is idempotent — a second purge of an already-purged tenant is a no-op, not an error.

## Files

- `lego/backend/internal/postgres/ownerid_test.go` (extend)
- `lego/backend/internal/keyvalue/service_test.go` (or equivalent, new tests)
- `lego/backend/internal/secrets/service_test.go` (or equivalent, new tests)

## Acceptance criteria

- [ ] Label-stamp tests cover both Postgres and KeyValue creates
- [ ] Cross-tenant isolation asserted in list-filter tests (not just "returns something")
- [ ] Purger idempotency tests cover all three purgers
- [ ] `go test ./...` in `lego/backend/` is green

## Out of scope

- The full end-to-end integration test (t006, already done before this task runs).
