test: add comprehensive unit test suite (~85 new tests)

Add unit tests across all model and server infrastructure layers,
increasing test count from 7 to 92. Covers serde round-trips, enum
methods, defaults, config parsing, error mapping, PKCE crypto (with
RFC 7636 test vector), OAuth store, and SearXNG ranking/dedup logic.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/infrastructure/auth.rs

@@ -24,9 +24,9 @@ pub const LOGGED_IN_USER_SESS_KEY: &str = "logged-in-user";
 /// post-login redirect URL and the PKCE code verifier needed for the
 /// token exchange.
 #[derive(Debug, Clone)]
-struct PendingOAuthEntry {
-    redirect_url: Option<String>,
-    code_verifier: String,
+pub(crate) struct PendingOAuthEntry {
+    pub(crate) redirect_url: Option<String>,
+    pub(crate) code_verifier: String,
 }
 
 /// In-memory store for pending OAuth states. Keyed by the random state
@@ -38,7 +38,7 @@ pub struct PendingOAuthStore(Arc<RwLock<HashMap<String, PendingOAuthEntry>>>);
 
 impl PendingOAuthStore {
     /// Insert a pending state with an optional redirect URL and PKCE verifier.
-    fn insert(&self, state: String, entry: PendingOAuthEntry) {
+    pub(crate) fn insert(&self, state: String, entry: PendingOAuthEntry) {
         // RwLock::write only panics if the lock is poisoned, which
         // indicates a prior panic -- propagating is acceptable here.
         #[allow(clippy::expect_used)]
@@ -50,7 +50,7 @@ impl PendingOAuthStore {
 
     /// Remove and return the entry if the state was pending.
     /// Returns `None` if the state was never stored (CSRF failure).
-    fn take(&self, state: &str) -> Option<PendingOAuthEntry> {
+    pub(crate) fn take(&self, state: &str) -> Option<PendingOAuthEntry> {
         #[allow(clippy::expect_used)]
         self.0
             .write()
@@ -60,7 +60,8 @@ impl PendingOAuthStore {
 }
 
 /// Generate a cryptographically random state string for CSRF protection.
-fn generate_state() -> String {
+#[cfg_attr(test, allow(dead_code))]
+pub(crate) fn generate_state() -> String {
     let bytes: [u8; 32] = rand::rng().random();
     // Encode as hex to produce a URL-safe string without padding.
     bytes.iter().fold(String::with_capacity(64), |mut acc, b| {
@@ -75,7 +76,7 @@ fn generate_state() -> String {
 ///
 /// Uses 32 random bytes encoded as base64url (no padding) to produce
 /// a 43-character verifier per RFC 7636.
-fn generate_code_verifier() -> String {
+pub(crate) fn generate_code_verifier() -> String {
     use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 
     let bytes: [u8; 32] = rand::rng().random();
@@ -85,7 +86,7 @@ fn generate_code_verifier() -> String {
 /// Derive the S256 code challenge from a code verifier per RFC 7636.
 ///
 /// `code_challenge = BASE64URL(SHA256(code_verifier))`
-fn derive_code_challenge(verifier: &str) -> String {
+pub(crate) fn derive_code_challenge(verifier: &str) -> String {
     use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
     use sha2::{Digest, Sha256};
 
@@ -304,3 +305,117 @@ pub async fn set_login_session(session: Session, data: UserStateInner) -> Result
         .await
         .map_err(|e| Error::StateError(format!("session insert failed: {e}")))
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    // -----------------------------------------------------------------------
+    // generate_state()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn generate_state_length_is_64() {
+        let state = generate_state();
+        assert_eq!(state.len(), 64);
+    }
+
+    #[test]
+    fn generate_state_chars_are_hex() {
+        let state = generate_state();
+        assert!(state.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn generate_state_two_calls_differ() {
+        let a = generate_state();
+        let b = generate_state();
+        assert_ne!(a, b);
+    }
+
+    // -----------------------------------------------------------------------
+    // generate_code_verifier()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn code_verifier_length_is_43() {
+        let verifier = generate_code_verifier();
+        assert_eq!(verifier.len(), 43);
+    }
+
+    #[test]
+    fn code_verifier_chars_are_url_safe_base64() {
+        let verifier = generate_code_verifier();
+        // URL-safe base64 without padding uses [A-Za-z0-9_-]
+        assert!(verifier
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_'));
+    }
+
+    // -----------------------------------------------------------------------
+    // derive_code_challenge()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn code_challenge_deterministic() {
+        let verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
+        let a = derive_code_challenge(verifier);
+        let b = derive_code_challenge(verifier);
+        assert_eq!(a, b);
+    }
+
+    #[test]
+    fn code_challenge_rfc7636_test_vector() {
+        // RFC 7636 Appendix B test vector:
+        // verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+        // expected challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+        let verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
+        let challenge = derive_code_challenge(verifier);
+        assert_eq!(challenge, "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
+    }
+
+    // -----------------------------------------------------------------------
+    // PendingOAuthStore
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn pending_store_insert_and_take() {
+        let store = PendingOAuthStore::default();
+        store.insert(
+            "state-1".into(),
+            PendingOAuthEntry {
+                redirect_url: Some("/dashboard".into()),
+                code_verifier: "verifier-1".into(),
+            },
+        );
+        let entry = store.take("state-1");
+        assert!(entry.is_some());
+        let entry = entry.unwrap();
+        assert_eq!(entry.redirect_url, Some("/dashboard".into()));
+        assert_eq!(entry.code_verifier, "verifier-1");
+    }
+
+    #[test]
+    fn pending_store_take_removes_entry() {
+        let store = PendingOAuthStore::default();
+        store.insert(
+            "state-2".into(),
+            PendingOAuthEntry {
+                redirect_url: None,
+                code_verifier: "v2".into(),
+            },
+        );
+        let _ = store.take("state-2");
+        // Second take should return None since the entry was removed.
+        assert!(store.take("state-2").is_none());
+    }
+
+    #[test]
+    fn pending_store_take_unknown_returns_none() {
+        let store = PendingOAuthStore::default();
+        assert!(store.take("nonexistent").is_none());
+    }
+}

src/infrastructure/config.rs

@@ -251,3 +251,160 @@ impl LlmProvidersConfig {
         Ok(Self { providers })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::*;
+    use pretty_assertions::assert_eq;
+    use serial_test::serial;
+
+    // -----------------------------------------------------------------------
+    // KeycloakConfig endpoint methods (no env vars needed)
+    // -----------------------------------------------------------------------
+
+    fn sample_keycloak() -> KeycloakConfig {
+        KeycloakConfig {
+            url: "https://auth.example.com".into(),
+            realm: "myrealm".into(),
+            client_id: "dashboard".into(),
+            redirect_uri: "https://app.example.com/callback".into(),
+            app_url: "https://app.example.com".into(),
+            admin_client_id: String::new(),
+            admin_client_secret: SecretString::from(String::new()),
+        }
+    }
+
+    #[test]
+    fn keycloak_auth_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.auth_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/auth"
+        );
+    }
+
+    #[test]
+    fn keycloak_token_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.token_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/token"
+        );
+    }
+
+    #[test]
+    fn keycloak_userinfo_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.userinfo_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/userinfo"
+        );
+    }
+
+    #[test]
+    fn keycloak_logout_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.logout_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/logout"
+        );
+    }
+
+    // -----------------------------------------------------------------------
+    // LlmProvidersConfig::from_env()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    #[serial]
+    fn llm_providers_empty_string() {
+        std::env::set_var("LLM_PROVIDERS", "");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert!(cfg.providers.is_empty());
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_single() {
+        std::env::set_var("LLM_PROVIDERS", "ollama");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_multiple() {
+        std::env::set_var("LLM_PROVIDERS", "ollama,openai,anthropic");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai", "anthropic"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_trims_whitespace() {
+        std::env::set_var("LLM_PROVIDERS", " ollama , openai ");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_filters_empty_entries() {
+        std::env::set_var("LLM_PROVIDERS", "ollama,,openai,");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    // -----------------------------------------------------------------------
+    // ServiceUrls::from_env() defaults
+    // -----------------------------------------------------------------------
+
+    #[test]
+    #[serial]
+    fn service_urls_default_ollama_url() {
+        std::env::remove_var("OLLAMA_URL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_url, "http://localhost:11434");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_default_ollama_model() {
+        std::env::remove_var("OLLAMA_MODEL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_model, "llama3.1:8b");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_default_searxng_url() {
+        std::env::remove_var("SEARXNG_URL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.searxng_url, "http://localhost:8888");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_custom_ollama_url() {
+        std::env::set_var("OLLAMA_URL", "http://gpu-host:11434");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_url, "http://gpu-host:11434");
+        std::env::remove_var("OLLAMA_URL");
+    }
+
+    #[test]
+    #[serial]
+    fn required_env_missing_returns_config_error() {
+        std::env::remove_var("__TEST_REQUIRED_MISSING__");
+        let result = required_env("__TEST_REQUIRED_MISSING__");
+        assert!(result.is_err());
+        let err_msg = result.unwrap_err().to_string();
+        assert!(err_msg.contains("__TEST_REQUIRED_MISSING__"));
+    }
+}

src/infrastructure/error.rs

@@ -41,3 +41,53 @@ impl IntoResponse for Error {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::response::IntoResponse;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn state_error_display() {
+        let err = Error::StateError("bad state".into());
+        assert_eq!(err.to_string(), "bad state");
+    }
+
+    #[test]
+    fn database_error_display() {
+        let err = Error::DatabaseError("connection lost".into());
+        assert_eq!(err.to_string(), "database error: connection lost");
+    }
+
+    #[test]
+    fn config_error_display() {
+        let err = Error::ConfigError("missing var".into());
+        assert_eq!(err.to_string(), "configuration error: missing var");
+    }
+
+    #[test]
+    fn state_error_into_response_500() {
+        let resp = Error::StateError("oops".into()).into_response();
+        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    }
+
+    #[test]
+    fn database_error_into_response_503() {
+        let resp = Error::DatabaseError("down".into()).into_response();
+        assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
+    }
+
+    #[test]
+    fn config_error_into_response_500() {
+        let resp = Error::ConfigError("bad cfg".into()).into_response();
+        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    }
+
+    #[test]
+    fn io_error_into_response_500() {
+        let io_err = std::io::Error::new(std::io::ErrorKind::NotFound, "not found");
+        let resp = Error::IoError(io_err).into_response();
+        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    }
+}

src/infrastructure/searxng.rs

@@ -5,13 +5,13 @@ use dioxus::prelude::*;
 // The #[server] macro generates a client stub for the web build that
 // sends a network request instead of executing this function body.
 #[cfg(feature = "server")]
-mod inner {
+pub(crate) mod inner {
     use serde::Deserialize;
     use std::collections::HashSet;
 
     /// Individual result from the SearXNG search API.
     #[derive(Debug, Deserialize)]
-    pub(super) struct SearxngResult {
+    pub(crate) struct SearxngResult {
         pub title: String,
         pub url: String,
         pub content: Option<String>,
@@ -25,7 +25,7 @@ mod inner {
 
     /// Top-level response from the SearXNG search API.
     #[derive(Debug, Deserialize)]
-    pub(super) struct SearxngResponse {
+    pub(crate) struct SearxngResponse {
         pub results: Vec<SearxngResult>,
     }
 
@@ -40,7 +40,7 @@ mod inner {
     /// # Returns
     ///
     /// The domain host or a fallback "Web" string
-    pub(super) fn extract_source(url_str: &str) -> String {
+    pub(crate) fn extract_source(url_str: &str) -> String {
         url::Url::parse(url_str)
             .ok()
             .and_then(|u| u.host_str().map(String::from))
@@ -64,7 +64,7 @@ mod inner {
     /// # Returns
     ///
     /// Filtered, deduplicated, and ranked results
-    pub(super) fn rank_and_deduplicate(
+    pub(crate) fn rank_and_deduplicate(
         mut results: Vec<SearxngResult>,
         max_results: usize,
     ) -> Vec<SearxngResult> {
@@ -285,3 +285,166 @@ pub async fn get_trending_topics() -> Result<Vec<String>, ServerFnError> {
 
     Ok(topics)
 }
+
+#[cfg(all(test, feature = "server"))]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::inner::*;
+    use pretty_assertions::assert_eq;
+
+    // -----------------------------------------------------------------------
+    // extract_source()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn extract_source_strips_www() {
+        assert_eq!(
+            extract_source("https://www.example.com/page"),
+            "example.com"
+        );
+    }
+
+    #[test]
+    fn extract_source_returns_domain() {
+        assert_eq!(
+            extract_source("https://techcrunch.com/article"),
+            "techcrunch.com"
+        );
+    }
+
+    #[test]
+    fn extract_source_invalid_url_returns_web() {
+        assert_eq!(extract_source("not-a-url"), "Web");
+    }
+
+    #[test]
+    fn extract_source_no_scheme_returns_web() {
+        // url::Url::parse requires a scheme; bare domain fails
+        assert_eq!(extract_source("example.com/path"), "Web");
+    }
+
+    // -----------------------------------------------------------------------
+    // rank_and_deduplicate()
+    // -----------------------------------------------------------------------
+
+    fn make_result(url: &str, content: &str, score: f64) -> SearxngResult {
+        SearxngResult {
+            title: "Title".into(),
+            url: url.into(),
+            content: if content.is_empty() {
+                None
+            } else {
+                Some(content.into())
+            },
+            published_date: None,
+            thumbnail: None,
+            score,
+        }
+    }
+
+    #[test]
+    fn rank_filters_empty_content() {
+        let results = vec![
+            make_result("https://a.com", "", 10.0),
+            make_result(
+                "https://b.com",
+                "This is meaningful content that passes the length filter",
+                5.0,
+            ),
+        ];
+        let ranked = rank_and_deduplicate(results, 10);
+        assert_eq!(ranked.len(), 1);
+        assert_eq!(ranked[0].url, "https://b.com");
+    }
+
+    #[test]
+    fn rank_filters_short_content() {
+        let results = vec![
+            make_result("https://a.com", "short", 10.0),
+            make_result(
+                "https://b.com",
+                "This content is long enough to pass the 20-char filter threshold",
+                5.0,
+            ),
+        ];
+        let ranked = rank_and_deduplicate(results, 10);
+        assert_eq!(ranked.len(), 1);
+    }
+
+    #[test]
+    fn rank_deduplicates_by_domain_keeps_highest() {
+        let results = vec![
+            make_result(
+                "https://example.com/page1",
+                "First result with enough content here for the filter",
+                3.0,
+            ),
+            make_result(
+                "https://example.com/page2",
+                "Second result with enough content here for the filter",
+                8.0,
+            ),
+        ];
+        let ranked = rank_and_deduplicate(results, 10);
+        assert_eq!(ranked.len(), 1);
+        // Should keep the highest-scored one (page2 with score 8.0)
+        assert_eq!(ranked[0].url, "https://example.com/page2");
+    }
+
+    #[test]
+    fn rank_sorts_by_score_descending() {
+        let results = vec![
+            make_result(
+                "https://a.com/p",
+                "Content A that is long enough to pass the filter check",
+                1.0,
+            ),
+            make_result(
+                "https://b.com/p",
+                "Content B that is long enough to pass the filter check",
+                5.0,
+            ),
+            make_result(
+                "https://c.com/p",
+                "Content C that is long enough to pass the filter check",
+                3.0,
+            ),
+        ];
+        let ranked = rank_and_deduplicate(results, 10);
+        assert_eq!(ranked.len(), 3);
+        assert!(ranked[0].score >= ranked[1].score);
+        assert!(ranked[1].score >= ranked[2].score);
+    }
+
+    #[test]
+    fn rank_truncates_to_max_results() {
+        let results: Vec<_> = (0..20)
+            .map(|i| {
+                make_result(
+                    &format!("https://site{i}.com/page"),
+                    &format!("Content for site {i} that is long enough to pass the filter"),
+                    i as f64,
+                )
+            })
+            .collect();
+        let ranked = rank_and_deduplicate(results, 5);
+        assert_eq!(ranked.len(), 5);
+    }
+
+    #[test]
+    fn rank_empty_input_returns_empty() {
+        let ranked = rank_and_deduplicate(vec![], 10);
+        assert!(ranked.is_empty());
+    }
+
+    #[test]
+    fn rank_all_filtered_returns_empty() {
+        let results = vec![
+            make_result("https://a.com", "", 10.0),
+            make_result("https://b.com", "too short", 5.0),
+        ];
+        let ranked = rank_and_deduplicate(results, 10);
+        assert!(ranked.is_empty());
+    }
+}