---
id: w4/m9/t007
title: Test coverage
worker: worker4
status: done
estimate: 45m
depends_on: [w4/m9/t005]
---

## Objective

Add meaningful tests for m9's behavior and failure modes: the login/sign-up
`login_challenge` passthrough (and the no-challenge path being unchanged), the
consent acceptor's accept/deny/stale-challenge branches, and bex-api's
protected-resource metadata + `WWW-Authenticate` enrichment (and its
env-unset no-op).

## Context

- Dashboard: vitest, adjacent `__tests__/` (route search validation,
  `use-ory-flow` param threading, consent server handler with a mocked Hydra
  admin).
- Backend: Go table tests next to `server.go` (metadata endpoint, 401 header,
  `BEX_OAUTH_ISSUER` unset ⇒ 404/bare header).
- Never game coverage: assert observable behavior (accepted/denied/redirected,
  headers, JSON bodies), not implementation details.

## Steps

1. Dashboard tests: challenge passthrough + no-challenge unchanged; consent accept (trusted/skip), deny (unknown), stale-challenge redirect.
2. Go tests: metadata JSON, enriched 401 on `/mcp`, unset-env no-op.
3. Full gates: dashboard `yarn lint && yarn typecheck && yarn test && yarn build`; backend `go vet ./... && go test ./...`.

## Files

- `dashboard/src/routes/__tests__/*`, `dashboard/src/common/**/__tests__/*`
- `lego/backend/internal/api/*_test.go`

## Acceptance criteria

- [x] Tests cover passthrough, consent accept/deny/stale, metadata/header incl. the negative (env unset) case.
- [x] All dashboard + backend gates green.

## Out of scope

- Load/security penetration testing.
