test(coverage): final serial pass #2 — handlers DB-error/edge arms toward 95%

Add 12 _final2 test files covering the biggest reachable uncovered chunks in
the api internal/handlers package, lifting the package from 93.12% → 93.9%
under CI conditions (pgvector/redis/mongo/nats, migrations applied,
go test ./internal/handlers/... -short -count=1 -p 1).

Covered arms (all reachable; no waivers):
- auth.go: GitHub/Google find-or-create LinkID errors, email-lookup DB errors
  (fault DB), Google empty-name team-name fallback. (OAuth flows driven via the
  existing SetOAuthURLsForTest + startFakeOAuth seams.)
- sns_verify.go: full snsVerifier.verify matrix (guards, cert-fetch error,
  sig decode, SignatureVersion 1/unknown/2, happy RSA verify) + getCert
  cache hit/miss/error via a generated throwaway RSA cert + fetchCert seam.
- internal_terminate.go: dunning/downgrade DB-error arms (staged openFaultDB),
  razorpay canceler-not-configured / cancel-error / happy paths.
- internal_resend_magic_link.go: lookup/update-hash DB errors + mark-failed /
  attempts-lookup / mark-abandoned best-effort error arms (fault DB + fake mailer).
- deploy_ttl.go: MakePermanent/SetTTL update_failed + refresh_failed +
  lookupDeployment fetch_failed (seeded deploy + staged fault DB).
- deploy_teardown_reconciler.go: begin_tx_failed, list_failed, empty-tx commit,
  mark_failed (fault DB + existing fakeTeardownProvider).
- env_policy.go: Get fetch_failed, Put role_lookup_failed / owner_required /
  invalid_body / invalid_env_policy / persist_failed / happy.
- billing.go (CreateCheckoutAPI): CreateSubscription circuit-open / razorpay-error
  / incomplete-response / persistence-failure (fake CreateSubscription seam,
  HMAC-signed payloads only, never a real key).
- stack.go: UpdateEnv fetch/persist DB errors + Family fetch_failed (seeded
  stack + staged fault DB).
- audit.go: bad-team-id unauthorized + List/CSV happy paths with metadata +
  actor-email lookup.
- provision_helper.go denyProvisionOverCap (was 0%) + per-handler over-cap
  (no-existing → 429; with-existing → dedup-return) + backend-failure
  soft-delete + finalizeProvision-failure persist arms across
  db/cache/nosql/vector/queue/storage/webhook (anon + authenticated).

No new exported test symbols were required (all arms reachable via existing
export_*_test.go seams or white-box package handlers tests), so no
export_final2_test.go was added.

Provably-unreachable arms left uncovered (documented): defaultFetchCert
(real network), generateOAuthState/issueSessionJWT failures (crypto/rand +
HS256 []byte key cannot fail), the k8s ComputeProvider constructor branch
(needs a live cluster; noop fallback is covered).

Known pre-existing shared-dev-DB flakes unrelated to this change: TestAdminList_*
(limit=100 paging on accumulated data) and TestQueue_* (NATS :8222 monitor not
reachable locally) — verify on a fresh DB per CLAUDE.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/audit_final2_test.go

@@ -0,0 +1,117 @@
+package handlers_test
+
+// audit_final2_test.go — FINAL SERIAL PASS #2 coverage for the audit.go
+// serialization + parse arms the DB-error suite (audit_final_test.go) misses:
+//
+//   * parseAuditQuery bad-team-id → unauthorized   (audit.go L148-152)
+//   * List happy path with metadata + resource_id + actor-email lookup
+//     (auditEventToMap metadata-unmarshal L396-398, email placeholders/lookup L440-457)
+//   * ListCSV happy path with a metadata-bearing row (CSV serialization L349-355)
+//
+// Seeds audit_log rows via models.InsertAuditEvent on a real DB and drives the
+// live List / ListCSV handlers through the existing auditFaultApp seam.
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"instant.dev/internal/models"
+	"instant.dev/internal/testhelpers"
+)
+
+func auditF2NeedDB(t *testing.T) {
+	t.Helper()
+	if os.Getenv("TEST_DATABASE_URL") == "" {
+		t.Skip("TEST_DATABASE_URL not set")
+	}
+}
+
+// A JWT carrying a non-UUID team_id reaches the handler (RequireAuth doesn't
+// validate UUID shape) → parseAuditQuery's uuid.Parse fails → unauthorized.
+func TestAuditFinal2_BadTeamID_Unauthorized(t *testing.T) {
+	auditF2NeedDB(t)
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	app := auditFaultApp(t, seedDB)
+	badJWT := testhelpers.MustSignSessionJWT(t, uuid.NewString(), "not-a-uuid", "audf2@example.com")
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer "+badJWT)
+	resp, err := app.Test(req, 5000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+}
+
+func TestAuditFinal2_List_Happy_WithMetadata(t *testing.T) {
+	auditF2NeedDB(t)
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	email := testhelpers.UniqueEmail(t)
+	var userID string
+	require.NoError(t, db.QueryRow(
+		`INSERT INTO users (team_id, email) VALUES ($1::uuid, $2) RETURNING id::text`, teamID, email).Scan(&userID))
+	jwt := testhelpers.MustSignSessionJWT(t, userID, teamID, email)
+
+	// Insert a row with metadata + resource_id so auditEventToMap runs the
+	// metadata-unmarshal + the actor-email lookup placeholder builder.
+	meta, _ := json.Marshal(map[string]any{"k": "v", "n": 1})
+	require.NoError(t, models.InsertAuditEvent(context.Background(), db, models.AuditEvent{
+		TeamID:       uuid.MustParse(teamID),
+		UserID:       uuid.NullUUID{UUID: uuid.MustParse(userID), Valid: true},
+		Actor:        userID,
+		Kind:         "resource.created",
+		ResourceType: "postgres",
+		ResourceID:   uuid.NullUUID{UUID: uuid.New(), Valid: true},
+		Summary:      "created a postgres resource",
+		Metadata:     meta,
+	}))
+
+	app := auditFaultApp(t, db)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer "+jwt)
+	resp, err := app.Test(req, 5000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
+func TestAuditFinal2_ListCSV_Happy_WithMetadata(t *testing.T) {
+	auditF2NeedDB(t)
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	email := testhelpers.UniqueEmail(t)
+	var userID string
+	require.NoError(t, db.QueryRow(
+		`INSERT INTO users (team_id, email) VALUES ($1::uuid, $2) RETURNING id::text`, teamID, email).Scan(&userID))
+	jwt := testhelpers.MustSignSessionJWT(t, userID, teamID, email)
+
+	meta, _ := json.Marshal(map[string]any{"csv": "row"})
+	require.NoError(t, models.InsertAuditEvent(context.Background(), db, models.AuditEvent{
+		TeamID:       uuid.MustParse(teamID),
+		UserID:       uuid.NullUUID{UUID: uuid.MustParse(userID), Valid: true},
+		Actor:        userID,
+		Kind:         "resource.deleted",
+		ResourceType: "redis",
+		ResourceID:   uuid.NullUUID{UUID: uuid.New(), Valid: true},
+		Summary:      "deleted a redis resource",
+		Metadata:     meta,
+	}))
+
+	app := auditFaultApp(t, db)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/audit.csv", nil)
+	req.Header.Set("Authorization", "Bearer "+jwt)
+	resp, err := app.Test(req, 5000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}

internal/handlers/auth_final2_test.go

@@ -0,0 +1,176 @@
+package handlers_test
+
+// auth_final2_test.go — FINAL SERIAL PASS #2 coverage for the few remaining
+// reachable error arms in auth.go's OAuth find-or-create helpers:
+//
+//   * findOrCreateUserGitHub LinkGitHubID error    (L601-603)
+//   * findOrCreateUserGitHub email-lookup DB error (L618-620)
+//   * findOrCreateUserGoogle LinkGoogleID error     (L1168-1170)
+//   * findOrCreateUserGoogle email-lookup DB error  (L1183-1185)
+//   * findOrCreateUserGoogle empty-Name teamName fallback (L1189-1191)
+//
+// Drives the live /auth/github + /auth/google handlers via the existing
+// startFakeOAuth / buildAuthApp / oauthPostJSON / oauthCfg / withIsolatedDB
+// seams. The link-error arms use a CHECK constraint that blocks the
+// github_id/google_id UPDATE; the email-lookup-error arm uses the fault DB
+// driver so GetUserByGitHubID (query #1) succeeds-as-NotFound while
+// GetUserByEmail (query #2) errors.
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"instant.dev/internal/handlers"
+	"instant.dev/internal/middleware"
+)
+
+// TestAuthFinal2_GitHub_LinkGitHubIDFailure: an email-only user exists, then a
+// CHECK constraint blocks any github_id assignment so LinkGitHubID's UPDATE
+// errors → findOrCreateUserGitHub link branch → 503. Covers auth.go L601-603.
+func TestAuthFinal2_GitHub_LinkGitHubIDFailure(t *testing.T) {
+	db := withIsolatedDB(t)
+	email := "ghlinkfail-final2@example.com"
+	_, err := db.ExecContext(context.Background(),
+		`INSERT INTO teams (id, name, plan_tier) VALUES (gen_random_uuid(), 'x', 'hobby')`)
+	require.NoError(t, err)
+	var teamID string
+	require.NoError(t, db.QueryRowContext(context.Background(),
+		`SELECT id::text FROM teams LIMIT 1`).Scan(&teamID))
+	_, err = db.ExecContext(context.Background(),
+		`INSERT INTO users (team_id, email) VALUES ($1::uuid, $2)`, teamID, email)
+	require.NoError(t, err)
+
+	// Block the LinkGitHubID UPDATE: github_id must stay NULL.
+	_, err = db.ExecContext(context.Background(),
+		`ALTER TABLE users ADD CONSTRAINT no_gh_link_final2 CHECK (github_id IS NULL)`)
+	require.NoError(t, err)
+
+	startFakeOAuth(t, &fakeOAuthServer{ghID: uniqueGHID(), ghEmail: email})
+	app := buildAuthApp(handlers.NewAuthHandler(db, oauthCfg()))
+	resp := oauthPostJSON(t, app, "/auth/github", `{"code":"abc"}`)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// TestAuthFinal2_Google_LinkGoogleIDFailure mirrors the GitHub case for the
+// google_id link path → findOrCreateUserGoogle link branch. Covers L1168-1170.
+func TestAuthFinal2_Google_LinkGoogleIDFailure(t *testing.T) {
+	db := withIsolatedDB(t)
+	email := "glinkfail-final2@example.com"
+	_, err := db.ExecContext(context.Background(),
+		`INSERT INTO teams (id, name, plan_tier) VALUES (gen_random_uuid(), 'x', 'hobby')`)
+	require.NoError(t, err)
+	var teamID string
+	require.NoError(t, db.QueryRowContext(context.Background(),
+		`SELECT id::text FROM teams LIMIT 1`).Scan(&teamID))
+	_, err = db.ExecContext(context.Background(),
+		`INSERT INTO users (team_id, email) VALUES ($1::uuid, $2)`, teamID, email)
+	require.NoError(t, err)
+
+	_, err = db.ExecContext(context.Background(),
+		`ALTER TABLE users ADD CONSTRAINT no_g_link_final2 CHECK (google_id IS NULL)`)
+	require.NoError(t, err)
+
+	startFakeOAuth(t, &fakeOAuthServer{gAud: "g-client", gSub: uniqueGHID(), gEmail: email})
+	app := buildAuthApp(handlers.NewAuthHandler(db, oauthCfg()))
+	resp := oauthPostJSON(t, app, "/auth/google", `{"id_token":"tok"}`)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// faultAuthApp builds an auth app over a fault-injecting DB that fails after
+// `failAfter` Query/Exec calls. The first call (GetUserByGitHubID /
+// GetUserByGoogleID) succeeds and returns NotFound (no row in the freshly
+// migrated faultpq DB), then GetUserByEmail (call #2) hits the injected error.
+func faultAuthApp(t *testing.T, failAfter int64) *fiber.App {
+	t.Helper()
+	db := openFaultDB(t, failAfter)
+	cfg := oauthCfg()
+	h := handlers.NewAuthHandler(db, cfg)
+	app := fiber.New(fiber.Config{
+		ErrorHandler: func(c *fiber.Ctx, err error) error {
+			if err == handlers.ErrResponseWritten {
+				return nil
+			}
+			code := fiber.StatusInternalServerError
+			if e, ok := err.(*fiber.Error); ok {
+				code = e.Code
+			}
+			return c.Status(code).JSON(fiber.Map{"ok": false, "error": err.Error()})
+		},
+	})
+	app.Use(middleware.RequestID())
+	app.Post("/auth/github", h.GitHub)
+	app.Post("/auth/google", h.Google)
+	return app
+}
+
+// TestAuthFinal2_GitHub_EmailLookupDBError: GetUserByGitHubID (NotFound) then
+// GetUserByEmail errors with a non-NotFound DB error → the email-lookup error
+// branch of findOrCreateUserGitHub → 503. Covers auth.go L618-620.
+func TestAuthFinal2_GitHub_EmailLookupDBError(t *testing.T) {
+	// failAfter=1: the github_id lookup query succeeds (0 rows → NotFound),
+	// then the email lookup query errors.
+	app := faultAuthApp(t, 1)
+	startFakeOAuth(t, &fakeOAuthServer{ghID: uniqueGHID(), ghEmail: "fault-gh-final2@example.com"})
+	resp := oauthPostJSON(t, app, "/auth/github", `{"code":"abc"}`)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// TestAuthFinal2_Google_EmailLookupDBError mirrors the GitHub case for the
+// findOrCreateUserGoogle email-lookup error branch. Covers auth.go L1183-1185.
+func TestAuthFinal2_Google_EmailLookupDBError(t *testing.T) {
+	app := faultAuthApp(t, 1)
+	startFakeOAuth(t, &fakeOAuthServer{gAud: "g-client", gSub: uniqueGHID(), gEmail: "fault-g-final2@example.com"})
+	resp := oauthPostJSON(t, app, "/auth/google", `{"id_token":"tok"}`)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// emptyNameGoogleServer is a fake Google tokeninfo endpoint that returns an
+// EMPTY name field, forcing findOrCreateUserGoogle to derive the team name from
+// the email local-part (L1189-1191). The shared fakeOAuthServer hardcodes
+// "G User", so this needs a bespoke server.
+func startEmptyNameGoogleOAuth(t *testing.T, sub, email string) {
+	t.Helper()
+	mux := http.NewServeMux()
+	mux.HandleFunc("/g/tokeninfo", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(fmt.Sprintf(`{"sub":%q,"email":%q,"name":"","aud":"g-client"}`, sub, email)))
+	})
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+	t.Cleanup(handlers.SetOAuthURLsForTest(srv.URL))
+}
+
+// TestAuthFinal2_Google_EmptyName_TeamNameFromEmail: a brand-new Google user
+// whose tokeninfo carries an empty name → teamName falls back to the email
+// local-part. Covers auth.go L1189-1191.
+func TestAuthFinal2_Google_EmptyName_TeamNameFromEmail(t *testing.T) {
+	db := withIsolatedDB(t)
+	sub := strconv.FormatInt(time.Now().UnixNano(), 10)
+	local := "noname" + sub[len(sub)-6:]
+	email := local + "@example.com"
+	startEmptyNameGoogleOAuth(t, sub, email)
+
+	app := buildAuthApp(handlers.NewAuthHandler(db, oauthCfg()))
+	resp := oauthPostJSON(t, app, "/auth/google", `{"id_token":"tok"}`)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	// The new team's name must be the email local-part (the empty-Name fallback).
+	var teamName string
+	require.NoError(t, db.QueryRowContext(context.Background(),
+		`SELECT t.name FROM teams t JOIN users u ON u.team_id = t.id WHERE u.email = $1`, email).Scan(&teamName))
+	assert.Equal(t, local, teamName, "empty Google name must fall back to the email local-part")
+}