---
id: w6/m2/t008
title: Test coverage — meaningful tests for the behavior this milestone shipped
worker: worker6
status: done
estimate: 30m
depends_on: [w6/m2/t006]
---

## Objective

Behavioral tests for the read API and MCP scoping: the own-→default-workspace quirk, membership-bounded visibility, ownerId filtering, and stateful MCP selection — including the failure modes (foreign workspace, unknown id, unselected session).

## Context

- Existing API handler tests in `lego/backend/internal/api/` set the pattern; two-tenant fixtures exist from w1/m9's tests.

## Steps

1. REST: list bounded to memberships; name/email filters; `own-` id resolution; cross-tenant 403/404; envelope shape assertions against pinned schema.
2. ownerId: field present on resource objects; filter honored; inaccessible ownerId behavior.
3. MCP: select→scoped-list flow; foreign-id selection rejected leaving prior selection intact; unselected default.

## Files

- `lego/backend/internal/api/*_test.go`
- `lego/backend/internal/core/*_test.go`

## Acceptance criteria

- [x] Each DoD clause of the milestone has a corresponding test, including negative cases (`workspaces/owners_test.go`, `apps/ownerid_test.go`, `postgres/ownerid_test.go`, `api/owners_rest_test.go`, `api/owners_mcp_test.go`)
- [x] `go test ./...` green

## Out of scope

- Live-Render contract tests (manual, in t006).
