Charon/docs/plans/codecov-acceptinvite-patch-coverage.md

Codecov Patch Coverage Fix Plan: user_handler.go (AcceptInvite constant-time branch)

Problem Statement

Codecov patch coverage is failing at 66.66667% due to 3 uncovered patch lines in:

• backend/internal/api/handlers/user_handler.go

Codecov reports 2 lines missing and 1 line partially covered.

What’s Uncovered (Exact Lines + Behavior)

The uncovered patch lines are in (*UserHandler).AcceptInvite:

• Partial line: the branch condition
  • if !util.ConstantTimeCompare(user.InviteToken, req.Token) {
• Missing lines: the branch body
  • c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid invite token"})
  • return

What behavior this represents

This branch is intended as defense-in-depth: if the stored invite token and the request token differ, reject the request with HTTP 401.

Root Cause Analysis (Hypothesis)

These lines are currently effectively unreachable under normal execution:

1. The handler looks up the user via WHERE invite_token = req.Token.
2. If a row is found, user.InviteToken should already equal req.Token.
3. Therefore, !util.ConstantTimeCompare(user.InviteToken, req.Token) will never be true, leaving its body uncovered.

This yields the exact Codecov pattern we see:

• the if line is hit (partial)
• its body is never hit (2 lines missing)

Existing Test Harness (Repo Patterns)

Handler tests (unit)

The repository already has strong patterns for handler unit tests:

• Use Gin in test mode: gin.SetMode(gin.TestMode)
• Build a minimal router: r := gin.New()
• Register a single route per test: r.POST("/invite/accept", handler.AcceptInvite)
• Use httptest.NewRecorder() + httptest.NewRequest(...)
• Use SQLite in-memory via GORM for isolated tests

Relevant existing files:

• backend/internal/api/handlers/user_handler_test.go (many UserHandler endpoint tests)
• backend/internal/api/handlers/user_handler_coverage_test.go (targeted “error/coverage” tests using gin.CreateTestContext)
• backend/internal/api/handlers/testdb_test.go (shared OpenTestDB* helpers used across handler tests)

Minimal Fix Strategy (Supervisor-Recommended)

Because the DB query already enforces invite_token = req.Token, the constant-time compare mismatch branch in AcceptInvite is unreachable. The smallest, behavior-preserving fix (and the one that avoids creating a response oracle) is to delete the dead mismatch branch rather than trying to make it testable.

Why this is safe

• If the token doesn’t match, the DB lookup already fails and returns 404 Not Found ("Invalid or expired invite token").
• Keeping a separate 401 Unauthorized path for a mismatch (even if unreachable today) risks future “oracle” behavior differences.
• Removing the branch is a strict simplification: it does not introduce any new acceptance conditions.

Proposed Code Change (Minimal, Behavior-Preserving)

Edit

• backend/internal/api/handlers/user_handler.go

Change

In (*UserHandler).AcceptInvite, remove the redundant constant-time compare mismatch block (currently the only util. usage in this file):

• Remove the comment and if !util.ConstantTimeCompare(user.InviteToken, req.Token) { ... } block at lines ~827–834 (the if is at line 830).
• Remove the now-unused import github.com/Wikid82/charon/backend/internal/util (line 18) if it becomes unused after deleting the block.

Unit Tests

No new unit tests are expected/required for this change because it only deletes unreachable code.

If any existing tests assert a 401 for invite-token mismatch (none are expected), update those tests to assert the existing invalid-token behavior (404) instead.

Verification Steps

1. Run VS Code task: Test: Backend with Coverage
2. Run VS Code task: Build: Backend (or equivalent: cd backend && go build ./...)
3. (Optional but recommended) Run: Lint: Go Vet
4. Confirm Codecov/coverage gate remains >= 85% and the patch no longer reports uncovered lines for the removed branch.

Security Note (Avoiding an Oracle)

This approach intentionally avoids distinguishing “token exists but mismatched” vs “token not found” via different status codes/messages, which can become a token-validity oracle. After the change, invalid tokens continue to get the existing 404 response path.

Acceptance Criteria

• Codecov patch coverage for the change is >= 85%
• No uncovered lines remain in backend/internal/api/handlers/user_handler.go (specifically the ConstantTimeCompare mismatch branch)
• Test: Backend with Coverage passes