fix(auth): complete Task 13 deployment review

tools/tht/internal/backup/create_test.go

@@ -23,7 +23,7 @@ import (
 
 var requiredTestVolumes = []string{"settings", "pi-state", "workspace-registry", "workspace-secrets", "sessions", "qdrant-data", "embedding-models"}
 
-func TestDecodeComposeImageIdentitiesAcceptsArrayAndStreamingJSON(t *testing.T) {
+func TestDecodeComposeImageIdentitiesAcceptsNonEmptyArrayAndStreamingJSON(t *testing.T) {
 	for name, input := range map[string]string{
 		"array":     `[{"ContainerName":"project-core-1","ID":"sha256:core"},{"ContainerName":"project-frontend-1","ID":"sha256:frontend"}]`,
 		"streaming": "{\"Service\":\"core\",\"ID\":\"sha256:core\"}\n{\"Service\":\"frontend\",\"ID\":\"sha256:frontend\"}\n",
@@ -41,11 +41,72 @@ func TestDecodeComposeImageIdentitiesAcceptsArrayAndStreamingJSON(t *testing.T)
 }
 
 func TestDecodeComposeImageIdentitiesAcceptsNoContainerForProfiledService(t *testing.T) {
-	for _, input := range []string{"", "[]"} {
-		identities, err := decodeComposeImageIdentities(input)
-		if err != nil || len(identities) != 0 {
-			t.Fatalf("decodeComposeImageIdentities(%q) = %#v, %v", input, identities, err)
-		}
+	for name, input := range map[string]string{
+		"empty output": "",
+		"empty array":  "[]",
+		"null":         "null",
+	} {
+		t.Run(name, func(t *testing.T) {
+			identities, err := decodeComposeImageIdentities(input)
+			if err != nil || len(identities) != 0 {
+				t.Fatalf("decodeComposeImageIdentities(%q) = %#v, %v", input, identities, err)
+			}
+		})
+	}
+}
+
+func TestDecodeComposeImageIdentitiesRejectsMalformedOrIncompleteOutput(t *testing.T) {
+	for name, input := range map[string]string{
+		"malformed JSON":           "[",
+		"scalar JSON":              "true",
+		"empty object":             "{}",
+		"null array element":       "[null]",
+		"missing image ID":         `[{"Service":"core"}]`,
+		"trailing document":        "null\n{}",
+		"trailing malformed bytes": `null garbage`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			if identities, err := decodeComposeImageIdentities(input); err == nil {
+				t.Fatalf("decodeComposeImageIdentities(%q) = %#v, nil; want error", input, identities)
+			}
+		})
+	}
+}
+
+func TestSelectComposeImageIdentityUsesExactComposeContainerWhenServiceIsAbsent(t *testing.T) {
+	identities := []composeImageIdentity{
+		{ContainerName: "project-core-1", ID: "sha256:core"},
+		{ContainerName: "project-llm", ID: "sha256:shared-image"},
+	}
+	id, err := selectComposeImageIdentity("core", "project-core-1", identities)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if id != "sha256:core" {
+		t.Fatalf("selected image ID = %q, want sha256:core", id)
+	}
+}
+
+func TestSelectComposeImageIdentityDoesNotFailOpen(t *testing.T) {
+	for name, identities := range map[string][]composeImageIdentity{
+		"unrelated container only": {{ContainerName: "project-llm", ID: "sha256:shared-image"}},
+		"duplicate service": {
+			{Service: "core", ID: "sha256:first"},
+			{Service: "core", ID: "sha256:second"},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if id, err := selectComposeImageIdentity("core", "project-core-1", identities); err == nil {
+				t.Fatalf("selectComposeImageIdentity() = %q, nil; want error", id)
+			}
+		})
+	}
+}
+
+func TestSelectComposeImageIdentityAcceptsSemanticallyEmptyOutput(t *testing.T) {
+	id, err := selectComposeImageIdentity("workspace-maintenance", "project-workspace-maintenance-1", nil)
+	if err != nil || id != "" {
+		t.Fatalf("selectComposeImageIdentity() = %q, %v; want empty identity", id, err)
 	}
 }