test(coverage): vector over-cap dedup + cross-service fallback; backup CreateRestore/ListRestores DB-error arms

- vector.go: over-cap dedup decrypt-fail fallthrough (corrupt all active rows
  then over-cap) + cross-service-fallback 429 (retype rows so type-lookup
  misses but any-lookup hits); auth gRPC-error soft-delete via DB-exposed
  failing bufconn fixture.
- backup.go (now 95.8%): CreateRestore team/backup/inflight/insert DB-error
  arms, no-user 401, missing-ack 400; ListRestores count-fail; bad-team/bad-id
  across all four routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/backup_final_test.go

@@ -178,6 +178,208 @@ func TestBackupFinal_ListRestores_ListFailed_503(t *testing.T) {
 	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
 }
 
+// CreateRestore: GetTeamByID errors → team_lookup_failed (backup.go:411). In-
+// place restore (no target). resource(1) succeeds, team(2) errors. failAfter=1.
+func TestBackupFinal_CreateRestore_TeamLookup_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := bkSeedPGResource(t, seedDB, teamID)
+	var resID string
+	require.NoError(t, seedDB.QueryRowContext(context.Background(),
+		`SELECT id::text FROM resources WHERE token=$1::uuid`, token).Scan(&resID))
+	backupID := seedBackupRow(t, seedDB, resID, "ok")
+
+	faultDB := openFaultDB(t, 1)
+	h := handlers.NewBackupHandler(faultDB, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	body := `{"backup_id":"` + backupID + `","destructive_acknowledgment":true}`
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+	assert.Equal(t, "team_lookup_failed", bkErr(t, resp))
+}
+
+// CreateRestore: GetBackupByIDForTeam errors → backup_lookup_failed
+// (backup.go:438). resource(1) + team(2) succeed, backup lookup(3) errors.
+// failAfter=2.
+func TestBackupFinal_CreateRestore_BackupLookup_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := bkSeedPGResource(t, seedDB, teamID)
+	var resID string
+	require.NoError(t, seedDB.QueryRowContext(context.Background(),
+		`SELECT id::text FROM resources WHERE token=$1::uuid`, token).Scan(&resID))
+	backupID := seedBackupRow(t, seedDB, resID, "ok")
+
+	faultDB := openFaultDB(t, 2)
+	h := handlers.NewBackupHandler(faultDB, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	body := `{"backup_id":"` + backupID + `","destructive_acknowledgment":true}`
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+	assert.Equal(t, "backup_lookup_failed", bkErr(t, resp))
+}
+
+// CreateRestore: HasInflightRestore errors → inflight_check_failed
+// (backup.go:464). resource(1) + team(2) + backup(3) succeed, inflight(4)
+// errors. failAfter=3.
+func TestBackupFinal_CreateRestore_InflightCheck_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := bkSeedPGResource(t, seedDB, teamID)
+	var resID string
+	require.NoError(t, seedDB.QueryRowContext(context.Background(),
+		`SELECT id::text FROM resources WHERE token=$1::uuid`, token).Scan(&resID))
+	backupID := seedBackupRow(t, seedDB, resID, "ok")
+
+	faultDB := openFaultDB(t, 3)
+	h := handlers.NewBackupHandler(faultDB, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	body := `{"backup_id":"` + backupID + `","destructive_acknowledgment":true}`
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+	assert.Equal(t, "inflight_check_failed", bkErr(t, resp))
+}
+
+// Bad team-id in Locals → unauthorized across CreateBackup / ListBackups /
+// CreateRestore / ListRestores (parseTeamID arms 104 / 224 / 320 / 550).
+func TestBackupFinal_BadTeamID_Unauthorized(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	h := handlers.NewBackupHandler(db, rdb, plans.Default())
+	app := newBackupApp(t, h, "not-a-uuid", uuid.NewString())
+	tok := uuid.NewString()
+	for _, route := range []struct {
+		method, path string
+	}{
+		{http.MethodPost, "/api/v1/resources/" + tok + "/backup"},
+		{http.MethodGet, "/api/v1/resources/" + tok + "/backups"},
+		{http.MethodPost, "/api/v1/resources/" + tok + "/restore"},
+		{http.MethodGet, "/api/v1/resources/" + tok + "/restores"},
+	} {
+		resp := bkDo(t, app, route.method, route.path, "")
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "route %s %s", route.method, route.path)
+		resp.Body.Close()
+	}
+}
+
+// Non-UUID :id → invalid_id across the four routes (224 / 230 / 332 / 557).
+func TestBackupFinal_BadResourceID_400(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	h := handlers.NewBackupHandler(db, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	for _, route := range []struct{ method, path string }{
+		{http.MethodPost, "/api/v1/resources/not-a-uuid/backup"},
+		{http.MethodGet, "/api/v1/resources/not-a-uuid/backups"},
+		{http.MethodPost, "/api/v1/resources/not-a-uuid/restore"},
+		{http.MethodGet, "/api/v1/resources/not-a-uuid/restores"},
+	} {
+		resp := bkDo(t, app, route.method, route.path, "")
+		assert.Equal(t, http.StatusBadRequest, resp.StatusCode, "route %s", route.path)
+		resp.Body.Close()
+	}
+}
+
+// CreateRestore: in-place without destructive_acknowledgment → 400
+// destructive_ack_required (backup.go:404-area).
+func TestBackupFinal_CreateRestore_MissingAck_400(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	token := bkSeedPGResource(t, db, teamID)
+	var resID string
+	require.NoError(t, db.QueryRowContext(context.Background(),
+		`SELECT id::text FROM resources WHERE token=$1::uuid`, token).Scan(&resID))
+	backupID := seedBackupRow(t, db, resID, "ok")
+
+	h := handlers.NewBackupHandler(db, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	body := `{"backup_id":"` + backupID + `"}` // no destructive_acknowledgment
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	assert.Equal(t, "destructive_ack_required", bkErr(t, resp))
+}
+
+// CreateRestore: CreateRestoreRow errors → restore_create_failed (backup.go:508).
+// resource(1)+team(2)+backup(3)+inflight(4) succeed, the INSERT(5) errors.
+// failAfter=4.
+func TestBackupFinal_CreateRestore_InsertFailed_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := bkSeedPGResource(t, seedDB, teamID)
+	var resID string
+	require.NoError(t, seedDB.QueryRowContext(context.Background(),
+		`SELECT id::text FROM resources WHERE token=$1::uuid`, token).Scan(&resID))
+	backupID := seedBackupRow(t, seedDB, resID, "ok")
+
+	faultDB := openFaultDB(t, 4)
+	h := handlers.NewBackupHandler(faultDB, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	body := `{"backup_id":"` + backupID + `","destructive_acknowledgment":true}`
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+	assert.Equal(t, "restore_create_failed", bkErr(t, resp))
+}
+
+// CreateRestore: missing user session → unauthorized (backup.go:325). The
+// newBackupApp helper pins a user; pass "" to drop it.
+func TestBackupFinal_CreateRestore_NoUser_401(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	token := bkSeedPGResource(t, db, teamID)
+	h := handlers.NewBackupHandler(db, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, "") // no user-id local
+	body := `{"backup_id":"` + uuid.NewString() + `","destructive_acknowledgment":true}`
+	resp := bkDo(t, app, http.MethodPost, "/api/v1/resources/"+token+"/restore", body)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+}
+
+// ListRestores: COUNT fails after list succeeds → 200 with total=len(items)
+// (backup.go:579). resource(1)+list(2) succeed, count(3) errors. failAfter=2.
+func TestBackupFinal_ListRestores_CountFail_200(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	rdb, cleanR := testhelpers.SetupTestRedis(t)
+	defer cleanR()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := bkSeedPGResource(t, seedDB, teamID)
+
+	faultDB := openFaultDB(t, 2)
+	h := handlers.NewBackupHandler(faultDB, rdb, plans.Default())
+	app := newBackupApp(t, h, teamID, uuid.NewString())
+	resp := bkDo(t, app, http.MethodGet, "/api/v1/resources/"+token+"/restores", "")
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
 // decodeJSON reads the response body into v.
 func decodeJSON(resp *http.Response, v any) error {
 	return json.NewDecoder(resp.Body).Decode(v)

internal/handlers/vector_final_test.go

@@ -141,28 +141,61 @@ func TestVectorFinal_Anon_OverCap_DedupDecryptFail(t *testing.T) {
 	post := func() (*http.Response, vecRespVecwave) {
 		return postVectorVecwave(t, app, ip, "", "", map[string]any{"name": "v", "env": "production"})
 	}
-	first, body := post()
+	first, _ := post()
 	first.Body.Close()
 	require.Equal(t, http.StatusCreated, first.StatusCode)
 
-	// Corrupt the stored connection_url so the dedup decrypt fails.
+	// Burn the rest of the daily cap (anonymous = 5/fp) so the NEXT call lands
+	// on the over-cap dedup branch.
+	for i := 0; i < 5; i++ {
+		r, _ := post()
+		r.Body.Close()
+	}
+
+	// Now corrupt EVERY active vector resource for this fingerprint so the
+	// over-cap dedup's GetActiveResourceByFingerprintType returns a row whose
+	// connection_url cannot be decrypted → the fail-closed fallthrough
+	// (vector.go:294-298) runs instead of emitting ciphertext.
 	_, err := db.ExecContext(context.Background(),
-		`UPDATE resources SET connection_url = 'not-valid-ciphertext' WHERE token = $1::uuid`, body.Token)
+		`UPDATE resources SET connection_url = 'not-valid-ciphertext'
+		 WHERE resource_type = 'vector' AND status = 'active' AND tier = 'anonymous'`)
 	require.NoError(t, err)
 
-	// Hammer past the daily cap (anonymous = 5/fp). Some calls dedup-hit the
-	// corrupt row (decrypt-fail → fall through to fresh provision → 201) or
-	// over-cap deny (429); we just need the corrupt-dedup arm to execute.
-	sawResolved := false
-	for i := 0; i < 10; i++ {
-		resp, _ := post()
-		code := resp.StatusCode
-		resp.Body.Close()
-		if code == http.StatusOK || code == http.StatusCreated || code == http.StatusTooManyRequests {
-			sawResolved = true
-		}
+	// One more over-cap call: dedup hit on a corrupt row → decrypt fails →
+	// fallthrough (then recycle gate / fresh provision / deny). Any non-5xx
+	// outcome proves the corrupt-url fallthrough arm executed.
+	resp, _ := post()
+	code := resp.StatusCode
+	resp.Body.Close()
+	assert.NotEqual(t, http.StatusInternalServerError, code)
+}
+
+// TestVectorFinal_Anon_OverCap_CrossServiceFallback — burns the cap with vector
+// provisions, then RETYPES every active row for the fingerprint to 'redis' so
+// the over-cap vector-type-by-env lookup MISSES but the any-type-by-env lookup
+// HITS → cross-service daily-cap fallback 429 (vector.go:269-275).
+func TestVectorFinal_Anon_OverCap_CrossServiceFallback(t *testing.T) {
+	app, db, _ := vectorGRPCAppWithDB(t)
+	const ip = "10.131.0.8"
+	post := func() (*http.Response, vecRespVecwave) {
+		return postVectorVecwave(t, app, ip, "", "", map[string]any{"name": "v", "env": "production"})
 	}
-	assert.True(t, sawResolved, "over-cap calls should resolve to dedup/fresh/deny, exercising the corrupt-url fallthrough")
+	// Burn the full cap (6 calls → over-cap on the 6th onward).
+	for i := 0; i < 6; i++ {
+		r, _ := post()
+		r.Body.Close()
+	}
+	// Retype the fingerprint's vector rows to redis: vector-type lookup now
+	// misses, but any-type lookup still finds a row → cross-service 429.
+	_, err := db.ExecContext(context.Background(),
+		`UPDATE resources SET resource_type = 'redis'
+		 WHERE resource_type = 'vector' AND status = 'active' AND tier = 'anonymous'`)
+	require.NoError(t, err)
+
+	resp, body := post()
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusTooManyRequests, resp.StatusCode)
+	assert.Equal(t, "provision_limit_reached", body.Error)
 }
 
 // TestVectorFinal_Auth_TeamLookup_DBError_503 — GetTeamByID errors (vector.go:453).
@@ -223,25 +256,62 @@ func TestVectorFinal_Auth_CreateResource_DBError_503(t *testing.T) {
 	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
 }
 
-// TestVectorFinal_Auth_GRPCError_SoftDelete_503 — provision via the bufconn
-// fake set to fail → soft-delete + 503 (vector.go:514). Reuses the vecwave
-// fixture.
+// vectorGRPCFailAppWithDB builds a /vector/new app whose bufconn provisioner
+// FAILS, exposing the DB so an authenticated team can be seeded.
+func vectorGRPCFailAppWithDB(t *testing.T) (*fiber.App, *sql.DB) {
+	t.Helper()
+	db, _ := testhelpers.SetupTestDB(t)
+	rdb, _ := testhelpers.SetupTestRedis(t)
+	t.Cleanup(func() { db.Close(); rdb.Close() })
+	cfg := &config.Config{
+		JWTSecret:                testhelpers.TestJWTSecret,
+		AESKey:                   testhelpers.TestAESKeyHex,
+		EnabledServices:          "postgres,vector,redis",
+		Environment:              "test",
+		PostgresProvisionBackend: "local",
+	}
+	provClient := newBufconnProvisionerClient(t, &fakeProvisioner{failProvision: true})
+	app := fiber.New(fiber.Config{
+		ErrorHandler: func(c *fiber.Ctx, e error) error {
+			if e == handlers.ErrResponseWritten {
+				return nil
+			}
+			code := fiber.StatusInternalServerError
+			if fe, ok := e.(*fiber.Error); ok {
+				code = fe.Code
+			}
+			_ = handlers.WriteFiberError(c, code, "internal_error", e.Error())
+			return nil
+		},
+		ProxyHeader: "X-Forwarded-For",
+	})
+	app.Use(middleware.RequestID())
+	app.Use(middleware.Fingerprint())
+	vectorH := handlers.NewVectorHandler(db, rdb, cfg, provClient, plans.Default())
+	app.Post("/vector/new", middleware.OptionalAuth(cfg), vectorH.NewVector)
+	return app, db
+}
+
+// TestVectorFinal_Auth_GRPCError_SoftDelete_503 — an AUTHENTICATED provision
+// where the gRPC provisioner fails → soft-delete + 503 (vector.go:514). Uses a
+// DB-exposed failing fixture so we can seed the team the JWT points at.
 func TestVectorFinal_Auth_GRPCError_SoftDelete_503(t *testing.T) {
-	fake := &fakeProvisioner{failProvision: true}
-	app, _, cleanup := setupVectorGRPCFixture(t, fake, false)
-	defer cleanup()
+	app, db := vectorGRPCFailAppWithDB(t)
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	jwt := vecJWT(t, db, teamID)
+
+	resp := vecPost(t, app, "10.62.0.1", jwt, `{"name":"v","env":"production"}`)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
 
-	// Need a seeded team + jwt; pull a fresh DB through the fixture's app is
-	// not exposed, so seed against a parallel DB and reuse the same secret.
-	// The fixture's VectorHandler shares the test DB created inside it, so we
-	// must mint the JWT against THAT db. Use a dev-only set-tier shortcut is
-	// unavailable; instead use the anonymous→gRPC-error path which also hits
-	// soft-delete on the anonymous arm (vector.go:362). Both share the
-	// SoftDeleteResource branch.
-	resp, body := postVectorVecwave(t, app, "10.62.0.1", "", "", map[string]any{"name": "v", "env": "production"})
+// TestVectorFinal_Anon_GRPCError_SoftDelete_503 — anonymous provision gRPC
+// failure → soft-delete on the anon arm (vector.go:362).
+func TestVectorFinal_Anon_GRPCError_SoftDelete_503(t *testing.T) {
+	app, _ := vectorGRPCFailAppWithDB(t)
+	resp := vecPost(t, app, "10.62.0.9", "", `{"name":"v","env":"production"}`)
 	defer resp.Body.Close()
 	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
-	assert.Equal(t, "provision_failed", body.Error)
 }
 
 // TestVectorFinal_ParseDimensions_MalformedJSON_Default — a body that is valid