test(coverage): audit List/CSV DB-error; vault PutSecret bad-AES; resource_family Family/ListFamilies DB-error arms

- audit.go: List + ListCSV db_failed via faultdb.
- vault.go: PutSecret encryptPlaintext aes-key-invalid 500.
- resource.go (Family/ListFamilies): fetch_failed + invalid_id + list DB-error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/audit_final_test.go

@@ -0,0 +1,83 @@
+package handlers_test
+
+// audit_final_test.go — FINAL coverage pass for audit.go's List / ListCSV
+// DB-error arms via a faultdb-backed handler.
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"instant.dev/internal/config"
+	"instant.dev/internal/handlers"
+	"instant.dev/internal/middleware"
+	"instant.dev/internal/testhelpers"
+)
+
+func auditFaultApp(t *testing.T, db *sql.DB) *fiber.App {
+	t.Helper()
+	cfg := &config.Config{JWTSecret: testhelpers.TestJWTSecret, AESKey: testhelpers.TestAESKeyHex, Environment: "test"}
+	app := fiber.New(fiber.Config{
+		ErrorHandler: func(c *fiber.Ctx, e error) error {
+			if e == handlers.ErrResponseWritten {
+				return nil
+			}
+			code := fiber.StatusInternalServerError
+			if fe, ok := e.(*fiber.Error); ok {
+				code = fe.Code
+			}
+			return c.Status(code).JSON(fiber.Map{"ok": false, "error": e.Error()})
+		},
+	})
+	app.Use(middleware.RequestID())
+	h := handlers.NewAuditHandler(db)
+	api := app.Group("/api/v1", middleware.RequireAuth(cfg))
+	api.Get("/audit", h.List)
+	api.Get("/audit.csv", h.ListCSV)
+	return app
+}
+
+func auditJWT(t *testing.T, db *sql.DB) string {
+	t.Helper()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	email := testhelpers.UniqueEmail(t)
+	var userID string
+	require.NoError(t, db.QueryRow(
+		`INSERT INTO users (team_id, email) VALUES ($1::uuid, $2) RETURNING id::text`, teamID, email).Scan(&userID))
+	return testhelpers.MustSignSessionJWT(t, userID, teamID, email)
+}
+
+// List: ListAuditEventsByTeam errors → db_failed (audit.go:246). failAfter=0.
+func TestAuditFinal_List_DBError_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	jwt := auditJWT(t, seedDB)
+
+	app := auditFaultApp(t, openFaultDB(t, 0))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer "+jwt)
+	resp, err := app.Test(req, 10000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// ListCSV: ListAuditEventsByTeam errors → db_failed (audit.go:313). failAfter=0.
+func TestAuditFinal_ListCSV_DBError_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	jwt := auditJWT(t, seedDB)
+
+	app := auditFaultApp(t, openFaultDB(t, 0))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/audit.csv", nil)
+	req.Header.Set("Authorization", "Bearer "+jwt)
+	resp, err := app.Test(req, 10000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}

internal/handlers/resource_final_test.go

@@ -54,6 +54,8 @@ func resourceFaultApp(t *testing.T, db *sql.DB, teamID string) *fiber.App {
 	app.Post("/r/:id/pause", h.Pause)
 	app.Post("/r/:id/resume", h.Resume)
 	app.Post("/r/:id/rotate", h.RotateCredentials)
+	app.Get("/r/:id/family", h.Family)
+	app.Get("/r/families", h.ListFamilies)
 	return app
 }
 
@@ -84,6 +86,13 @@ func rfPost(t *testing.T, app *fiber.App, path string) *http.Response {
 	return resp
 }
 
+func rfGet(t *testing.T, app *fiber.App, path string) *http.Response {
+	t.Helper()
+	resp, err := app.Test(httptest.NewRequest(http.MethodGet, path, nil), 10000)
+	require.NoError(t, err)
+	return resp
+}
+
 func rfErr(t *testing.T, resp *http.Response) string {
 	t.Helper()
 	var m map[string]any
@@ -179,6 +188,42 @@ func TestResourceFinal_Resume_DBFlipError_503(t *testing.T) {
 	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
 }
 
+// Family: GetResourceByToken errors → fetch_failed (resource_family.go:89).
+// failAfter=0.
+func TestResourceFinal_Family_LookupError_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	token := rfSeedActivePG(t, seedDB, teamID)
+
+	app := resourceFaultApp(t, openFaultDB(t, 0), teamID)
+	resp := rfGet(t, app, "/r/"+token+"/family")
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// Family: bad :id → invalid_id (resource_family.go:60).
+func TestResourceFinal_Family_BadID_400(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	teamID := testhelpers.MustCreateTeamDB(t, db, "pro")
+	app := resourceFaultApp(t, db, teamID)
+	resp := rfGet(t, app, "/r/not-a-uuid/family")
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+}
+
+// ListFamilies: DB error → 503 (resource_family.go:144-153). failAfter=0.
+func TestResourceFinal_ListFamilies_DBError_503(t *testing.T) {
+	seedDB, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	teamID := testhelpers.MustCreateTeamDB(t, seedDB, "pro")
+	app := resourceFaultApp(t, openFaultDB(t, 0), teamID)
+	resp := rfGet(t, app, "/r/families")
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
 // RotateCredentials: GetResourceByToken errors → fetch_failed. failAfter=0.
 func TestResourceFinal_Rotate_LookupError_503(t *testing.T) {
 	seedDB, clean := testhelpers.SetupTestDB(t)

internal/handlers/vault_final_test.go

@@ -0,0 +1,60 @@
+package handlers_test
+
+// vault_final_test.go — FINAL coverage pass for vault.go's encryptPlaintext
+// aes-key-invalid arm (vault.go:163) via a handler configured with a bad AES
+// key, driven through PutSecret.
+
+import (
+	"database/sql"
+	"net/http"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"instant.dev/internal/config"
+	"instant.dev/internal/handlers"
+	"instant.dev/internal/middleware"
+	"instant.dev/internal/plans"
+	"instant.dev/internal/testhelpers"
+)
+
+func vaultBadAESApp(t *testing.T, db *sql.DB) *fiber.App {
+	t.Helper()
+	cfg := &config.Config{
+		JWTSecret: testhelpers.TestJWTSecret,
+		AESKey:    "not-a-valid-hex-aes-key", // ParseAESKey fails → encryptPlaintext errors
+	}
+	app := fiber.New(fiber.Config{
+		ErrorHandler: func(c *fiber.Ctx, e error) error {
+			if e == handlers.ErrResponseWritten {
+				return nil
+			}
+			code := fiber.StatusInternalServerError
+			if fe, ok := e.(*fiber.Error); ok {
+				code = fe.Code
+			}
+			return c.Status(code).JSON(fiber.Map{"ok": false, "error": "internal_error", "message": e.Error()})
+		},
+	})
+	app.Use(middleware.RequestID())
+	h := handlers.NewVaultHandler(db, cfg, plans.Default())
+	api := app.Group("/api/v1", middleware.RequireAuth(cfg))
+	api.Put("/vault/:env/:key", h.PutSecret)
+	return app
+}
+
+// PutSecret with a bad AES key → encryptPlaintext fails → 500 (vault.go:163).
+func TestVaultFinal_PutSecret_BadAESKey_500(t *testing.T) {
+	db, clean := testhelpers.SetupTestDB(t)
+	defer clean()
+	_, _, jwt := makeTeamUser(t, db)
+
+	app := vaultBadAESApp(t, db)
+	req := jsonReq(t, http.MethodPut, "/api/v1/vault/production/MY_KEY", jwt, map[string]string{"value": "s3cr3t"})
+	resp, err := app.Test(req, 5000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
+}