[Coverage Report] Test Coverage Report — 2026-06-15

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total	Status
Statements	96.77%	4,923 / 5,087	✅
Branches	91.27%	2,730 / 2,991	✅
Functions	98.81%	583 / 590	✅
Lines	96.90%	4,766 / 4,918	✅

Overall coverage is strong. All four metrics are well above the configured thresholds (statements: 38%, branches: 30%, functions: 35%, lines: 38%), though several individual files have branch coverage below 80%.

---

Security-Critical File Status

File	Statements	Branches	Functions	Notes
host-iptables.ts + all sub-modules	100%	100%	100%	✅ Fully covered
host-iptables-rules.ts	100%	100%	100%	✅
squid-config.ts (entry)	100%	—	100%	✅ Re-export only
squid/access-rules.ts	100%	100%	100%	✅
squid/acl-generator.ts	100%	100%	100%	✅
squid/domain-acl.ts	100%	100%	100%	✅
squid/validation.ts	100%	100%	100%	✅
squid/config-sections.ts	100%	82.75%	100%	⚠️ 5 branches uncovered
squid/policy-manifest.ts	87.5%	88.23%	70%	⚠️ 3 of 10 functions untested
domain-patterns.ts	98.18%	94.52%	100%	✅ 4 branches uncovered
docker-manager.ts	100%	—	100%	✅ Re-export only
cli.ts	85.71%	50%	100%	⚠️ 1 of 2 branches uncovered (entry-point guard)

---

Per-File Branch Coverage — Files Below 80%

File	Branch %	Uncovered	Area
commands/validators/network-options.ts	50%	5 / 10	Network security config validation
services/agent-volumes/etc-mounts.ts	67.85%	9 / 28	/etc filesystem exposure control
logs/log-parser.ts	68.57%	22 / 70	Firewall audit log parsing
services/agent-volumes/docker-host-staging.ts	72.41%	8 / 29	DinD filesystem staging
logs/audit-enricher.ts	74.13%	15 / 58	Audit log enrichment
services/agent-volumes/workspace-mounts.ts	75%	10 / 40	Workspace mount configuration
commands/validators/log-and-limits.ts	77.58%	13 / 58	Log and rate-limit validation
workdir-setup.ts	79.62%	11 / 54	Work directory initialisation
squid/policy-manifest.ts (functions)	88.23% branches / 70% funcs	3 funcs / 4 branches	Policy ACL manifest generation

---

🔍 Notable Findings

1. commands/validators/network-options.ts — 50% branch coverage (security config gate)

This is the validation entry point for all network-security options: Docker host detection, DNS server selection, upstream proxy configuration, domain allow/block lists, and DinD path-prefix resolution. Only 5 of 10 branches are exercised. The uncovered branches most likely include:

• the dockerHostCheck.valid === false warning path (external Docker host detected)
• the dindHint && !dockerHostPathPrefix compound condition (ARC/DinD split-filesystem warning)

Both are warning-only paths today, but they gate security-relevant configuration decisions. A future regression that accidentally silences or skips them would be undetected without branch-level tests.

2. squid/policy-manifest.ts — 70% function coverage (3 of 10 functions untested)

generatePolicyManifest() builds the structured ACL manifest used for audit log enrichment. Three functions are completely untested. Looking at the source, the three untested code paths are the conditional rule-generation branches for: HTTP-only domain rules (allow-http-only-plain, allow-http-only-regex), HTTPS-only domain rules (allow-https-only-plain, allow-https-only-regex), and explicit blocked-domain regex patterns (deny-blocked-regex). Each of these maps to a distinct Squid http_access directive. If the manifest diverges from the actual Squid config in these protocol-specific cases, the audit enricher will misattribute allowed/denied traffic.

3. logs/log-parser.ts — 68.57% branch coverage (22 of 70 branches uncovered)

The log parser interprets every Squid audit event. Its 22 uncovered branches likely include: entries where destIp or destPort is - (no upstream connection established), decision codes that are neither TCP_DENIED nor NONE variants (e.g., TCP_MISS, TCP_HIT, TCP_REFRESH_UNMODIFIED), and the isAllowed three-way classification logic. Gaps here mean that legitimate traffic types may be misclassified in awf logs stats / awf logs summary output — a security audit correctness issue.

4. services/agent-volumes/etc-mounts.ts — 67.85% branch coverage (9 of 28 branches uncovered)

This module decides which /etc files are bind-mounted into the agent container's chroot — a direct security boundary. The uncovered branches include the synthesizeIdentityFile failure path (returns undefined on write error), the resolveUniqueName collision-counter loop, and conditional logic that adds synthesized /etc/passwd or /etc/group entries when the runner's UID/GID are absent. An untested failure in this path could cause the agent to run as the wrong user identity or skip a required identity mapping.

---

📈 Recommendations

🔴 High — Cover commands/validators/network-options.ts branch gaps

Add tests for the two uncovered warning branches: (a) checkDockerHost() returning valid: false (external TCP Docker host) and (b) dockerHostPathPrefixResolution.dindHint === true with no prefix set. These are the conditions where AWF detects ARC/DinD split-filesystem setups. Without branch coverage, a code change that silently breaks DinD detection would ship unnoticed.

// Example: test the dindHint warning path
process.env.DOCKER_HOST = '(redacted)
process.env.AWF_DIND = '1';
validateNetworkOptions({ allowDomains: ['example.com'] });
// assert logger.warn called with dindHint message

🟡 Medium — Add protocol-specific domain tests for squid/policy-manifest.ts

Add generatePolicyManifest() test cases with:

1. A domain list containing HTTP-only entries (e.g., (internal.corp/redacted) — verifies allow-http-only-plain` rule is generated.
2. A domain list with HTTPS-only entries — verifies allow-https-only-plain.
3. A blockedDomains list that includes a regex pattern (e.g., *.evil.example) — verifies deny-blocked-regex rule is emitted.

This ensures the manifest accurately reflects the Squid ACL for all domain protocol variants and the audit enricher correlates log events correctly.

🟡 Medium — Expand logs/log-parser.ts with real-world decision-code variants

Add unit tests covering:

• Log lines where destIp:destPort is -:- (proxy-denied before upstream connection)
• Lines with TCP_MISS, TCP_HIT, TCP_MEM_HIT, and TCP_REFRESH_UNMODIFIED decision codes (should be classified as isAllowed: true)
• Lines with NONE/ prefix variants (should be classified as noise, not counted as allowed or denied)

These cases occur regularly in production Squid logs and directly affect the accuracy of awf logs stats security summaries.

Generated by Test Coverage Reporter · ◷

• expires on Jun 22, 2026, 3:24 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-22T15:24:01.772Z.

Closed by Workflow