test: unit tests for pkg/api core handlers (api.go) — 13.1% → 39.4% [quality]

[hivecommons-hive]

Test Improvement

Adds pkg/api/api_test.go — direct unit tests for the previously 0%-covered core handler cluster in pkg/api/api.go:

• Idea CRUD authorization (loadAuthorized, offeredToCallerRepo, handleGetIdea/handleUpdateIdea/handleDeleteIdea): private ideas 404 (not 403) to strangers so their existence doesn't leak; offers reveal a private idea to the target repo's owner only; writes are author-only even on public ideas.
• Admin surface (requireAdmin, handleAdminIdeas, handleAdminRematch*): DIBS_ADMINS gating (incl. anonymous), admin listing with provider fallback, engine-absent 503, unknown-idea 404, stale-job 409.
• Async rematch lifecycle: dry run (202) → status polling with since/job params → apply persists reviewed results → consumed dry run refuses re-apply (409).
• Input hygiene (decodeInput): invalid JSON 400, oversized body 413; client-settable status restricted to draft/offered on create and update.
• Listing scopes: handleListIdeas (mine/public/invalid, SuggestionsSeenAt scrubbed for non-authors), handleListRepos (accepting/all/mine/invalid), handleUpdateRepo (owner-only, 404/403).
• Pure helpers: firstNonEmpty, ideaForViewer (no mutation of the original), summarizeMatches top-3 cap, responseSince, storeErrStatus.

Hermetic: temp-dir store/registry, identity injected via auth.WithIdentity, admin via t.Setenv, nil-LLM engine uses the deterministic fallback matcher. pkg/api coverage: 13.1% → 39.4%. Full go test ./... green; async tests stable at -count=5. (Local run without -race: no cgo toolchain on this host; handlers guard shared state with rematchMu.)

Files claimed: pkg/api/api_test.go (new, tests only — no production code changes). Disjoint from open PRs pluk#43 (Dependabot config) and hotshot#34 (install.sh tests).

Related Issue

Refs #136 (partial fix: covers the api.go cluster; wave2/settlement/market/wave3 handlers remain untested and are tracked there)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment