[Gap-Audit] 035 Messaging Service Tests: cover 4 untested services

[TortoiseWolfe]

Summary

4 of 8 messaging services have test files. The largest service (message-service.ts, 1200+ LOC) is one of the four uncovered.

What's shipped

• connection-service.test.ts (310 LOC)
• gdpr-service.test.ts (542 LOC)
• offline-queue-service.test.ts (499 LOC)
• welcome-service.test.ts (458 LOC)

Gaps — 4 services missing tests

Service	LOC	What it does
message-service.ts	1200+	encryption, send, retrieve, edit, delete
key-service.ts	~28KB	key generation, storage, validation
group-key-service.ts	~23KB	group key rotation
audit-logger.ts	(in services/auth)	audit trail logging

Why this matters

Per 35 spec: NFR-001 (100% line coverage for all 4 services). The largest, most security-critical messaging code path has no unit-test coverage; bugs here have caused multiple reverts (issues #7, #8 cover the systemic patterns).

Reference

• Spec: features/testing/035-messaging-service-tests/spec.md
• Coordinate with: [Gap-Audit] Stability: createClient() at hook top level destabilizes realtime subscriptions #7, [Gap-Audit] Stability: stale-closure-after-async-auth across SignIn/SignUp/idle-timeout #8 (refactor service code first to be testable, then write tests)

[TortoiseWolfe]

Next-session primer

Goal: write unit tests for the 4 untested messaging services: message-service, key-service, group-key-service, audit-logger.

Effort: large (~1-2 days) — message-service alone is 1200+ LOC
Blocked on: nothing — but P3 (no users blocked, just NFR-001 coverage gap)

What's already tested

• connection-service.test.ts (310 LOC)
• gdpr-service.test.ts (542 LOC)
• offline-queue-service.test.ts (499 LOC)
• welcome-service.test.ts (458 LOC)
• key-derivation.test.ts — extended in batch 7a [Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12 Item B with verifyPublicKey contract tests
• audit-logger.ts — has the credential-stripping fix from batch 2 [Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12

The 4 missing test files

A. message-service.test.ts (largest)

• 1200+ LOC service: encryption, send, retrieve, edit, delete
• Pattern: mock supabase client at module level; assert sequence of calls per method
• Covers: sendMessage retry-counter logic (rebuilt in batch 4 [Gap-Audit] Stability: messaging service code duplication + retry-counter logic bug #13 part 2 — pin the contract there), getMessageHistory pagination, markAsRead/Delivered idempotency, editMessage 15-minute window, deleteMessage soft delete
• Reuse the getSessionWithRetry helper extracted in batch 4

B. key-service.test.ts

• ~28KB service
• Covers: initializeKeys/deriveKeys flow, hasKeys/hasKeysForUser, rotateKeys, revokeKeys, getUserPublicKey caching
• Watch out: this file changes substantially when [Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12 Item C ships (IndexedDB key vault). Coordinate.

C. group-key-service.test.ts

• 818 LOC
• Covers: group key generation, distribution, rotation on member-add/remove (relies on [Gap-Audit] 011 + 043 Group Chats / Group Service: implement 8 stub member-management methods #26 implementation)
• Crypto-heavy; might want to mock crypto.subtle for unit speed

D. audit-logger.test.ts

• (Already in src/services/auth/audit-logger.ts; coordinated with batch 2 [Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12 fix that added stripCredentials)
• Tests for: log() persistence path, stripCredentials filter (verify password/token/secret/key keys are dropped), each AuthEventType helper

Files

• src/services/messaging/message-service.test.ts (new, ~30+ test cases)
• src/services/messaging/key-service.test.ts (new)
• src/services/messaging/group-key-service.test.ts (new)
• src/services/auth/audit-logger.test.ts (new)

Pattern to copy

• src/services/messaging/connection-service.test.ts for shape
• src/services/messaging/gdpr-service.test.ts for handling auth + RLS

Verification

• pnpm test -- --run src/services/messaging/ — all should pass
• Coverage report: pnpm test:coverage — should hit NFR-001 (100% line coverage on these 4 services)

Watch-outs

• Don't write tests against the OLD createClient-per-method pattern from message-service — it was refactored in batch 4 [Gap-Audit] Stability: messaging service code duplication + retry-counter logic bug #13 to use the getSessionWithRetry helper
• For [Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12 Item C ordering: write key-service tests AFTER the IndexedDB migration so they cover the new shape, not the legacy one