test(api): cover authorization, validation and error paths in api handlers

[vavallee]

Summary

Tests only, no production changes. Adds 22 *_coverage_test.go files to internal/api, raising package statement coverage from 79.5% to 85.2% (measured on the same base, with the new tests skipped and then included).

Focus is authorization and validation first, then repo and provider error paths: tenancy 404s for another user's rows (recommendations, metadata profiles, books, pending grabs), requester rate limits and identity checks on requests, write-only credential handling on Prowlarr, indexer and download client updates, refused writes leaving the stored row untouched, and 500s when the repo fails. Every test asserts status, body and the stored state afterwards.

Biggest movers:

file	before	after
series.go	78.0%	89.4%
authors.go	80.7%	86.6%
queue.go	79.5%	90.0%
recommendations.go	46.6%	96.6%
abs_review.go	57.9%	85.7%
abs_import.go	38.6%	100%
authors_alias.go	51.2%	91.2%
abs_conflicts.go	52.2%	79.1%
requests.go	76.7%	82.0%
backup.go	63.4%	81.7%

Deliberately left alone because open PRs are changing them: GET /setting for non-admins (#2361), POST /author/book with a foreign id another user owns, and the Audnex follow-ups. Outbound calls use httptest servers only, no sleeps beyond bounded channel waits. Test names are spread across the race shards (36 A-B, 4 C-K, 35 L-Q, 26 R-Z), keeping C-K, already the biggest, light.

No production bugs found.

Test plan

• gofmt -l . clean
• go vet ./internal/api/
• golangci-lint run ./internal/api/ (v2.11.4): 0 issues
• go test ./internal/api/ -count=1 -timeout 40m passes, 85.2% coverage, rebased on 8ecf776
• CI race shards

🤖 Generated with Claude Code

https://claude.ai/code/session_016fJcCVbNnKsmj2MAAMwWj9

[github-actions]

Tests only, no production changes — 22 new *_coverage_test.go files, 5036 additions, 0 deletions.

What I checked

• No new external packages. Only github.com/go-chi/chi/v5 appears in imports; it's pre-existing.
• No t.Parallel(), time.Sleep, t.Skip, or os.Getenv in the new tests.
• No duplicate helper function names across the 22 files.
• SetEnforceTenancyForTests delegates to t.Setenv; cleanup is automatic and safe without t.Parallel().
• Tenancy: cross-user 404s verified and stored-state-unchanged asserted for recommendations, pending grabs, books (TestBookToggleExcludedCoverage), metadata profiles, authors, series.
• Credential write-only / no-leak: Prowlarr API key, OIDC client secret (GetProviders), indexer API key in pending release list — all tested.
• covQAsUser / covQIDRequest defined in queue_coverage_test.go and used across pending_coverage_test.go; fine within package api.
• The CSRF test case "auto behind https proxy" passes X-Forwarded-Proto: https directly to the handler (bypassing the proxy middleware) — but this accurately mirrors the existing code at auth.go:502 and auth.go:651, which already read that header. No new production behaviour is being introduced.
• gitleaks:allow annotation on the test-fixture secret in auth_coverage_test.go is correct.

PR looks clean.

— 🤖 Bindery triage bot (automated). Reply to correct me; a human will see it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!