test(coverage): drive server/handlers to ≥95% coverage (#20)

- server: 54.8% → 98.9%. Adds dedicated-backend dispatch tests for every
  RPC (Provision/Deprovision/StorageBytes/Regrade) across postgres, redis,
  mongo, and queue; pool-hit / pool-error / pool-miss branches via a new
  PoolClaimer interface seam; callBackendVoid breaker-open path;
  end-to-end gRPC round-trip via bufconn; New() constructor branches for
  k8s + MinIO + dedicated DSN configs; teamIDFromContext via metadata;
  PostgresBackend / Breakers accessors.
- handlers: 94.1% → 100%. Adds long-error-message truncation path on
  platformDBCheck and a whitebox test for the defensive nil-pool branch.
- Minor refactor in server.go: typed *pool.Manager field becomes a
  PoolClaimer interface so tests can inject a fake claimer without
  standing up a real *pgxpool.Pool. Production behaviour preserved by
  normalising nil *pool.Manager to a nil interface in NewWithBackends.

Joint coverage now well above the 95% gate on both packages.

Co-authored-by: Manas Srivastava <[email protected]>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/readyz_internal_test.go

@@ -0,0 +1,28 @@
+package handlers
+
+// readyz_internal_test.go — whitebox tests for the defensive nil-pool branch
+// in platformDBCheck. NewReadyzHandler only registers the platform_db check
+// when h.pool != nil, so the `if h.pool == nil` branch inside the closure is
+// dead under the public surface — but the guard is kept as belt-and-braces
+// in case a future refactor wires the check unconditionally. A whitebox test
+// pins the contract: "registered but pool nil" maps to failed +
+// pgxpool_not_configured.
+
+import (
+	"context"
+	"testing"
+
+	"instant.dev/common/readiness"
+)
+
+func TestPlatformDBCheck_NilPool_DefensiveBranch(t *testing.T) {
+	h := &ReadyzHandler{} // pool intentionally nil
+	check := h.platformDBCheck()
+	res := check(context.Background())
+	if res.Status != readiness.StatusFailed {
+		t.Errorf("nil-pool branch: status = %q, want failed", res.Status)
+	}
+	if res.LastError != "pgxpool_not_configured" {
+		t.Errorf("nil-pool branch: LastError = %q, want pgxpool_not_configured", res.LastError)
+	}
+}

internal/handlers/readyz_test.go

@@ -155,6 +155,39 @@ func TestReadyz_OpenCircuit_Degrades(t *testing.T) {
 	}
 }
 
+// TestReadyz_LongErrorMessage_Truncated — when the pool ping fails with a
+// >80-char message, /readyz truncates it to 80 chars before surfacing it on
+// the platform_db check (avoids leaking long connection-string bytes through
+// the response body).
+func TestReadyz_LongErrorMessage_Truncated(t *testing.T) {
+	// 120-char error message — must end up truncated to 80 in the response.
+	longMsg := "connection refused: tcp dial 10.0.0.1:5432 failed because the server is offline and rebooting now"
+	if len(longMsg) <= 80 {
+		t.Fatalf("test setup: long message must be > 80 chars (got %d)", len(longMsg))
+	}
+	h := handlers.NewReadyzHandler(handlers.Config{
+		PoolPinger: fakePool{err: errors.New(longMsg)},
+	})
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/readyz", nil)
+	h.Get(rr, req)
+	if rr.Code != 503 {
+		t.Fatalf("expected 503, got %d", rr.Code)
+	}
+	var got readiness.Response
+	if err := json.Unmarshal(rr.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	for _, c := range got.Checks {
+		if c.Name == "platform_db" {
+			if len(c.LastError) > 80 {
+				t.Errorf("platform_db.LastError = %q (len %d); want ≤80 chars",
+					c.LastError, len(c.LastError))
+			}
+		}
+	}
+}
+
 // TestReadyz_ContentType_AndNoStore — the response is JSON and tagged
 // no-store so probes don't stale.
 func TestReadyz_ContentType_AndNoStore(t *testing.T) {

internal/server/server.go

@@ -53,6 +53,16 @@ func teamIDFromContext(ctx context.Context) string {
 	return vals[0]
 }
 
+// PoolClaimer is the minimal Claim surface server.go uses from
+// *pool.Manager. Extracting it lets tests inject a fake claimer that
+// returns synthesised pool hits / errors without standing up a real
+// *pgxpool.Pool — *pool.Manager itself remains the production
+// implementation. Keep this interface byte-for-byte aligned with
+// (*pool.Manager).Claim so the concrete type continues to satisfy it.
+type PoolClaimer interface {
+	Claim(ctx context.Context, resourceType string) (*pool.Item, error)
+}
+
 // Server implements ProvisionerServiceServer.
 type Server struct {
 	provisionerv1.UnimplementedProvisionerServiceServer
@@ -65,7 +75,7 @@ type Server struct {
 	dedicatedRedisBackend    redis.Backend         // nil if not configured; used for Pro/Team tier
 	dedicatedMongoBackend    mongo.Backend         // nil if not configured; used for Pro/Team tier
 	dedicatedQueueBackend    queue.Backend         // nil if not configured; used for Pro/Team tier
-	pool                     *pool.Manager         // nil if pool is disabled
+	pool                     PoolClaimer           // nil if pool is disabled; production type is *pool.Manager
 
 	// breakers — per-backend in-process circuit breakers (audit P0-3).
 	// Independent instance per backend so a Redis outage cannot trip the
@@ -168,6 +178,16 @@ func NewWithBackends(
 	dedicatedQueue queue.Backend,
 	poolMgr *pool.Manager,
 ) *Server {
+	// A typed nil *pool.Manager assigned to a PoolClaimer interface field
+	// would make `s.pool != nil` evaluate true (the interface holds a
+	// non-nil type descriptor) and the next Claim call would dereference a
+	// nil receiver. Normalise the nil pointer to a nil interface here so
+	// production callers that pass nil get the documented "pool disabled"
+	// behaviour.
+	var poolClaimer PoolClaimer
+	if poolMgr != nil {
+		poolClaimer = poolMgr
+	}
 	return &Server{
 		postgresBackend:          pgB,
 		redisBackend:             rB,
@@ -178,7 +198,7 @@ func NewWithBackends(
 		dedicatedRedisBackend:    dedicatedRedis,
 		dedicatedMongoBackend:    dedicatedMongo,
 		dedicatedQueueBackend:    dedicatedQueue,
-		pool:                     poolMgr,
+		pool:                     poolClaimer,
 		// circuit.Default is the process-wide breaker set. Tests inject
 		// their own via SetBreakers() (or NewServerForTest) so per-test
 		// trips don't bleed into other tests.
@@ -194,6 +214,15 @@ func (s *Server) SetBreakers(b *circuit.Breakers) *Server {
 	return s
 }
 
+// SetPool injects an alternate pool claimer. Test-only entry point — production
+// code wires *pool.Manager via NewWithBackends and never calls this. Useful
+// for exercising the pool-hit / pool-error / pool-miss branches in
+// provisionPostgres/Redis/Mongo/Queue without standing up a real *pgxpool.Pool.
+func (s *Server) SetPool(p PoolClaimer) *Server {
+	s.pool = p
+	return s
+}
+
 // breakerForPostgres returns the right breaker for a Postgres call: the
 // `postgres_k8s` breaker when the dedicated k8s backend will be used (Pro/
 // Team/Growth tier with a configured dedicated backend), and the