Skip to content

🚨 [CRITICAL] Fix Coverage Implementation Blocking Issues from MR #20 Review

🚨 Fix Coverage Implementation Blocking Issues from MR #20 Review

📊 Issue Overview

MR #20's comprehensive review identified 5 critical blocking issues and 3 high-priority improvements that must be resolved before the coverage requirements implementation can be merged. This issue tracks all required fixes to achieve approval.

Related MR: #20 - Coverage Requirements Implementation
Priority: CRITICAL - Blocks quality gate implementation
Teams Involved: Development, Security, QA, DevOps

🔴 BLOCKING ISSUES (Must Fix for MR Approval)

1. Critical Security Gap: server.ts Zero Coverage

Current State:

// From validate-security-coverage.js
'src/server.ts': { lines: 0, functions: 0, branches: 0 }  // CRITICAL

Risk: Main server file handling all MCP tool routing is completely untested, exposing authentication flows and error paths that could leak tokens.

Required Actions:

  • Add comprehensive unit tests for server.ts achieving minimum 50% coverage
  • Test all error handling paths and authentication flows
  • Validate token sanitization in error messages
  • Cover tool routing and request dispatch logic

Files to Modify:

  • tests/unit/server.test.ts (create)
  • src/server.ts (ensure testability)

2. Insufficient Security Coverage Target

Current: 90% target for security files
Required: 95-100% for authentication code (industry standard)

Required Actions:

  • Update security validation script to require 95% minimum for security files
  • Expand security-critical function list beyond current 4 functions
  • Add comprehensive tests for all authentication paths
  • Implement token exposure prevention tests

Files to Modify:

  • scripts/validate-security-coverage.js
  • vitest.config.ts

3. Zero Function/Branch Thresholds

Problem: Current configuration allows complete coverage gaps:

// Current vitest.config.ts
thresholds: {
  functions: 0,    // Allows 0% function coverage
  branches: 0,     // Allows 0% branch coverage
}

Required Changes:

// Required configuration
thresholds: {
  lines: 30,
  functions: 10,    // Minimum 10% (was 0)
  branches: 5,      // Minimum 5% (was 0)
  statements: 30,
  perFile: true     // Enable for better coverage distribution
}

Actions:

  • Update vitest.config.ts with non-zero thresholds
  • Enable per-file coverage for security-critical files
  • Document threshold progression plan

4. Test Infrastructure Instability

Issues:

  • Tests timing out at 30s/45s limits
  • CI environment detection flakiness
  • Cleanup operations failing
  • Performance degradation with coverage collection

Required Actions:

  • Optimize test performance to reduce execution time
  • Fix CI environment detection logic
  • Implement test parallelization
  • Add coverage caching strategy
  • Resolve Alpine Linux Rollup dependency issues

Evidence:

// Current CI timeouts indicate problems
timeout: isCI ? 45000 : 30000,
hookTimeout: isCI ? 60000 : 30000,

5. Missing Test Coverage for Critical Components

Critical Gaps Identified:

  • src/server-new.ts: 131 lines with minimal coverage
  • src/core.ts: Only 28% coverage for authentication logic
  • Handler integration points lack comprehensive tests

Required Actions:

  • Add unit tests for server-new.ts (target 70%+)
  • Increase core.ts coverage to 95% (security-critical)
  • Test all handler integration points
  • Cover error handling and edge cases

⚠️ HIGH PRIORITY IMPROVEMENTS

6. TDD Compliance Issues

Finding: Tests appear to be written after implementation

Required Actions:

  • Document TDD best practices in CONTRIBUTING.md
  • Refactor existing tests to focus on behavior vs implementation
  • Implement Red-Green-Refactor workflow documentation
  • Add TDD compliance checks to PR template

7. Coverage Measurement Gaps

Issue: No historical tracking or trend analysis

Required Actions:

  • Integrate coverage trending tool (Codecov/similar)
  • Set up coverage dashboards
  • Implement monthly coverage reports
  • Add coverage regression alerts

8. Missing ROI Justification

Concern: No clear business metrics for 80% target

Required Actions:

  • Define measurable outcomes (bug reduction, support tickets)
  • Create phased rollout plan (30% → 50% → 80%)
  • Benchmark against competing MCP servers
  • Document coverage benefits in README

📋 Implementation Plan

Phase 1: Critical Fixes (This Sprint)

  1. Day 1-2: Fix test infrastructure and timeouts
  2. Day 2-3: Add server.ts and server-new.ts test coverage
  3. Day 3-4: Update vitest.config.ts thresholds
  4. Day 4-5: Implement security coverage validation

Phase 2: Coverage Enhancement (Next Sprint)

  1. Increase core.ts coverage to 95%
  2. Implement coverage trend tracking
  3. Add test parallelization
  4. Document TDD practices

Phase 3: Long-term Improvements (Next Month)

  1. Achieve 50% overall coverage milestone
  2. Complete coverage dashboard setup
  3. Implement automated progression increases
  4. Full TDD compliance across codebase

✅ Acceptance Criteria

The following must be completed for MR #20 approval:

Critical Requirements

  • server.ts achieves minimum 50% coverage
  • Security files target increased to 95%
  • Function/branch thresholds set to non-zero values (10%/5%)
  • Test performance issues resolved (under 30s execution)
  • CI pipeline stable (no flaky tests)

Coverage Metrics Required

File Current Required Priority
src/server.ts 0% 50%+ CRITICAL
src/server-new.ts ~10% 70%+ HIGH
src/core.ts 28% 95%+ CRITICAL
Overall Functions 0% min 10%+ min HIGH
Overall Branches 0% min 5%+ min HIGH

Performance Requirements

  • Test suite executes in under 5 minutes
  • No individual test exceeds 10s timeout
  • Coverage generation under 10s
  • CI pipeline completes in under 10 minutes

🔧 Technical Details

Files Requiring Updates 

vitest.config.ts                    # Update thresholds
scripts/validate-security-coverage.js # Increase security requirements
tests/unit/server.test.ts           # Create comprehensive tests
tests/unit/server-new.test.ts       # Add unit tests
tests/unit/core.test.ts             # Enhance authentication tests
.gitlab-ci.yml                      # Add coverage caching

Test Coverage Commands 

# Check current coverage
npm run test:coverage

# Validate security coverage
npm run security:validate

# Check coverage thresholds
npm run coverage:check

# Generate HTML report
npm run coverage:report

🏷️ Labels

critical testing coverage security ci/cd blocking mr-20

👥 Assignees

  • Development Team: server.ts testing
  • Security Team: 95% coverage requirement
  • QA Team: test infrastructure fixes
  • DevOps Team: CI optimization

🔗 Related Links

This issue blocks MR #20 approval. All critical items must be resolved before the coverage implementation can be merged.