---
id: w4/m8/t006
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m8/t004]
---

## Objective

Gap-scan the milestone's DoD against what t004 covered and close the holes on both sides of the wire: Go tests for the session-caller GraphQL path (session mints/lists/revokes; bearer path unchanged; unauthenticated 401) and any missing dashboard failure modes (mint mutation error surfaces to the user; revoke failure leaves the key listed). Tests must assert real behavior and failure modes — never trivial, tautological, or snapshot-everything tests.

## Context

- Standing closing task; `make test` with the GOTOOLCHAIN pin (memory: go-toolchain-quirk) + dashboard suite.

## Steps

1. Diff DoD + t001–t003 acceptance criteria against existing tests.
2. Add missing cases, favoring failure modes; both suites green.

## Files

- `operator/internal/api/*_test.go`
- `dashboard/src/features/` api-keys tests

## Acceptance criteria

- [x] Every DoD clause maps to an asserting test; `make test` + dashboard suite green.

## Out of scope

- m4's checker tests (owned by m4).

## Resolution

Gap-scanned the DoD + t001–t003 acceptance criteria against the tests written in t001/t004 and closed the one real hole: `TestAPIKeys_SessionCaller` (`internal/api/server_test.go`) had session mint/list/revoke, forbidden, and unauthenticated-401 subtests, but nothing proving the **bearer** GraphQL path for api-keys still works unchanged alongside the new session path — added "bearer path is unchanged — still mints via GraphQL alongside the new session path" (uses the existing `gql` helper + `testToken`, asserting the same `createApiKey` mutation succeeds over a bearer token on the same handler that also serves sessions).

Everything else in scope was already covered by t004's tests, cross-checked here: mint-mutation-error-surfaces-to-user (`create-api-key-dialog.test.tsx`'s "a create failure... keeps the dialog on the name step"), revoke-failure-leaves-the-key-listed (`api-keys-panel.test.tsx`'s "a failed revoke does not refetch — the key stays listed"). The DoD's "revoke ⇒ token no longer authenticates" clause is explicitly scoped to `scripts/auth-e2e.sh` (pre-existing m3 E2E infra, not a new unit test); "no new REST surface" is satisfied by inspection (only `.graphql` operations added, no `rest.go` changes). `go build ./... && go vet ./... && go test ./...` (backend) and `yarn typecheck && yarn lint && yarn test` (dashboard, 62 files / 421 tests) all green.
