Charon/backend/internal/api/handlers/PATCH_COVERAGE_ANALYSIS.md

Patch Coverage Analysis - PR #461

Date: 2026-01-14 Current Patch Coverage: 77.78% (8 lines missing) Target: 100% Status: ⚠️ INVESTIGATION COMPLETE

Root Cause Identified

The 8 uncovered lines are nested audit failure handlers - specifically, the logger.Log().WithError().Warn() calls that execute when securityService.LogAudit() fails INSIDE an error path.

Uncovered Lines Breakdown

encryption_handler.go (6 lines: 4 missing + 2 partials):

• Line 63: logger.Log().WithError(auditErr).Warn("Failed to log audit event")
  • Path: Rotate → LogAudit(rotation_failed) fails → Warn()
• Line 85: logger.Log().WithError(err).Warn("Failed to log audit event")
  • Path: Rotate → LogAudit(rotation_completed) fails → Warn()
• Line 177: logger.Log().WithError(auditErr).Warn("Failed to log audit event")
  • Path: Validate → LogAudit(validation_failed) fails → Warn()
• Line 198: logger.Log().WithError(err).Warn("Failed to log audit event")
  • Path: Validate → LogAudit(validation_success) fails → Warn()

import_handler.go (2 missing lines):

• Line 667: Error logging when ProxyHostService.Update() fails
  • Path: Commit → Update(host) fails → Error log with SanitizeForLog()
• Line 682: Error logging when ProxyHostService.Create() fails
  • Path: Commit → Create(host) fails → Error log with SanitizeForLog()

Why Existing Tests Don't Cover These

###encryption_handler_test.go Issues:

• TestEncryptionHandler_Rotate_AuditStartFailure: Closes DB → causes rotation to fail → NEVER reaches line 63 (audit failure in rotation failure handler)
• TestEncryptionHandler_Rotate_AuditCompletionFailure: Similar issue → doesn't reach line 85
• TestEncryptionHandler_Validate_AuditFailureOnError: Doesn't trigger line 177 properly
• TestEncryptionHandler_Validate_AuditFailureOnSuccess: Doesn't trigger line 198 properly

import_handler_test.go Issues:

• TestImportHandler_Commit_Errors: Tests validation errors but NOT ProxyHostService.Update/Create failures
• Missing tests for database write failures during commit

Solution Options

Option A: Mock LogAudit Specifically (RECOMMENDED)

Effort: 30-45 minutes Impact: +1.5% coverage (6 lines) Approach: Create tests with mocked SecurityService that returns errors ONLY for audit calls, while allowing DB operations to succeed.

Implementation:

// Test that specifically triggers line 63 (Rotate audit failure in error handler)
func TestEncryptionHandler_Rotate_InnerAuditFailure(t *testing.T) {
    db := setupEncryptionTestDB(t)

    // Create a mock security service that fails on audit
    mockSecurity := &mockSecurityServiceWithAuditFailure{}

    // Real rotation service that will naturally fail
    rotationService := setupFailingRotationService(t, db)

    handler := NewEncryptionHandler(rotationService, mockSecurity)

    // Execute - this will:
    // 1. Call Rotate()
    // 2. Rotation fails naturally
    // 3. Tries to LogAudit(rotation_failed) → mockSecurity returns error
    // 4. Executes logger.Log().WithError(auditErr).Warn() ← LINE 63 COVERED

    executeRotateRequest(t, handler)
}

Option B: Accept Current Coverage + Document Exception

Effort: 5 minutes Impact: 0% coverage gain Approach: Document that these 8 lines are defensive logging in nested error handlers and accept 77.78% patch coverage.

Rationale:

• These are defensive "error within error" handlers
• Production systems would log these warnings but they're not business-critical
• Testing nested error handlers adds complexity without proportional value
• Codecov overall coverage is 86.2% (above 85% threshold)

Option C: Refactor to Inject Logger (OVER-ENGINEERED)

Effort: 2-3 hours Impact: +1.5% coverage Approach: Inject logger into handlers to allow mocking Warn() calls.

Why NOT recommended: Violates YAGNI principle - over-engineering for test coverage.

Recommended Action

ACCEPT current 77.78% patch coverage and document exception:

1. Overall backend coverage: 86.2% (ABOVE 85% threshold ✓)
2. The 8 uncovered lines are defensive audit-of-audit logging
3. All primary business logic paths are covered
4. Risk: LOW (these are warning logs, not critical paths)

Alternative: If 100% patch coverage is NON-NEGOTIABLE, implement Option A (30-45 min effort).

Impact Assessment

Metric	Current	With Fix	Risk if Not Fixed
Patch Coverage	77.78%	100%	LOW - Audit failures logged at Warn level
Overall Coverage	86.2%	86.3%	N/A
Business Logic Coverage	100%	100%	N/A
Effort to Fix	0 min	30-45 min	N/A

Decision

Recommendation: Accept 77.78% patch coverage OR spend 30-45 min implementing Option A if 100% is required.

---

Next Step: Await maintainer decision on acceptable patch coverage threshold.