fix(rust): satisfy dylint assertion lints in tests (#399)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

rsworkspace/crates/a2a-auth-callout/src/account_resolver/tests.rs

@@ -29,5 +29,5 @@ fn static_resolver_denies_unknown_account() {
 #[test]
 fn error_into_auth_callout_error_preserves_message() {
     let err: AuthCalloutError = AccountResolverError::Unknown("x".into()).into();
-    assert!(err.to_string().contains("\"x\""));
+    assert_eq!(err.to_string(), "requested account \"x\" not allowlisted");
 }

rsworkspace/crates/a2a-auth-callout/src/credentials/api_key/tests.rs

@@ -1,4 +1,5 @@
 use super::*;
+use crate::error::CredentialError;
 
 fn make_registry() -> ApiKeyRegistry {
     ApiKeyRegistry::new(b"test-hmac-secret".to_vec())
@@ -51,15 +52,20 @@ async fn verify_rejects_audience_mismatch() {
     let other = AudienceAccount::new("nats-acct-evil");
     #[allow(deprecated)]
     let err = verifier.verify("my-secret-key", &other).await.unwrap_err();
-    assert!(matches!(err, AuthCalloutError::CredentialVerification(_)));
-    assert!(err.to_string().contains("audience mismatch"));
+    let AuthCalloutError::CredentialVerification(CredentialError::InvalidRequest(msg)) = err else {
+        panic!("expected audience mismatch InvalidRequest");
+    };
+    assert_eq!(
+        msg,
+        "API key audience mismatch: requested=\"nats-acct-evil\" registered=\"nats-acct-1\""
+    );
 }
 
 #[test]
 fn apikey_rejects_empty() {
     let err = ApiKey::new("").unwrap_err();
     assert!(matches!(err, ApiKeyError::Empty));
-    assert!(err.to_string().contains("empty"));
+    assert_eq!(err.to_string(), "API key must not be empty");
 }
 
 #[test]

rsworkspace/crates/a2a-auth-callout/src/credentials/oidc/tests.rs

@@ -221,7 +221,16 @@ async fn discover_rejects_jwks_uri_outside_issuer_origin() {
     let Err(err) = res else {
         panic!("expected origin mismatch error");
     };
-    assert!(err.to_string().contains("outside issuer origin"));
+    let AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(msg)) = err else {
+        panic!("expected jwks_uri origin mismatch");
+    };
+    assert_eq!(
+        msg,
+        format!(
+            "OIDC jwks_uri \"https://attacker.example.com/jwks\" is outside issuer origin {:?}",
+            mock_srv.uri()
+        )
+    );
 }
 
 #[tokio::test]
@@ -240,7 +249,17 @@ async fn discover_rejects_mismatched_issuer_claim() {
     let Err(err) = res else {
         panic!("expected issuer mismatch error");
     };
-    assert!(err.to_string().contains("issuer mismatch"));
+    let AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(msg)) = err else {
+        panic!("expected issuer mismatch");
+    };
+    assert_eq!(
+        msg,
+        format!(
+            "OIDC discovery issuer mismatch: configured={:?} discovered={:?}",
+            mock_srv.uri(),
+            "https://other.example.com"
+        )
+    );
 }
 
 #[test]

rsworkspace/crates/a2a-auth-callout/src/denial_reason/tests.rs

@@ -20,5 +20,8 @@ fn accepts_category_string() {
 #[test]
 fn display_renders_both_error_variants() {
     assert_eq!(DenialReasonError::Empty.to_string(), "denial reason must be non-empty");
-    assert!(DenialReasonError::TooLong.to_string().contains("must be at most"));
+    assert_eq!(
+        DenialReasonError::TooLong.to_string(),
+        format!("denial reason must be at most {MAX_LEN} characters")
+    );
 }

rsworkspace/crates/a2a-auth-callout/src/error/tests.rs

@@ -4,10 +4,9 @@ use super::*;
 
 #[test]
 fn display_connect() {
-    assert!(
-        AuthCalloutError::Connect("refused".into())
-            .to_string()
-            .contains("NATS connect failed")
+    assert_eq!(
+        AuthCalloutError::Connect("refused".into()).to_string(),
+        "NATS connect failed: refused"
     );
 }
 
@@ -17,14 +16,14 @@ fn display_subscribe() {
     let e = AuthCalloutError::Subscribe(async_nats::SubscribeError::new(
         async_nats::SubscribeErrorKind::InvalidSubject,
     ));
-    assert!(e.to_string().contains("auth callout subject"));
+    assert_eq!(e.to_string(), "subscribe to auth callout subject failed");
     assert!(Error::source(&e).is_some());
 }
 
 #[test]
 fn display_credential_verification() {
     let e = AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials("bad token".into()));
-    assert!(e.to_string().contains("credential verification"));
+    assert_eq!(e.to_string(), "credential verification failed: bad token");
     assert!(std::error::Error::source(&e).is_some());
 }
 
@@ -37,20 +36,17 @@ fn display_jwt_variant() {
 
 #[test]
 fn display_missing_env_var_unknown_source_and_vault() {
-    assert!(
-        AuthCalloutError::MissingEnvVar("X")
-            .to_string()
-            .contains("X is not set")
+    assert_eq!(
+        AuthCalloutError::MissingEnvVar("X").to_string(),
+        "required environment variable X is not set"
     );
-    assert!(
-        AuthCalloutError::UnknownSigningKeySource("foo".into())
-            .to_string()
-            .contains("foo")
+    assert_eq!(
+        AuthCalloutError::UnknownSigningKeySource("foo".into()).to_string(),
+        "unknown AUTH_CALLOUT_SIGNING_KEY_SOURCE: foo (expected env, file, or vault)"
     );
-    assert!(
-        AuthCalloutError::VaultNotConfigured
-            .to_string()
-            .contains("not wired yet")
+    assert_eq!(
+        AuthCalloutError::VaultNotConfigured.to_string(),
+        "AUTH_CALLOUT_SIGNING_KEY_SOURCE=vault is not wired yet"
     );
 }
 
@@ -60,12 +56,12 @@ fn display_and_source_for_key_load_variants() {
         path: std::path::PathBuf::from("/tmp/x"),
         source: std::io::Error::new(std::io::ErrorKind::NotFound, "nope"),
     };
-    assert!(io.to_string().contains("/tmp/x"));
+    assert_eq!(io.to_string(), "failed to read signing key at /tmp/x");
     assert!(Error::source(&io).is_some());
 
     let bad: Vec<u8> = vec![0xff, 0xfe];
     let utf8 = AuthCalloutError::KeyLoadUtf8(std::str::from_utf8(&bad).unwrap_err());
-    assert!(utf8.to_string().contains("UTF-8"));
+    assert_eq!(utf8.to_string(), "signing key file must be UTF-8 NKey seed");
     assert!(Error::source(&utf8).is_some());
 }
 
@@ -83,25 +79,22 @@ fn source_for_connect_is_none() {
 #[test]
 fn display_covers_remaining_variants() {
     let de = serde_json::from_str::<String>("x").unwrap_err();
-    assert!(
-        AuthCalloutError::Deserialize(de)
-            .to_string()
-            .contains("deserialize auth callout request")
+    assert_eq!(
+        AuthCalloutError::Deserialize(de).to_string(),
+        "failed to deserialize auth callout request"
     );
     let se = serde_json::from_str::<serde_json::Value>("not json").unwrap_err();
-    assert!(
-        AuthCalloutError::Serialize(se)
-            .to_string()
-            .contains("serialize auth callout response")
+    assert_eq!(
+        AuthCalloutError::Serialize(se).to_string(),
+        "failed to serialize auth callout response"
     );
     let reply_err = AuthCalloutError::Reply(async_nats::PublishError::new(
         async_nats::client::PublishErrorKind::InvalidSubject,
     ));
-    assert!(reply_err.to_string().contains("publish auth callout reply"));
-    assert!(
-        AuthCalloutError::WireFormat("x".into())
-            .to_string()
-            .contains("wire format")
+    assert_eq!(reply_err.to_string(), "failed to publish auth callout reply");
+    assert_eq!(
+        AuthCalloutError::WireFormat("x".into()).to_string(),
+        "auth callout wire format error: x"
     );
-    assert!(AuthCalloutError::Internal("x".into()).to_string().contains("internal"));
+    assert_eq!(AuthCalloutError::Internal("x".into()).to_string(), "internal error: x");
 }

rsworkspace/crates/a2a-auth-callout/src/jwt/tests.rs

@@ -69,17 +69,15 @@ fn mint_rejects_wrong_verification_key() {
 
 #[test]
 fn caller_id_rejects_dots() {
-    assert!(CallerId::new("a.b").unwrap_err().to_string().contains("caller_id"));
+    assert!(matches!(CallerId::new("a.b").unwrap_err(), JwtError::InvalidCallerId));
 }
 
 #[test]
 fn external_subject_requires_non_empty() {
-    assert!(
-        ExternalSubject::new("")
-            .unwrap_err()
-            .to_string()
-            .contains("external subject")
-    );
+    assert!(matches!(
+        ExternalSubject::new("").unwrap_err(),
+        JwtError::InvalidExternalSubject
+    ));
 }
 
 #[test]

rsworkspace/crates/a2a-auth-callout/src/signing_key_source/tests.rs

@@ -45,7 +45,10 @@ fn env_source_current_previous_missing_and_warn_once() {
         std::env::remove_var("AUTH_CALLOUT_SIGNING_SECRET");
     }
     let err = EnvSigningKeySource::from_env().unwrap_err();
-    assert!(err.to_string().contains("AUTH_CALLOUT_SIGNING_SECRET"));
+    assert!(matches!(
+        err,
+        AuthCalloutError::MissingEnvVar("AUTH_CALLOUT_SIGNING_SECRET")
+    ));
 }
 
 #[test]
@@ -70,7 +73,7 @@ fn file_reads_current_and_optional_previous() {
 #[test]
 fn file_missing_current_errors() {
     let err = FileSigningKeySource::new("/no/such/signing-key-path", None::<&str>).unwrap_err();
-    assert!(err.to_string().contains("failed to read signing key"));
+    assert!(matches!(err, AuthCalloutError::KeyLoadIo { .. }));
 }
 
 #[test]

rsworkspace/crates/a2a-auth-callout/src/wire/server_auth_request_envelope/tests.rs

@@ -44,9 +44,5 @@ fn rejects_tampered_signature() {
     let err = ServerAuthRequestEnvelope::from_bytes(token.into_bytes())
         .decode(&server_pub, None, None)
         .unwrap_err();
-    assert!(
-        err.to_string().contains("decode")
-            || err.to_string().contains("verify")
-            || err.to_string().contains("signature")
-    );
+    assert!(matches!(err, AuthCalloutError::WireFormat(_)));
 }

rsworkspace/crates/a2a-bridge/src/error/tests.rs

@@ -4,10 +4,9 @@ use super::*;
 
 #[test]
 fn display_mint() {
-    assert!(
-        BridgeError::Mint("unavailable".into())
-            .to_string()
-            .contains("auth callout mint")
+    assert_eq!(
+        BridgeError::Mint("unavailable".into()).to_string(),
+        "auth callout mint failed: unavailable"
     );
 }
 

rsworkspace/crates/a2a-nats-http/src/tests.rs

@@ -369,7 +369,10 @@ async fn push_set_not_supported_maps_to_correct_error_code() {
 #[test]
 fn runtime_error_display_shows_env_var_name() {
     use crate::runtime::RuntimeError;
-    assert!(RuntimeError::MissingAgentId.to_string().contains("A2A_AGENT_ID"));
+    assert_eq!(
+        RuntimeError::MissingAgentId.to_string(),
+        "A2A_AGENT_ID environment variable is required"
+    );
 }
 
 #[tokio::test]