Testing: Add integration test coverage for edge cases and failure modes

[sfloess]

Overview

Expand integration testing beyond happy path to cover edge cases, network failures, malformed responses, and boundary conditions.

Current State

• ✅ 304 total tests
• ✅ Happy path covered
• ❌ Edge cases undertested
• ❌ Failure mode coverage incomplete

Testing Score Impact

Current: Testing A- (90/100)
With this + #62: Testing A+ (98/100)

Missing Test Scenarios

1. Network Failure Modes

@Test
void testConnectionTimeout() {
    // Mock server that never responds
    // Verify timeout triggers after configured duration
}

@Test
void testConnectionDroppedMidResponse() {
    // Mock server that closes connection mid-stream
    // Verify retry logic kicks in
}

@Test
void testSlowServer() {
    // Mock server with 10s+ response time
    // Verify client doesn't hang indefinitely
}

@Test
void testDNSResolutionFailure() {
    // Invalid hostname
    // Verify proper error message
}

2. Malformed Response Handling

@Test
void testMalformedJSON() {
    // Return invalid JSON from server
    // Verify graceful error, not crash
}

@Test
void testMissingRequiredFields() {
    // JSON without 'items' array
    // Verify proper error handling
}

@Test
void testUnexpectedNullValues() {
    // Null where not expected (id, path, etc.)
    // Verify defensive programming
}

@Test
void testVeryLargeResponse() {
    // 100MB+ JSON response
    // Verify memory usage stays reasonable
}

@Test
void testUnicodeAndSpecialCharacters() {
    // Paths with emoji, CJK, RTL characters
    // Verify encoding/decoding works
}

3. HTTP Status Code Handling

@Test
void testHTTP401Unauthorized() {
    // Invalid credentials
    // Verify clear error message
}

@Test
void testHTTP403Forbidden() {
    // Valid user but insufficient permissions
    // Verify error indicates permission issue
}

@Test
void testHTTP429RateLimited() {
    // Too many requests
    // Verify retry with backoff
}

@Test
void testHTTP500ServerError() {
    // Server error
    // Verify retry logic
}

@Test
void testHTTP502BadGateway() {
    // Proxy error
    // Verify retry
}

@Test
void testHTTP503ServiceUnavailable() {
    // Server overloaded
    // Verify retry with exponential backoff
}

4. Pagination Edge Cases

@Test
void testPaginationWith1000Pages() {
    // Extremely large repository
    // Verify no memory leak
    // Verify eventual completion
}

@Test
void testPaginationServerReturnsEmptyPage() {
    // Server returns page with 0 items but has continuation token
    // Verify infinite loop prevention
}

@Test
void testPaginationServerReturnsDuplicateToken() {
    // Server keeps returning same continuation token
    // Verify infinite loop detection
}

@Test
void testPaginationTokenBecomesInvalid() {
    // Token expires mid-pagination
    // Verify error handling
}

5. Cache Edge Cases

@Test
void testConcurrentCacheAccess() {
    // 10 threads accessing same cache simultaneously
    // Verify thread safety
}

@Test
void testCacheWith10000Repositories() {
    // Stress test cache size
    // Verify memory usage reasonable
}

@Test
void testCacheInvalidationDuringRead() {
    // One thread reads while another invalidates
    // Verify no race condition
}

@Test
void testCacheExpiryBoundaryCondition() {
    // Read exactly at TTL expiry moment
    // Verify correct behavior
}

6. Delete Operation Edge Cases

@Test
void testDeleteNonExistentComponent() {
    // Component ID doesn't exist
    // Verify error message clarity
}

@Test
void testDeleteAlreadyDeletedComponent() {
    // Delete same component twice
    // Verify idempotency
}

@Test
void testDeleteDuringPagination() {
    // Delete component while another thread pages same repo
    // Verify consistency
}

@Test
void testDelete1000Components() {
    // Bulk delete stress test
    // Verify memory usage, no leaks
}

7. Credentials Edge Cases

@Test
void testPasswordWithSpecialCharacters() {
    // Password: !@#$%^&*(){}[]|\:;<>?,.~/`
    // Verify Base64 encoding works
}

@Test
void testVeryLongPassword() {
    // 1000+ character password
    // Verify no truncation
}

@Test
void testEmptyUsername() {
    // Empty/blank username
    // Verify validation error
}

8. Component Path Edge Cases

@Test
void testPathWithSpaces() {
    // "my file with spaces.jar"
    // Verify URL encoding
}

@Test
void testPathWithUnicode() {
    // "文件.jar", "файл.jar", "🚀.jar"
    // Verify encoding/decoding
}

@Test
void testVeryLongPath() {
    // 1000+ character path
    // Verify no truncation
}

@Test  
void testPathTraversalAttempt() {
    // "../../etc/passwd"
    // Verify security validation
}

9. Statistics Edge Cases

@Test
void testStatsOnEmptyRepository() {
    // Zero components
    // Verify no divide-by-zero
}

@Test
void testStatsOnSingleComponent() {
    // Edge case for median calculation
}

@Test
void testStatsWithExtremeFileSizes() {
    // Mix of 1 byte and 10GB files
    // Verify bucketing works
}

@Test
void testStatsWithFutureDates() {
    // Component createdDate in future
    // Verify age calculation doesn't break
}

10. Regex Validation Edge Cases

@Test
void testComplexRegexPattern() {
    // Extremely complex pattern
    // Verify ReDoS prevention
}

@Test
void testInvalidRegexPattern() {
    // Syntactically invalid regex
    // Verify clear error message
}

@Test
void testRegexWithUnicode() {
    // Pattern matching CJK characters
    // Verify works correctly
}

Platform-Specific Tests

Android (OkHttp)

@Test
void testOkHttpInterceptorFailure() {
    // Interceptor throws exception
    // Verify error handling
}

@Test
void testOkHttpConnectionPoolExhaustion() {
    // Exhaust connection pool
    // Verify queuing works
}

iOS (URLSession)

func testURLSessionInvalidateDuringRequest() {
    // Invalidate session mid-request
    // Verify graceful cancellation
}

func testURLSessionBackgroundTransfer() {
    // Large download in background
    // Verify completion handling
}

Desktop (HttpClient)

@Test
void testHttpClientRedirect() {
    // Server returns 302 redirect
    // Verify follows redirect
}

@Test
void testHttpClientSSLCertificateError() {
    // Self-signed certificate
    // Verify error message
}

Acceptance Criteria

• All 50+ scenarios above have tests
• Tests pass on all platforms (Desktop, Android, iOS)
• Code coverage increases to 95%+
• No flaky tests (run 100 times successfully)
• Performance tests complete <5 minutes in CI

Priority

Medium - Important for robustness and production confidence

Related

• Testing: Add performance and load testing suite #62: Performance testing (complements this)
• Documentation: README.md still references old X.Y versioning instead of X.Y.Z semver #52: Fixed race condition (would be caught by these tests)