Skip to content

test(ws-server): CPProvisioner coverage — auth, env fallback, error paths - #990

Merged
HongmingWang-Rabbit merged 1 commit into
stagingfrom
fix/cp-provisioner-tests
Apr 19, 2026
Merged

HongmingWang-Rabbit merged 1 commit into
stagingfrom
fix/cp-provisioner-tests

Conversation

@HongmingWang-Rabbit

Copy link
Copy Markdown
Contributor

Summary

Post-merge regression audit flagged `cp_provisioner.go` as the only new file from the canary/C1 rollout without test coverage. This fills the gap with 6 focused unit tests:

  • `NewCPProvisioner_RequiresOrgID` — self-hosted without `MOLECULE_ORG_ID` refuses to construct (avoids silent phone-home to prod CP)
  • `NewCPProvisioner_FallsBackToProvisionSharedSecret` — operator ergonomics of one env-var name on both sides of the wire
  • `AuthHeader_NoopWhenSecretEmpty` + `AuthHeader_SetsBearerWhenSecretSet` — bearer is only emitted when a secret is configured
  • `Start_HappyPath` — end-to-end POST to stubbed CP, bearer forwarded, `instance_id` parsed
  • `Start_Non201ReturnsStructuredError` — structured `{"error":"…"}` surfaces to caller
  • `Start_NoStructuredErrorFallsBackToSize` — regression gate for the anti-log-leak change from fix(security): scrub workspace-server token + upstream error logs #980 (raw upstream body must NOT appear in the error — only byte count)

Test plan

  • `go test ./internal/provisioner/...` passes

🤖 Generated with Claude Code

Post-merge audit flagged cp_provisioner.go as the only new file from
the canary/C1 work without test coverage. Fills the gap:

- NewCPProvisioner_RequiresOrgID — self-hosted without MOLECULE_ORG_ID
  refuses to construct (avoids silent phone-home to prod CP).
- NewCPProvisioner_FallsBackToProvisionSharedSecret — the operator
  ergonomics of using one env-var name on both sides of the wire.
- AuthHeader noop + happy path — bearer only set when secret is set.
- Start_HappyPath — end-to-end POST to stubbed CP, bearer forwarded,
  instance_id parsed out of response.
- Start_Non201ReturnsStructuredError — when CP returns structured
  {"error":"…"}, that message surfaces to the caller.
- Start_NoStructuredErrorFallsBackToSize — regression gate for the
  anti-log-leak change from PR #980: raw upstream body must NOT
  appear in the error, only the byte count.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@HongmingWang-Rabbit
HongmingWang-Rabbit merged commit b8ccc06 into staging Apr 19, 2026
9 checks passed
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
test(ws-server): CPProvisioner coverage — auth, env fallback, error paths
@HongmingWang-Rabbit
HongmingWang-Rabbit deleted the fix/cp-provisioner-tests branch April 24, 2026 00:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant