[test-improver] Improve tests for guard Registry.HasNonNoopGuard

[github-actions]

Test Improvements: internal/guard/guard_test.go

File Analyzed

• Test File: internal/guard/guard_test.go
• Package: internal/guard
• Lines of Code: 802 → 847 (+45 lines)

Improvements Made

1. Increased Coverage — Direct Tests for Registry.HasNonNoopGuard

Problem: The HasNonNoopGuard method in internal/guard/registry.go was called from internal/server/unified.go to determine whether DIFC should be auto-enabled:

// server/unified.go line 170
if !us.enableDIFC && (us.guardRegistry.HasNonNoopGuard() || ...) {

Despite being a meaningful predicate used in server startup logic, HasNonNoopGuard had no dedicated unit tests in guard_test.go. All other Registry methods (Register, Get, Has, List, Remove, GetGuardInfo) had explicit subtests — HasNonNoopGuard was the only gap.

2. New Test: TestGuardRegistry_HasNonNoopGuard

Added 6 subtests covering all branches of the HasNonNoopGuard method:

• ✅ empty registry returns false — verifies base case
• ✅ only noop guards returns false — verifies multiple noop guards don't trigger true
• ✅ one non-noop guard returns true — verifies detection of a single non-noop guard
• ✅ mix of noop and non-noop returns true — verifies any non-noop triggers true
• ✅ removing non-noop guard makes it return false — verifies dynamic removal
• ✅ replacing non-noop with noop returns false — verifies guard replacement

The tests reuse the existing mockGuard helper and follow the established subtest patterns throughout the file (consistent with TestGuardRegistry).

3. Cleaner & More Stable Tests

• ✅ Each subtest uses its own fresh NewRegistry() — fully isolated, no shared state
• ✅ Uses assert.True/assert.False for clear, readable assertions
• ✅ Tests the state before and after mutations (remove/replace) to validate dynamic behaviour
• ✅ Follows the existing file style exactly — no new imports needed

Why These Changes?

HasNonNoopGuard is the sentinel used by the server to auto-activate DIFC when a non-trivial guard is registered. A regression in this predicate (e.g., always returning false) would silently disable DIFC enforcement at startup — a security-relevant failure. Despite the rest of the Registry API being well-tested, this method was the only gap.

---

Generated by Test Improver Workflow
Focuses on better patterns, increased coverage, and more stable tests

Generated by Test Improver · ◷

[Copilot]

Pull request overview

Adds dedicated unit tests for Registry.HasNonNoopGuard in internal/guard, improving confidence in the predicate used by server startup logic to detect whether any “real” (non-noop) guards are registered.

Changes:

• Introduces TestGuardRegistry_HasNonNoopGuard with subtests covering empty, noop-only, non-noop, mixed, removal, and replacement scenarios.
• Ensures each subtest uses a fresh registry instance for isolation.

Show a summary per file

File	Description
internal/guard/guard_test.go	Adds new unit tests covering all main behavioral branches of Registry.HasNonNoopGuard.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0