J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs(b3-1): coverage before/after, row count and pre-squash SHAs in the evidence block

Browse Source 
auth_handler.go 78.0% -> 90.2%, totp_handler.go 78.8% -> 91.1% (statements).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
This commit is contained in:
J3vb
2026-08-29 20:39:31 +02:00
co-authored by Claude Fable 5
parent b7317d03e0
commit a0356ee1d4
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/b3-server-architecture-guardrails-2026-08-29.md
+33
View File
@@ -290,6 +290,39 @@ files' coverage are in the evidence block. One PR.
failing (crypto/rand), and the partial-token TTL expiry (no clock on the failing (crypto/rand), and the partial-token TTL expiry (no clock on the
store). B3-2's service interface is where a seam for these would go; they are store). B3-2's service interface is where a seam for these would go; they are
not behaviour the slice moves. not behaviour the slice moves.
- **Characterization file:** `Server/api/auth_characterization_test.go` —
**12 tests, 44 table rows** (56 `PASS` lines under `-v`), green on HEAD and
under `-race`. Fault injection is the database itself (`ALTER TABLE x RENAME
TO x_gone` for read faults, `RAISE(FAIL)` triggers for write faults), so no
handler is mocked. Three `// known:` rows → ledger **OC-0376**, **OC-0377**,
**OC-0378** (all `low`, open, B3-9). Because a pinning test is green by
construction, three mutations stood in for RED: `401→500` in
`totpChallengeSecret` (2 rows RED), `500→401` in `loginAuthenticate` (1 row
RED), `503→401` in `AuthMiddleware` (1 test RED); tree restored.
- **Coverage** (`go test -coverprofile ./api/`, statements, filtered to the two
files — B3-2 must not drop it):
| File | Before (`d383d8c7`) | After B3-1 |
| --------------------- | ------------------- | ------------------- |
| `api/auth_handler.go` | 198/254 = **78.0%** | 229/254 = **90.2%** |
| `api/totp_handler.go` | 141/179 = **78.8%** | 163/179 = **91.1%** |
| `api` package | 83.5% | 85.8% |
Functions still short of 100%: `handleRegister` 80.6% (the post-commit
`GetUserByID` failure and `GenerateToken` failure, not injectable),
`registerReadRequest`/`loginReadRequest` (invalid-username and
password-strength branches are `auth/` tests), `handleMe` 66.7% (the
no-principal branch is unreachable behind `AuthMiddleware`), `issueSession`
83.3% (`GenerateToken` failure).
- **Pre-squash SHAs:** `659c8cbd` (B3-0 SHA recorded), `0905a942` (inventory
table), `b7317d03` (characterization file + ledger + claim updates), plus the
coverage commit that carries this bullet.
- Gates before every commit: `check:docs`, `check:hygiene`; from `Server/` the
four build-tag variants, `go vet`, `go test -race ./...`, `go test -tags
deadlock ./ws/`, `golangci-lint run` (first run tripped `prealloc` and
`modernize` on the timing row — fixed), `sqlc generate` and `genprotocol`
drift checks.
## B3-2 — The auth vertical slice (S-10) ## B3-2 — The auth vertical slice (S-10)