---
id: w7/m7/t005
title: Test coverage — meaningful tests for the scoped RBAC + CI guard
worker: worker7
status: todo
estimate: 30m
depends_on: [w7/m7/t003]
---

## Objective

Add meaningful tests that assert the least-privilege posture holds and the guard actually catches regressions — not tautological manifest snapshots. Cover: (1) the CI guard fails on a re-broadened fixture and passes on the scoped manifests; (2) where feasible (envtest), the operator's scoped permissions still cover its real Secret operations.

## Context

- The CI guard (t003) is the primary regression surface — give it a negative fixture (a ClusterRole with cluster-wide secrets read) and a positive one (the scoped manifests).
- Operator envtest (`make test` in `lego/operator/`) can exercise that reconcile still succeeds under the narrowed RBAC, catching an over-tight grant.

## Steps

1. Add a test asserting the t003 guard fails on the negative RBAC fixture and passes on the current manifests.
2. If practical, add/extend an envtest that reconcile (build clone-secret read, tenant Secret create) still works under the scoped role.
3. Run the operator + backend test suites.

## Files

- Test for the guard (alongside `gitops-validate.sh` / gitops workflow test harness)
- `lego/operator/internal/controller/*_test.go` (envtest, if used)

## Acceptance criteria

- [ ] A test proves the guard rejects a cluster-wide secrets-read fixture and accepts the scoped manifests.
- [ ] Operator/backend suites pass under the narrowed RBAC (no operation broken by over-tightening).

## Out of scope

- The Closeout DoD verification (t006).
