Test coverage gaps need to be addressed

[birdmanmandbir]

Summary

Current test coverage is essentially scaffolded boilerplate. The controller test only verifies Reconcile() returns no error without checking any created resources.

Test Coverage Gaps

Gap	Severity	Impact
Controller reconciliation not tested	10/10	Secrets, CNPG cluster, deployments not verified
Secret generation error handling	9/10	Operator could crash or leave inconsistent state
CNPG cluster builder	9/10	Role permissions, replication config not verified
Deployment builders	7/10	Env vars, health probes not verified
JWT signature verification	6/10	Tokens could be invalid

Required Tests

Controller Tests (Priority: Critical)

• Verify secrets are created with correct keys
• Verify CNPG Cluster is created with correct managed roles
• Verify deployments are created for each service (Auth, REST, Studio, Meta, Kong)
• Verify services are created with correct ports and selectors
• Verify status conditions are set correctly on success/failure
• Verify ObservedGeneration is updated after successful reconciliation
• Test error handling when secret generation fails
• Test behavior when CNPG cluster is not ready (requeue)

Secret Generation Tests

• Verify all required secrets are generated (JWT, supabase-admin, authenticator, auth-admin)
• Verify secret data contains expected keys
• Verify error wrapping provides context
• Test when user provides existing jwt.secretRef

CNPG Cluster Builder Tests

• Verify managed roles are configured correctly (9 roles)
• Verify bootstrap SQL ConfigMap reference is correct
• Verify storage configuration from spec
• Verify backup configuration when enabled

Deployment Builder Tests

• Verify environment variables are set correctly
• Verify secret references point to correct secrets
• Verify health probes are configured
• Verify image tags from spec are used
• Verify replicas default to 1 when not specified

JWT Tests

• Verify generated tokens can be decoded
• Verify token claims (role, iss, iat, exp)
• Verify signature verification works

Suggested Approach

1. Use envtest for controller tests (already set up in suite_test.go)
2. Add table-driven tests for builders to cover edge cases
3. Use testify/assert for cleaner assertions
4. Consider adding integration tests with a real CNPG operator in CI

Acceptance Criteria

• Controller tests verify resource creation, not just error-free execution
• All severity 9+ gaps have tests
• CI runs tests on every PR