补完单元测试覆盖率：81 个新测试覆盖 7 个关键文件

domain/action.rs: 38.6% → 100% (19 tests)
service/action.rs: 69.5% → 96.3% (26 tests)
email/ses.rs: 37.2% → 80.6% (6 tests)
middleware/rate_limit.rs: 62.1% → 77.4% (16 tests)
cache/mod.rs: 61.5% → 63.8% (8 tests)
api/webauthn.rs: 53.5% → 61.0% (5 tests)
api/password.rs: 65.9% → 70.9% (5 tests)

Overall: 90.12% → 91.05%

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gpgkd906

auth9-core/src/api/password.rs

@@ -213,4 +213,43 @@ mod tests {
         let response = MessageResponse::new("Test message");
         assert_eq!(response.message, "Test message");
     }
+
+    #[test]
+    fn test_forgot_password_input_deserialization() {
+        let json = r#"{"email": "test@example.com"}"#;
+        let input: ForgotPasswordInput = serde_json::from_str(json).unwrap();
+        assert_eq!(input.email, "test@example.com");
+    }
+
+    #[test]
+    fn test_reset_password_input_deserialization() {
+        let json = r#"{"token": "abc123", "new_password": "NewPass123!"}"#;
+        let input: ResetPasswordInput = serde_json::from_str(json).unwrap();
+        assert_eq!(input.token, "abc123");
+        assert_eq!(input.new_password, "NewPass123!");
+    }
+
+    #[test]
+    fn test_change_password_input_deserialization() {
+        let json = r#"{"current_password": "OldPass", "new_password": "NewPass123!"}"#;
+        let input: ChangePasswordInput = serde_json::from_str(json).unwrap();
+        assert_eq!(input.current_password, "OldPass");
+        assert_eq!(input.new_password, "NewPass123!");
+    }
+
+    #[test]
+    fn test_admin_set_password_input_deserialization() {
+        let json = r#"{"password": "TempPass123!", "temporary": true}"#;
+        let input: AdminSetPasswordInput = serde_json::from_str(json).unwrap();
+        assert_eq!(input.password, "TempPass123!");
+        assert!(input.temporary);
+    }
+
+    #[test]
+    fn test_admin_set_password_input_temporary_default() {
+        let json = r#"{"password": "TempPass123!"}"#;
+        let input: AdminSetPasswordInput = serde_json::from_str(json).unwrap();
+        assert_eq!(input.password, "TempPass123!");
+        assert!(!input.temporary);
+    }
 }

auth9-core/src/api/webauthn.rs

@@ -302,4 +302,52 @@ mod tests {
         let ip = extract_client_ip(&headers);
         assert!(ip.is_none());
     }
+
+    #[test]
+    fn test_extract_client_ip_xff_with_spaces() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-forwarded-for", "  192.168.1.1 , 10.0.0.1 ".parse().unwrap());
+        let ip = extract_client_ip(&headers);
+        assert_eq!(ip, Some("192.168.1.1".to_string()));
+    }
+
+    #[test]
+    fn test_extract_client_ip_xff_single() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-forwarded-for", "10.0.0.1".parse().unwrap());
+        let ip = extract_client_ip(&headers);
+        assert_eq!(ip, Some("10.0.0.1".to_string()));
+    }
+
+    #[test]
+    fn test_extract_client_ip_prefers_xff_over_real_ip() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-forwarded-for", "1.1.1.1".parse().unwrap());
+        headers.insert("x-real-ip", "2.2.2.2".parse().unwrap());
+        let ip = extract_client_ip(&headers);
+        assert_eq!(ip, Some("1.1.1.1".to_string()));
+    }
+
+    #[test]
+    fn test_authentication_start_response_fields() {
+        let response = AuthenticationStartResponse {
+            challenge_id: "ch-123".to_string(),
+            public_key: serde_json::json!({"rpId": "localhost"}),
+        };
+        assert_eq!(response.challenge_id, "ch-123");
+        let json = serde_json::to_string(&response).unwrap();
+        assert!(json.contains("rpId"));
+    }
+
+    #[test]
+    fn test_authentication_token_response_fields() {
+        let response = AuthenticationTokenResponse {
+            access_token: "tok-123".to_string(),
+            token_type: "Bearer".to_string(),
+            expires_in: 7200,
+        };
+        assert_eq!(response.access_token, "tok-123");
+        assert_eq!(response.token_type, "Bearer");
+        assert_eq!(response.expires_in, 7200);
+    }
 }

auth9-core/src/cache/mod.rs

@@ -1336,4 +1336,67 @@ mod tests {
         let result = cache.invalidate_user_roles_for_tenant(user_id, tenant_id).await;
         assert!(result.is_ok());
     }
+
+    // ========================================================================
+    // CacheOperations trait dispatch tests - OIDC and Refresh Token
+    // ========================================================================
+
+    #[tokio::test]
+    async fn test_noop_cache_operations_trait_oidc_state() {
+        let cache: &dyn CacheOperations = &NoOpCacheManager::new();
+        assert!(cache.store_oidc_state("nonce-1", "payload", 300).await.is_ok());
+        // NoOp impl stores in-memory, so consuming works
+        let result = cache.consume_oidc_state("nonce-1").await.unwrap();
+        assert!(result.is_some());
+        let second = cache.consume_oidc_state("nonce-1").await.unwrap();
+        assert!(second.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_noop_cache_operations_trait_refresh_session() {
+        let cache: &dyn CacheOperations = &NoOpCacheManager::new();
+        assert!(cache.bind_refresh_token_session("rt-1", "sid-1", 300).await.is_ok());
+        let result = cache.get_refresh_token_session("rt-1").await.unwrap();
+        assert_eq!(result.as_deref(), Some("sid-1"));
+        assert!(cache.remove_refresh_token_session("rt-1").await.is_ok());
+        let missing = cache.get_refresh_token_session("rt-1").await.unwrap();
+        assert!(missing.is_none());
+    }
+
+    #[test]
+    fn test_refresh_token_hash_deterministic() {
+        let hash1 = NoOpCacheManager::refresh_token_hash("test-token");
+        let hash2 = NoOpCacheManager::refresh_token_hash("test-token");
+        assert_eq!(hash1, hash2);
+    }
+
+    #[test]
+    fn test_refresh_token_hash_different_inputs() {
+        let hash1 = NoOpCacheManager::refresh_token_hash("token-a");
+        let hash2 = NoOpCacheManager::refresh_token_hash("token-b");
+        assert_ne!(hash1, hash2);
+    }
+
+    #[test]
+    fn test_cache_manager_refresh_token_hash_deterministic() {
+        let hash1 = CacheManager::refresh_token_hash("test-token");
+        let hash2 = CacheManager::refresh_token_hash("test-token");
+        assert_eq!(hash1, hash2);
+        // Both managers should produce same hash
+        let noop_hash = NoOpCacheManager::refresh_token_hash("test-token");
+        assert_eq!(hash1, noop_hash);
+    }
+
+    #[test]
+    fn test_oidc_state_key_format() {
+        let key = format!("{}:{}", keys::OIDC_STATE, "nonce-abc");
+        assert_eq!(key, "auth9:oidc_state:nonce-abc");
+    }
+
+    #[test]
+    fn test_refresh_token_session_key_format() {
+        let key = format!("{}:{}", keys::REFRESH_TOKEN_SESSION, "hash-abc");
+        assert_eq!(key, "auth9:refresh_session:hash-abc");
+    }
+
 }