[Coverage Report] Test Coverage Report — 2026-06-21

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	97.82%	5,041 / 5,153
Branches	93.58%	2,831 / 3,025
Functions	99.50%	609 / 612
Lines	97.89%	4,872 / 4,977

All metrics exceed configured thresholds (statements ≥38%, branches ≥30%, functions ≥35%, lines ≥38%).

---

Security-Critical File Coverage

File	Lines	Branches	Functions	Status
squid-config.ts	100%	100%	100%	✅
docker-manager.ts	100%	100%	100%	✅
host-iptables-cleanup.ts	100%	100%	100%	✅
host-iptables-network.ts	100%	100%	100%	✅
host-iptables-rules.ts	98.66%	96.05% (73/76)	100%	⚠️ 3 uncovered branches
domain-patterns.ts	100%	89.47% (17/19)	100%	⚠️ 2 uncovered branches
cli.ts	85.71%	50.00% (1/2)	100%	⚠️ 1 uncovered branch

---

Files With Lowest Coverage

File	Lines	Branches	Gap
squid-log-reader.ts	82.22% (37/45)	—	8 uncovered lines
cli.ts	85.71% (6/7)	50% (1/2)	Entry-point branch untested
config-writer.ts	85.71% (66/77)	—	11 uncovered lines
commands/logs-command-helpers.ts	88.33% (53/60)	—	7 uncovered lines
domain-patterns.ts	100%	89.47% (17/19)	2 uncovered branches in ACL logic

---

Notable Findings

• Overall coverage is strong: At 97.82% statements and 93.58% branches, the test suite far exceeds configured thresholds. Coverage is broad and well-distributed across 67 unit test files.
• Branch coverage is the primary gap (194 uncovered branches total); the largest security-relevant concentration is in domain-patterns.ts (2 uncovered branches, 89.47%) — the module that validates and normalises domain ACL rules controlling what traffic the firewall allows.
• host-iptables-rules.ts has 3 uncovered branches (96.05%) in iptables rule generation. This is the most security-sensitive path in the codebase; even a small gap here may leave error-handling or edge-case rule variants untested.
• squid-log-reader.ts has the lowest line coverage at 82.22% (8 uncovered lines), which may affect the reliability of audit log parsing — the component used for compliance reporting and incident detection.

---

Recommendations

Priority	Recommendation
🔴 High	Add targeted branch tests for domain-patterns.ts to cover the 2 remaining edge cases in domain pattern validation. A logic bypass here directly weakens ACL enforcement — the firewall's primary security guarantee.
🟡 Medium	Extend host-iptables-rules.ts tests to cover the 3 uncovered branches in iptables rule construction. Focus on conditional rule variants and error-handling paths that may produce subtly incorrect network isolation rules.
🟢 Low	Improve squid-log-reader.ts line coverage from 82% to ≥95%. The uncovered lines likely represent error handling paths; if untested, they could cause silent log loss during security incident investigation or compliance audits.

---

Generated from coverage/coverage-summary.json · 67 unit test files · 35 integration test files · Branch: main · Date: 2026-06-21

Generated by Test Coverage Reporter · 55.6 AIC · ⊞ 4.6K · ◷

• expires on Jun 28, 2026, 5:54 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-28T17:54:13.567Z.

Closed by Workflow