Test Coverage Gap Analysis — Road to 100%

#[derive(Clone)]
pub struct JwksProvider {
    issuer: String,
    fetch_url: String,
    client: reqwest::Client,
    keys: Arc<RwLock<Option<JwkSet>>>,  // None until first refresh()
}

// Test setup pattern:
use rsa::RsaPrivateKey;
use rsa::pkcs1::EncodeRsaPublicKey;
use jsonwebtoken::{encode, EncodingKey, Header, Algorithm};
use jsonwebtoken::jwk::{Jwk, JwkSet, CommonParameters, RsaKeyParameters, KeyAlgorithm};

async fn test_provider(issuer: &str) -> (JwksProvider, EncodingKey) {
    let mut rng = rand::rng();
    let private_key = RsaPrivateKey::new(&mut rng, 2048).unwrap();
    let public_key = private_key.to_public_key();
    // Build JWK from public key DER, set kid = "test-kid-1"
    // Build JwkSet with that single JWK
    let provider = JwksProvider::with_fetch_url(issuer, "http://unused");
    *provider.keys.write().await = Some(jwk_set);
    let encoding_key = EncodingKey::from_rsa_der(&private_key.to_pkcs1_der().unwrap().as_bytes());
    (provider, encoding_key)
}

pub async fn auth_middleware(
    State(layer): State<AuthLayer>,
    mut request: Request,
    next: Next,
) -> Response {
    let token = request.headers().get("authorization")
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.strip_prefix("Bearer "));
    let Some(token) = token else {
        return (StatusCode::UNAUTHORIZED, "missing or invalid authorization header").into_response();
    };
    match layer.provider.validate_token(token).await {
        Ok(claims) => { request.extensions_mut().insert(claims); next.run(request).await }
        Err(e) => { (StatusCode::UNAUTHORIZED, "invalid token").into_response() }
    }
}

#[tokio::test]
async fn audit_trail_captures_inbound_events() {
    // 1. Use harness.admin_cases_client() to create a case (triggers "case.created" event)
    // 2. Sleep 2 seconds for the event subscriber to process
    // 3. Use harness.admin_security_client() to query GET /v1/security/audit?action=create&resource_type=case
    // 4. Assert at least one audit entry exists with action="create", resource_type="case"
    // 5. Verify the resource_id matches the created case ID
}

// Test 1: payment_lifecycle_approve_issue_clear
// - Create a rate (POST /v1/financial/rates)
// - Create a case + placement via cases/placement services (or use seed data)
// - Calculate payment (POST /v1/financial/payments/calculate) → get payment ID
// - Approve (PUT /v1/financial/payments/{id}/approve) → assert 200, status="approved"
// - NOTE: issue and clear transitions may need direct store calls if no API endpoint exists
//         Check if there's an issue_payment endpoint; if not, just test approve.

// Test 2: eligibility_evaluated_updates_ffp
// - Create a rate + calculate a payment (status="pending")
// - Publish an EventEnvelope with event_type="eligibility.evaluated"
//   payload: { case_id, child_id, ive_eligible: true, ffp_rate: 0.75 }
// - Retry-poll GET /v1/financial/payments/{id} until ffp_rate/ffp_amount are updated (5s timeout)
// - Assert ive_eligible=true, ffp_rate=0.75, ffp_amount = net_amount * 0.75

// Test 3: placement_created_auto_generates_payment
// - Create a rate for jurisdiction/payment_type/age
// - Publish EventEnvelope with event_type="placement.created"
//   payload: { case_id, child_id, placement_id, foster_home_id, placement_type, child_age }
// - Retry-poll GET /v1/financial/payments?case_id=... until a payment appears
// - Assert payment exists with correct placement_id, daily_rate, gross_amount

// Test 4: placement_ended_voids_pending_payments
// - Create a payment in pending status (via calculate)
// - Publish EventEnvelope with event_type="placement.ended"
//   payload: { placement_id }
// - Retry-poll GET /v1/financial/payments/{id} until status="voided" (5s timeout)

// Test 5: claim_aggregation_with_issued_payments
// - Create a rate, calculate a payment, approve it
// - Advance to "issued" status (if API endpoint exists, or via direct store call)
// - Generate a claim (POST /v1/financial/claims/generate) for that period
// - Assert total_expenditure > 0, ive_eligible_amount reflects the payment

pub async fn update_submission_status(
    db: &sqlx::PgPool, id: Uuid, status: &str,
    reviewed_by: Option<&str>, reviewed_at: Option<DateTime<Utc>>,
    approved_by: Option<&str>, approved_at: Option<DateTime<Utc>>,
    transmitted_at: Option<DateTime<Utc>>,
) -> anyhow::Result<Option<AfcarsSubmission>>

// Test 1: afcars_full_lifecycle
// - Generate (POST /v1/reporting/afcars/generate) → status="validated"
// - Review (PUT /v1/reporting/afcars/{id}/review) → status="reviewed"
// - Approve (PUT /v1/reporting/afcars/{id}/approve) → status="approved"
// - Transmit (POST /v1/reporting/afcars/{id}/transmit) → status="transmitted"
// - Assert each step returns 200 and status field advances

// Test 2: ncands_full_lifecycle — same pattern for NCANDS

// Test 3: afcars_approve_from_validated_fails
// - Generate → status="validated"
// - Approve directly (skipping review) → assert 400

// Test 4: afcars_transmit_from_reviewed_fails
// - Generate, review → status="reviewed"
// - Transmit directly (skipping approve) → assert 400

// payments.rs: approve_payment_success
// - Create rate, calculate payment, then approve → assert 200, status="approved", approved_by is set

// adjustments.rs: adjustment_lifecycle
// - Create rate, calculate payment
// - Create adjustment (POST /v1/financial/payments/{payment_id}/adjustments) → assert 200
// - Approve adjustment (PUT /v1/financial/adjustments/{id}/approve) → assert 200
// - Get payment → verify net_amount = gross_amount + adjustment

// claims.rs: submit_and_verify_claim
// - Generate claim → assert status="draft"
// - Submit claim (PUT /v1/financial/claims/{id}/submit) → assert status="submitted"

let harness = TestHarness::new().await.unwrap();
let admin = harness.admin_financial_client().await.unwrap();
let supervisor = harness.supervisor_financial_client().await.unwrap();
// admin creates, supervisor approves (role-appropriate)

#[tokio::test]
async fn disabled_captcha_accepts_any_token() {
    let verifier = CaptchaVerifier::new("disabled".into(), "http://unused".into(), reqwest::Client::new());
    assert!(verifier.verify(None).await.is_ok());
    assert!(verifier.verify(Some("any-token")).await.is_ok());
}

#[tokio::test]
async fn enabled_captcha_rejects_missing_token() {
    let verifier = CaptchaVerifier::new("real-secret".into(), "http://localhost:1".into(), reqwest::Client::new());
    let result = verifier.verify(None).await;
    assert!(result.is_err());
    assert!(result.unwrap_err().contains("required"));
}

#[tokio::test]
async fn enabled_captcha_rejects_empty_token() {
    let verifier = CaptchaVerifier::new("real-secret".into(), "http://localhost:1".into(), reqwest::Client::new());
    let result = verifier.verify(Some("")).await;
    assert!(result.is_err());
    assert!(result.unwrap_err().contains("empty"));
}

// expired_api_key_returns_401
// - Create an API key (POST /v1/intake/api-keys)
// - Directly UPDATE the key's expires_at to a past timestamp via SQL:
//   UPDATE intake_api_keys SET expires_at = NOW() - INTERVAL '1 day' WHERE id = $1
// - Use the key to submit a report (POST /partner/v1/reports)
// - Assert 401 response with body containing "expired"

impl Default for DbPoolOpts {
    fn default() -> Self {
        Self {
            max_connections: 10,
            idle_timeout: Duration::from_secs(600),
        }
    }
}

#[test]
fn default_pool_opts() {
    let opts = DbPoolOpts::default();
    assert_eq!(opts.max_connections, 10);
    assert_eq!(opts.idle_timeout, Duration::from_secs(600));
}

impl Default for ServerOptions {
    fn default() -> Self {
        Self {
            cors_origins: "*".into(),
            body_limit: 2 * 1024 * 1024, // 2 MiB
        }
    }
}

#[test]
fn default_server_options() {
    let opts = ServerOptions::default();
    assert_eq!(opts.cors_origins, "*");
    assert_eq!(opts.body_limit, 2 * 1024 * 1024);
}

#[test]
fn build_cors_wildcard() {
    let layer = build_cors("*");
    // CorsLayer doesn't expose internals for assertion,
    // but we can verify it doesn't panic on "*"
}

#[test]
fn build_cors_specific_origins() {
    let layer = build_cors("http://a.com, http://b.com");
    // Verify no panic; specific origin parsing works
}

// All 6 conversion arms:
StoreError::NotFound(msg) → ApiError::NotFound(msg)
StoreError::TooLarge { size, limit } → ApiError::BadRequest("upload too large: {size} bytes exceeds limit of {limit} bytes")
StoreError::DisallowedContentType(ct) → ApiError::BadRequest("disallowed content type: {ct}")
StoreError::InvalidFilename(msg) → ApiError::BadRequest("invalid filename: {msg}")
StoreError::ObjectStore(e) → ApiError::Internal("object store error")
StoreError::Config(msg) → ApiError::Internal("store config error: {msg}")

use super::*;

#[test]
fn not_found_converts_to_api_not_found() {
    let err: ApiError = StoreError::NotFound("gone".into()).into();
    assert!(matches!(err, ApiError::NotFound(msg) if msg == "gone"));
}

#[test]
fn too_large_converts_to_bad_request() {
    let err: ApiError = StoreError::TooLarge { size: 5000, limit: 1000 }.into();
    assert!(matches!(err, ApiError::BadRequest(msg) if msg.contains("5000") && msg.contains("1000")));
}

#[test]
fn disallowed_content_type_converts_to_bad_request() {
    let err: ApiError = StoreError::DisallowedContentType("text/html".into()).into();
    assert!(matches!(err, ApiError::BadRequest(msg) if msg.contains("text/html")));
}

#[test]
fn invalid_filename_converts_to_bad_request() {
    let err: ApiError = StoreError::InvalidFilename("../etc/passwd".into()).into();
    assert!(matches!(err, ApiError::BadRequest(msg) if msg.contains("../etc/passwd")));
}

#[test]
fn object_store_error_converts_to_internal() {
    let err: ApiError = StoreError::ObjectStore(
        object_store::Error::NotFound { path: "x".into(), source: "".into().into() }
    ).into();
    assert!(matches!(err, ApiError::Internal(_)));
}

#[test]
fn config_error_converts_to_internal() {
    let err: ApiError = StoreError::Config("bad config".into()).into();
    assert!(matches!(err, ApiError::Internal(msg) if msg.contains("bad config")));
}

use craig_test_lib::{TestHarness, devstack_available};
use reqwest::Client;

/// Obtain a session cookie by logging in via craig-web's OIDC flow.
/// Returns a cookie jar with a valid session.
async fn web_session(harness: &TestHarness) -> reqwest::Client {
    // 1. GET /intake/reports to trigger OIDC redirect
    // 2. Follow redirect to Keycloak, POST credentials (jane.doe/password)
    // 3. Follow callback redirect back to craig-web
    // 4. Client now has session cookie
    // Alternative: reuse the auth/setup.ts pattern from E2E —
    //   POST directly to Keycloak token endpoint, then set session via craig-web
    todo!()
}

#[tokio::test]
async fn convert_sends_valid_priority_to_intake_api() {
    if !devstack_available().await { return; }
    let harness = TestHarness::new().await.unwrap();
    let client = web_session(&harness).await;

    // 1. Submit a report via craig-intake public API
    let intake = harness.intake_client();
    let report = intake.submit_public_report(&json!({...})).await.unwrap();
    let id = report["id"].as_str().unwrap();

    // 2. Claim via craig-web form POST (mirrors what the browser does)
    let resp = client.post(format!("http://localhost:8080/intake/reports/{id}/claim"))
        .send().await.unwrap();
    assert!(resp.status().is_redirection() || resp.status().is_success());

    // 3. Convert via craig-web form POST with form-encoded priority
    let resp = client.post(format!("http://localhost:8080/intake/reports/{id}/convert"))
        .form(&[("priority", "24_hour")])
        .send().await.unwrap();
    // Should redirect to /intake/referrals/{referral_id}, NOT back to report with error flash
    let location = resp.headers().get("location").unwrap().to_str().unwrap();
    assert!(location.contains("/intake/referrals/"), "convert should redirect to referral, got: {location}");
}

UpdateNistControlRequest {
    implementation_status: String,       // required — "partial", "implemented", "not_applicable"
    implementation_notes: Option<String>,
    evidence_key: Option<String>,
    last_assessed: Option<NaiveDate>,
    assessed_by: Option<String>,
}

// update_nist_control_planned_to_partial
// - List NIST controls, find one with status="planned"
// - PUT /v1/security/nist/{control_id} with implementation_status="partial"
// - Assert 200, verify status changed

// update_nist_control_partial_to_implemented
// - Continue from above control (now "partial")
// - PUT with implementation_status="implemented" and evidence_key="some-key"
// - Assert 200

// update_nist_control_invalid_transition
// - Find a "planned" control
// - PUT with implementation_status="implemented" (skipping "partial" — depends on state machine)
// - NOTE: Check if planned→implemented IS valid (it is per the state machine!)
// - Instead test: take a "partial" control, try to go back to "planned" → assert 400

// audit_by_resource_returns_entries
// - Create a case (via cases client) — this generates audit entries via events
// - Wait for event processing (retry loop)
// - GET /v1/security/audit/resource/case/{case_id}
// - Assert data array contains at least one entry

// update_review_to_overdue
// - Create a review with status="scheduled" (POST /v1/security/reviews)
// - PUT /v1/security/reviews/{id} with status="overdue"
// - Assert 200

use craig_cli::client::ApiClient;
use craig_cli::cmd::<module>::<CmdEnum>;
use craig_cli::output::Format;
use craig_test_lib::{TestHarness, devstack_available};

async fn admin_<service>_client(harness: &TestHarness) -> ApiClient {
    let token = harness.tokens.get_token("admin", "password").await.unwrap();
    ApiClient::new(&harness.config.<service>_url, &token)
}

#[tokio::test]
async fn test_name() {
    if !devstack_available().await { return; }
    let harness = TestHarness::new().await.unwrap();
    let client = admin_<service>_client(&harness).await;
    let cmd = <CmdEnum>::<Variant> { field: value, ... };
    craig_cli::cmd::<module>::run(&cmd, Format::Json, &client).await.expect("should succeed");
}

test-results/
  unit.xml          # cargo nextest --lib
  integration.xml   # cargo nextest (full workspace)
  e2e.xml           # playwright --reporter=junit

[store]
dir = "test-results"

[profile.default]
fail-fast = false
slow-timeout = { period = "60s", terminate-after = 2 }

[profile.ci]
fail-fast = false
junit.path = "unit.xml"

[profile.ci-integration]
fail-fast = false
junit.path = "integration.xml"

reporter: [
  ['list'],
  ['junit', { outputFile: '/app/results/e2e.xml' }],
],

volumes:
  - ./test-results:/app/results

# rust-test job:
artifacts:
  when: always
  reports:
    junit: test-results/unit.xml

# integration-test job:
artifacts:
  when: always
  reports:
    junit: test-results/integration.xml

# e2e-test job:
artifacts:
  when: always
  reports:
    junit: test-results/e2e.xml