test(git-gate): ratchet git_gate coverage to >=90%

Fourth per-module ratchet under ADR 0004. Cover the pure
`git_gate_render_gitconfig` renderer (empty entries, insteadOf URL,
scheme override, RemoteKey ssh alias with/without non-default port,
newline-injection rejection) and the dynamic gitea deploy-key
lifecycle with the forge provisioner mocked:

- `_provision_dynamic_key`: writes key + key-id files, strips `.git`
  from owner/repo, builds the proposal title; missing token raises.
- `revoke_git_gate_provisioned_keys`: revokes a gitea key when the
  id-file is present, skips static-provider entries and missing
  id-files, raises on a missing token.

bot_bottle/git_gate.py: 70% -> 99% (unit only). Two remaining partial
branches are inner conditionals on the alias/owner-repo paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NkwFXLFff9PYPy4wgVBJp9

tests/unit/test_egress_core_parsing.py

@@ -0,0 +1,297 @@
+"""Unit: egress_addon_core route parsing, serialization, and match
+evaluation error/edge branches (coverage ratchet, ADR 0004).
+
+Complements test_egress_addon_core.py — focuses on the validation
+rejections, the Route->YAML serializer, and evaluate_matches."""
+
+from __future__ import annotations
+
+import unittest
+
+from bot_bottle.egress_addon_core import (
+    HeaderMatch,
+    MatchEntry,
+    PathMatch,
+    Route,
+    evaluate_matches,
+    load_config,
+    parse_config,
+    parse_routes,
+    route_to_yaml_dict,
+)
+
+
+def _route(d: dict[str, object]) -> Route:
+    return parse_routes({"routes": [d]})[0]
+
+
+class TestRouteValidationErrors(unittest.TestCase):
+    def _bad(self, d: dict[str, object]) -> None:
+        with self.assertRaises(ValueError):
+            parse_routes({"routes": [d]})
+
+    # routes-payload shape
+    def test_payload_not_dict(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_routes(["nope"])
+
+    def test_routes_not_list(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_routes({"routes": "nope"})
+
+    def test_route_not_dict(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_routes({"routes": ["nope"]})
+
+    def test_host_missing(self) -> None:
+        self._bad({})
+
+    def test_unknown_route_key(self) -> None:
+        self._bad({"host": "h", "bogus": 1})
+
+    # auth
+    def test_auth_scheme_without_token_env(self) -> None:
+        self._bad({"host": "h", "auth_scheme": "Bearer"})
+
+    def test_auth_scheme_wrong_type(self) -> None:
+        self._bad({"host": "h", "auth_scheme": 5, "token_env": "T"})
+
+    # git
+    def test_git_not_dict(self) -> None:
+        self._bad({"host": "h", "git": "yes"})
+
+    def test_git_fetch_not_bool(self) -> None:
+        self._bad({"host": "h", "git": {"fetch": "yes"}})
+
+    def test_git_unknown_key(self) -> None:
+        self._bad({"host": "h", "git": {"fetch": True, "push": True}})
+
+    # matches: paths
+    def test_matches_not_list(self) -> None:
+        self._bad({"host": "h", "matches": "x"})
+
+    def test_match_entry_not_dict(self) -> None:
+        self._bad({"host": "h", "matches": ["x"]})
+
+    def test_paths_not_list(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": "x"}]})
+
+    def test_path_not_dict(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": ["x"]}]})
+
+    def test_path_bad_type(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": [{"type": "bogus", "value": "/x"}]}]})
+
+    def test_path_empty_value(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": [{"value": ""}]}]})
+
+    def test_path_value_missing_slash(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": [{"type": "prefix", "value": "x"}]}]})
+
+    def test_path_bad_regex(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": [{"type": "regex", "value": "("}]}]})
+
+    def test_path_unknown_key(self) -> None:
+        self._bad({"host": "h", "matches": [{"paths": [{"value": "/x", "z": 1}]}]})
+
+    # matches: methods
+    def test_methods_not_list(self) -> None:
+        self._bad({"host": "h", "matches": [{"methods": "GET"}]})
+
+    def test_method_not_string(self) -> None:
+        self._bad({"host": "h", "matches": [{"methods": [5]}]})
+
+    def test_method_invalid(self) -> None:
+        self._bad({"host": "h", "matches": [{"methods": ["FETCH"]}]})
+
+    # matches: headers
+    def test_headers_not_list(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": "x"}]})
+
+    def test_header_not_dict(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": ["x"]}]})
+
+    def test_header_name_empty(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": [{"name": "", "value": "v"}]}]})
+
+    def test_header_value_not_string(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": [{"name": "X", "value": 1}]}]})
+
+    def test_header_bad_type(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": [{"name": "X", "value": "v", "type": "z"}]}]})
+
+    def test_header_bad_regex(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": [{"name": "X", "value": "(", "type": "regex"}]}]})
+
+    def test_header_unknown_key(self) -> None:
+        self._bad({"host": "h", "matches": [{"headers": [{"name": "X", "value": "v", "z": 1}]}]})
+
+    # dlp
+    def test_dlp_not_dict(self) -> None:
+        self._bad({"host": "h", "dlp": "x"})
+
+    def test_dlp_detectors_wrong_type(self) -> None:
+        self._bad({"host": "h", "dlp": {"outbound_detectors": "x"}})
+
+    def test_dlp_detector_name_invalid(self) -> None:
+        self._bad({"host": "h", "dlp": {"outbound_detectors": ["bogus"]}})
+
+    def test_dlp_detector_item_not_string(self) -> None:
+        self._bad({"host": "h", "dlp": {"outbound_detectors": [5]}})
+
+    def test_dlp_on_match_invalid(self) -> None:
+        self._bad({"host": "h", "dlp": {"outbound_on_match": "maybe"}})
+
+    def test_dlp_unknown_key(self) -> None:
+        self._bad({"host": "h", "dlp": {"bogus": 1}})
+
+
+class TestRouteValidAccepts(unittest.TestCase):
+    def test_full_route_parses(self) -> None:
+        r = _route({
+            "host": "api.example.com",
+            "auth_scheme": "Bearer",
+            "token_env": "TOK",
+            "matches": [{
+                "paths": [{"type": "exact", "value": "/v1"}],
+                "methods": ["get", "post"],
+                "headers": [{"name": "X-Env", "value": "prod"}],
+            }],
+            "git": {"fetch": True},
+            "dlp": {
+                "outbound_detectors": ["token_patterns"],
+                "inbound_detectors": ["naive_injection_detection"],
+                "outbound_on_match": "block",
+            },
+        })
+        self.assertEqual("api.example.com", r.host)
+        self.assertEqual(("GET", "POST"), r.matches[0].methods)
+        self.assertTrue(r.git_fetch)
+        self.assertEqual("block", r.outbound_on_match)
+
+    def test_dlp_detectors_false_disables(self) -> None:
+        r = _route({"host": "h", "dlp": {"outbound_detectors": False}})
+        self.assertEqual((), r.outbound_detectors)
+
+
+class TestParseConfig(unittest.TestCase):
+    def test_log_must_be_valid_level(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_config({"log": 5, "routes": []})
+
+    def test_log_true_rejected(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_config({"log": True, "routes": []})
+
+    def test_top_level_not_dict(self) -> None:
+        with self.assertRaises(ValueError):
+            parse_config(["x"])
+
+    def test_load_config_invalid_yaml(self) -> None:
+        with self.assertRaises(ValueError):
+            load_config("routes: [unterminated\n")
+
+
+class TestRouteToYamlDict(unittest.TestCase):
+    def test_minimal(self) -> None:
+        self.assertEqual({"host": "h"}, route_to_yaml_dict(Route(host="h")))
+
+    def test_auth_fields(self) -> None:
+        d = route_to_yaml_dict(Route(host="h", auth_scheme="Bearer", token_env="T"))
+        self.assertEqual("Bearer", d["auth_scheme"])
+        self.assertEqual("T", d["token_env"])
+
+    def test_git_fetch(self) -> None:
+        d = route_to_yaml_dict(Route(host="h", git_fetch=True))
+        self.assertEqual({"fetch": True}, d["git"])
+
+    def test_dlp_fields(self) -> None:
+        d = route_to_yaml_dict(Route(
+            host="h",
+            outbound_detectors=("token_patterns",),
+            inbound_detectors=("naive_injection_detection",),
+            outbound_on_match="redact",
+        ))
+        self.assertEqual(
+            {
+                "outbound_detectors": ["token_patterns"],
+                "inbound_detectors": ["naive_injection_detection"],
+                "outbound_on_match": "redact",
+            },
+            d["dlp"],
+        )
+
+    def test_matches_serialization_omits_defaults(self) -> None:
+        route = Route(host="h", matches=(MatchEntry(
+            paths=(
+                PathMatch(type="prefix", value="/p"),   # default type -> omitted
+                PathMatch(type="exact", value="/e"),    # non-default -> kept
+            ),
+            methods=("GET",),
+            headers=(
+                HeaderMatch(name="X", value="v"),                    # exact -> omitted
+                HeaderMatch(name="Y", value="r", type="regex"),      # regex -> kept
+            ),
+        ),))
+        d = route_to_yaml_dict(route)
+        matches = d["matches"]
+        assert isinstance(matches, list)
+        entry = matches[0]
+        self.assertEqual(
+            [{"value": "/p"}, {"value": "/e", "type": "exact"}],
+            entry["paths"],
+        )
+        self.assertEqual(["GET"], entry["methods"])
+        self.assertEqual(
+            [{"name": "X", "value": "v"}, {"name": "Y", "value": "r", "type": "regex"}],
+            entry["headers"],
+        )
+
+
+class TestEvaluateMatches(unittest.TestCase):
+    def _route_with(self, entry: MatchEntry) -> Route:
+        return Route(host="h", matches=(entry,))
+
+    def test_empty_matches_allows_all(self) -> None:
+        self.assertTrue(evaluate_matches(Route(host="h"), "/anything", "GET"))
+
+    def test_exact_path(self) -> None:
+        r = self._route_with(MatchEntry(paths=(PathMatch("exact", "/a"),)))
+        self.assertTrue(evaluate_matches(r, "/a", "GET"))
+        self.assertFalse(evaluate_matches(r, "/a/b", "GET"))
+
+    def test_prefix_path_boundary(self) -> None:
+        r = self._route_with(MatchEntry(paths=(PathMatch("prefix", "/a"),)))
+        self.assertTrue(evaluate_matches(r, "/a/b", "GET"))
+        self.assertFalse(evaluate_matches(r, "/ab", "GET"))
+
+    def test_regex_path(self) -> None:
+        import re
+        r = self._route_with(MatchEntry(
+            paths=(PathMatch("regex", r"/v\d+", compiled=re.compile(r"/v\d+")),),
+        ))
+        self.assertTrue(evaluate_matches(r, "/v1", "GET"))
+        self.assertFalse(evaluate_matches(r, "/x", "GET"))
+
+    def test_method_filter(self) -> None:
+        r = self._route_with(MatchEntry(methods=("POST",)))
+        self.assertTrue(evaluate_matches(r, "/x", "post"))
+        self.assertFalse(evaluate_matches(r, "/x", "GET"))
+
+    def test_header_exact(self) -> None:
+        r = self._route_with(MatchEntry(headers=(HeaderMatch("X-Env", "prod"),)))
+        self.assertTrue(evaluate_matches(r, "/x", "GET", {"x-env": "prod"}))
+        self.assertFalse(evaluate_matches(r, "/x", "GET", {"x-env": "dev"}))
+        self.assertFalse(evaluate_matches(r, "/x", "GET", {}))
+
+    def test_header_regex(self) -> None:
+        import re
+        r = self._route_with(MatchEntry(
+            headers=(HeaderMatch("X-Env", r"pr.*", type="regex", compiled=re.compile(r"pr.*")),),
+        ))
+        self.assertTrue(evaluate_matches(r, "/x", "GET", {"x-env": "prod"}))
+        self.assertFalse(evaluate_matches(r, "/x", "GET", {"x-env": "dev"}))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_git_gate_render_provision.py

@@ -0,0 +1,174 @@
+"""Unit: git_gate gitconfig rendering + deploy-key provision/revoke
+(coverage ratchet, ADR 0004).
+
+Covers the pure `git_gate_render_gitconfig` renderer and the dynamic
+(gitea) deploy-key lifecycle, with the forge provisioner mocked."""
+
+from __future__ import annotations
+
+import tempfile
+import types
+import unittest
+from pathlib import Path
+from typing import Any, cast
+from unittest.mock import patch
+
+from bot_bottle.git_gate import (
+    _gitconfig_validate_value,
+    _provision_dynamic_key,
+    git_gate_render_gitconfig,
+    revoke_git_gate_provisioned_keys,
+)
+from bot_bottle.manifest_git import ManifestGitEntry, ManifestKeyConfig
+
+
+def _entry(**kw: Any) -> ManifestGitEntry:
+    base: dict[str, Any] = {
+        "Name": "repo",
+        "Upstream": "git@github.com:o/r.git",
+        "UpstreamHost": "github.com",
+        "UpstreamUser": "git",
+        "UpstreamPath": "o/r.git",
+        "UpstreamPort": "22",
+    }
+    base.update(kw)
+    return ManifestGitEntry(**base)
+
+
+def _gitea_entry(**kw: Any) -> ManifestGitEntry:
+    return _entry(
+        Key=ManifestKeyConfig(provider="gitea", forge_token_env="GITEA_TOK"),
+        **kw,
+    )
+
+
+class _FakeProvisioner:
+    def __init__(self) -> None:
+        self.created: list[tuple[str, str]] = []
+        self.deleted: list[tuple[str, str]] = []
+
+    def create(self, owner_repo: str, title: str) -> tuple[str, bytes]:
+        self.created.append((owner_repo, title))
+        return "kid123", b"PRIVATE-KEY-BYTES"
+
+    def delete(self, owner_repo: str, key_id: str) -> None:
+        self.deleted.append((owner_repo, key_id))
+
+
+# ---------------------------------------------------------------------------
+# git_gate_render_gitconfig
+# ---------------------------------------------------------------------------
+
+
+class TestRenderGitconfig(unittest.TestCase):
+    def test_empty_entries_returns_empty_string(self) -> None:
+        self.assertEqual("", git_gate_render_gitconfig((), "git-gate"))
+
+    def test_single_entry_renders_insteadof(self) -> None:
+        out = git_gate_render_gitconfig((_entry(),), "git-gate")
+        self.assertIn('[url "git://git-gate/repo.git"]', out)
+        self.assertIn("insteadOf = git@github.com:o/r.git", out)
+
+    def test_scheme_override(self) -> None:
+        out = git_gate_render_gitconfig((_entry(),), "1.2.3.4:9418", scheme="http")
+        self.assertIn('[url "http://1.2.3.4:9418/repo.git"]', out)
+
+    def test_remote_key_alias_with_nondefault_port(self) -> None:
+        out = git_gate_render_gitconfig(
+            (_entry(RemoteKey="10.0.0.5", UpstreamPort="2222"),), "git-gate",
+        )
+        self.assertIn("insteadOf = ssh://git@10.0.0.5:2222/o/r.git", out)
+
+    def test_remote_key_alias_default_port_omits_port(self) -> None:
+        out = git_gate_render_gitconfig(
+            (_entry(RemoteKey="10.0.0.5", UpstreamPort="22"),), "git-gate",
+        )
+        self.assertIn("insteadOf = ssh://git@10.0.0.5/o/r.git", out)
+        self.assertNotIn(":22/", out)
+
+    def test_validate_rejects_newline(self) -> None:
+        with self.assertRaises(ValueError):
+            _gitconfig_validate_value("field", "line1\nline2")
+
+    def test_render_rejects_newline_in_upstream(self) -> None:
+        with self.assertRaises(ValueError):
+            git_gate_render_gitconfig((_entry(Upstream="a\nb"),), "git-gate")
+
+
+# ---------------------------------------------------------------------------
+# _provision_dynamic_key
+# ---------------------------------------------------------------------------
+
+
+class TestProvisionDynamicKey(unittest.TestCase):
+    def test_happy_path_writes_key_and_id(self) -> None:
+        fake = _FakeProvisioner()
+        with tempfile.TemporaryDirectory() as d, \
+                patch.dict("os.environ", {"GITEA_TOK": "secret-token"}), \
+                patch("bot_bottle.deploy_key_provisioner.get_provisioner", return_value=fake), \
+                patch("sys.stderr"):
+            path = _provision_dynamic_key(_gitea_entry(), "myslug", Path(d))
+            key_file = Path(path)
+            self.assertEqual(b"PRIVATE-KEY-BYTES", key_file.read_bytes())
+            id_file = Path(d) / "repo-deploy-key-id"
+            self.assertEqual("kid123", id_file.read_text())
+        # owner_repo had .git stripped; title carries slug + name
+        self.assertEqual([("o/r", "bot-bottle:myslug:repo")], fake.created)
+
+    def test_missing_token_raises(self) -> None:
+        with tempfile.TemporaryDirectory() as d, \
+                patch.dict("os.environ", {}, clear=False):
+            import os
+            os.environ.pop("GITEA_TOK", None)
+            with self.assertRaises(RuntimeError):
+                _provision_dynamic_key(_gitea_entry(), "s", Path(d))
+
+
+# ---------------------------------------------------------------------------
+# revoke_git_gate_provisioned_keys
+# ---------------------------------------------------------------------------
+
+
+def _bottle(*entries: ManifestGitEntry) -> Any:
+    return cast(Any, types.SimpleNamespace(git=entries))
+
+
+class TestRevokeProvisionedKeys(unittest.TestCase):
+    def test_revokes_gitea_key_when_id_present(self) -> None:
+        fake = _FakeProvisioner()
+        with tempfile.TemporaryDirectory() as d, \
+                patch.dict("os.environ", {"GITEA_TOK": "secret-token"}), \
+                patch("bot_bottle.deploy_key_provisioner.get_provisioner", return_value=fake), \
+                patch("sys.stderr"):
+            (Path(d) / "repo-deploy-key-id").write_text("kid123")
+            revoke_git_gate_provisioned_keys(_bottle(_gitea_entry()), Path(d))
+        self.assertEqual([("o/r", "kid123")], fake.deleted)
+
+    def test_skips_non_gitea_entry(self) -> None:
+        fake = _FakeProvisioner()
+        static_entry = _entry(Key=ManifestKeyConfig(provider="static", path="/k"))
+        with tempfile.TemporaryDirectory() as d, \
+                patch("bot_bottle.deploy_key_provisioner.get_provisioner", return_value=fake):
+            revoke_git_gate_provisioned_keys(_bottle(static_entry), Path(d))
+        self.assertEqual([], fake.deleted)
+
+    def test_skips_when_id_file_missing(self) -> None:
+        fake = _FakeProvisioner()
+        with tempfile.TemporaryDirectory() as d, \
+                patch("bot_bottle.deploy_key_provisioner.get_provisioner", return_value=fake):
+            # no id file written -> entry skipped
+            revoke_git_gate_provisioned_keys(_bottle(_gitea_entry()), Path(d))
+        self.assertEqual([], fake.deleted)
+
+    def test_missing_token_raises(self) -> None:
+        with tempfile.TemporaryDirectory() as d, \
+                patch.dict("os.environ", {}, clear=False):
+            import os
+            os.environ.pop("GITEA_TOK", None)
+            (Path(d) / "repo-deploy-key-id").write_text("kid123")
+            with self.assertRaises(RuntimeError):
+                revoke_git_gate_provisioned_keys(_bottle(_gitea_entry()), Path(d))
+
+
+if __name__ == "__main__":
+    unittest.main()