Test coverage across the codebase is very low for critical packages:
Package
Coverage
Notes
internal/config
87.9%
Good
internal/database
74.8%
Decent
internal/globals
100%
Good
internal/logger
84.0%
Good
internal/handlers
5.7%
Only tests handler creation and missing template error
internal/delivery
0.0%
No tests at all for the core delivery engine
internal/middleware
0.0%
No tests
internal/server
0.0%
No tests
internal/session
0.0%
No tests
internal/healthcheck
0.0%
No tests
cmd/webhooker
0.0%
No tests
pkg/config
47.5%
Separate module
Critical Untested Paths
Delivery engine: The entire delivery logic (HTTP delivery, retry with backoff, log delivery, database delivery) has zero test coverage. This is the core business logic.
Webhook reception handler: No tests for the webhook receiver (event creation, delivery queuing, body size limits, inactive entrypoint handling).
Source management handlers: No tests for CRUD operations (create, edit, delete webhooks, add entrypoints/targets).
Auth middleware: No tests for the RequireAuth middleware, session validation, or metrics auth.
Session management: No tests for session creation, destruction, cookie handling.
Notes
The config test has an integration gap: it tests DevSessionKey in the config layer but never verifies it works with the session layer (it doesn't — see issue #19).
The handlers test uses a mock database that returns nil for DB(), which doesn't reflect real behavior.
Category
Nice-to-have for 1.0 MVP, but critical for reliability going forward.
## Issue
Test coverage across the codebase is very low for critical packages:
| Package | Coverage | Notes |
|---------|----------|-------|
| `internal/config` | 87.9% | Good |
| `internal/database` | 74.8% | Decent |
| `internal/globals` | 100% | Good |
| `internal/logger` | 84.0% | Good |
| `internal/handlers` | 5.7% | Only tests handler creation and missing template error |
| `internal/delivery` | 0.0% | **No tests at all** for the core delivery engine |
| `internal/middleware` | 0.0% | No tests |
| `internal/server` | 0.0% | No tests |
| `internal/session` | 0.0% | No tests |
| `internal/healthcheck` | 0.0% | No tests |
| `cmd/webhooker` | 0.0% | No tests |
| `pkg/config` | 47.5% | Separate module |
## Critical Untested Paths
1. **Delivery engine**: The entire delivery logic (HTTP delivery, retry with backoff, log delivery, database delivery) has zero test coverage. This is the core business logic.
2. **Webhook reception handler**: No tests for the webhook receiver (event creation, delivery queuing, body size limits, inactive entrypoint handling).
3. **Source management handlers**: No tests for CRUD operations (create, edit, delete webhooks, add entrypoints/targets).
4. **Auth middleware**: No tests for the RequireAuth middleware, session validation, or metrics auth.
5. **Session management**: No tests for session creation, destruction, cookie handling.
## Notes
- The config test has an integration gap: it tests `DevSessionKey` in the config layer but never verifies it works with the session layer (it doesn't — see issue [#19](https://git.eeqj.de/sneak/webhooker/issues/19)).
- The handlers test uses a mock database that returns nil for `DB()`, which doesn't reflect real behavior.
## Category
Nice-to-have for 1.0 MVP, but critical for reliability going forward.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Issue
Test coverage across the codebase is very low for critical packages:
internal/configinternal/databaseinternal/globalsinternal/loggerinternal/handlersinternal/deliveryinternal/middlewareinternal/serverinternal/sessioninternal/healthcheckcmd/webhookerpkg/configCritical Untested Paths
Delivery engine: The entire delivery logic (HTTP delivery, retry with backoff, log delivery, database delivery) has zero test coverage. This is the core business logic.
Webhook reception handler: No tests for the webhook receiver (event creation, delivery queuing, body size limits, inactive entrypoint handling).
Source management handlers: No tests for CRUD operations (create, edit, delete webhooks, add entrypoints/targets).
Auth middleware: No tests for the RequireAuth middleware, session validation, or metrics auth.
Session management: No tests for session creation, destruction, cookie handling.
Notes
DevSessionKeyin the config layer but never verifies it works with the session layer (it doesn't — see issue #19).DB(), which doesn't reflect real behavior.Category
Nice-to-have for 1.0 MVP, but critical for reliability going forward.
@clawbot please work on this