Bose-SoundTouch/tests/integration/http-client/COVERAGE.md

Speaker-contract coverage (.http integration suite)

This is the coverage checklist for the JetBrains .http integration suite (make test-http-client). Its purpose is the regression net described in docs/content/docs/architecture/API-ROUTE-LAYOUT.md ("Regression safety: contract tests from the frozen recordings"): pin the frozen speaker contract (category 1a/1b routes) so the staged route refactor for issue #451 cannot silently change the wire.

Method

The inventory below was mined (read-only) from real recorded speaker traffic (User-Agent: Bose_Lisa/* / Bose/*, self/ category) across the local recording corpus (_/backup/*, tests/integration/testdata/interactions/). Recordings are used as a reference for route + request/response shape only; no raw recorded bodies (which carry real ids/IPs/MACs/tokens) are committed. Authored flows use the RFC-5737 / placeholder values from http-client.env.json.

TuneIn upstream (radiotime.com) is served by mock-tunein in CI (see TUNEIN-MOCK-MISSING.md), so the suite has no live external dependency.

Variable path segments are templated: {stationID}, {episodeID}, {hash}, {encodedURL}, {provider}/{file}.

Legend: ✅ covered · ⬜ gap · 〰️ partial (some status/variant uncovered).

Enforced by: TestFrozenRouteContractCoverage (cmd/soundtouch-service/coverage_guard_test.go). It walks the router for frozen-contract routes, matches each against the .http request lines, and golden-files the set of uncovered frozen routes (cmd/soundtouch-service/testdata/frozen_routes_uncovered.txt). Adding a new frozen route without a test, or a test that newly covers one, changes that set and fails the test, so this checklist can't silently drift from the code.

Frozen speaker routes

Method	Route	Status(es) observed	Covered by	State
GET	/streaming/account/{a}/full	200, 304	get_full_account.http, get_full_account_conditional.http	✅
GET	/streaming/account/{a}/devices	200	get_account_devices.http	✅
GET	/streaming/account/{a}/sources	200	get_account_sources.http	✅
GET	/streaming/account/{a}/presets/all	200	get_account_presets.http	✅
GET	/streaming/account/{a}/provider_settings	200	get_provider_settings.http	✅
POST	/streaming/account (+ /login)	201/200	create_account.http	✅
POST	/streaming/account/{a}/device/	201	register_device.http	✅
PUT	/streaming/account/{a}/device/{d}	200, 401	rename_device.http	〰️ (401 gap)
DELETE	/streaming/account/{a}/device/{d}	200	unregister_device.http	✅
GET	/streaming/account/{a}/device/{d}/group/	200	get_group.http	✅
GET	/streaming/account/{a}/device/{d}/presets	200, 304	get_presets.http, get_presets_conditional.http	✅
PUT	/streaming/account/{a}/device/{d}/preset/{n}	200	set_preset_5/6.http	✅
DELETE	/streaming/account/{a}/device/{d}/preset/{n}	200	delete_preset_6.http	✅
POST	/streaming/account/{a}/device/{d}/recent	201	post_recent.http	✅
GET	/streaming/account/{a}/device/{d}/recents	200	get_recents.http	✅
POST	/streaming/account/{a}/source	200	set_preset_5.http	✅
POST	/streaming/account/{a}/group/	201	create_group.http	✅
DELETE	/streaming/account/{a}/group/	200	delete_group.http	✅ (account-level teardown)
DELETE	/streaming/account/{a}/group/{id}	200	delete_group.http	✅
GET	/streaming/device/{d}/streaming_token	200	get_streaming_token.http	✅
GET	/streaming/software/update/account/{a}	200	get_software_update.http	✅
GET	/streaming/sourceproviders	200	get_sourceproviders.http	✅
GET	/streaming/resources/api_versions.xml	200	get_api_versions.http	✅
POST	/streaming/support/power_on	200	power_on.http	✅
POST	/streaming/support/customersupport	200	customer_support.http	✅
POST	/streaming/music/musicprovider/{id}/is_eligible	200	post_musicprovider_is_eligible.http	✅
POST	/accounts/{a}/devices	201	register_device.http	✅
DELETE	/accounts/{a}/devices/{d}	200	unregister_device.http	✅
GET	/updates/soundtouch	200	get_soundtouch_updates.http	✅
GET	/v1/auth	200, 403, 404	get_speaker_auth.http	✅ (200; 403/404 probe/edge)
POST	/v1/scmudc/{d}	200	post_scmudc_event.http	✅
GET	/v1/blacklist/{d}	405	get_blacklist.http	✅ (currently ignored: 405 stub)
POST	/alexa/certificate	501 (rare 200)	post_alexa_certificate.http	✅ (currently ignored: 501 stub)
GET	/bmx/registry/v1/services	200	get_bmx_services.http	✅
GET	/bmx/registry/v1/servicesAvailability	200	get_bmx_services_availability.http	✅
POST	/bmx/tunein/v1/token	200	tunein_playback_station.http	✅
GET	/bmx/tunein/v1/playback/station/{stationID}	200, 401	tunein_playback_station.http	✅ (offline via mock-tunein)
GET	/bmx/tunein/v1/playback/episode(s)/{episodeID}	200	—	⬜ (needs mock fixture, see TUNEIN-MOCK-MISSING.md)
POST	/bmx/tunein/v1/report	200	post_tunein_report.http	✅
POST/DELETE	/bmx/tunein/v1/favorite/{stationID}	202	tunein_favorite.http	✅ (local-only)
GET	/core02/svc-bmx-adapter-orion/prod/orion/station	200	get_orion_station.http	✅
GET	/custom/v1/playback/{encodedURL}	200	get_custom_playback.http	✅
GET	/media/aftertouch-ding.wav	200 (binary)	get_media_ding.http	✅
GET	/media/bmx-icons/{provider}/{file}	200 (binary)	get_bmx_icon.http	✅
GET	/media/tts/{hash}.mp3	200, 404 (binary)	—	⬜ (depends on prior TTS)
GET	/ced/soundtouch/.../index.xml	200	get_ced_index.http	✅ (absent paths 404)
POST	/oauth/device/{d}/.../15/token/cs3	200	post_oauth_token.http	✅
POST	/oauth/device/{d}/.../20/token/cs1	200	post_oauth_token_amazon.http	✅

App / provisioning surface (app-called, not the speaker data-plane)

The SoundTouch app (not the speaker) drives these. They are part of the frozen contract but a different audience; shapes are taken from _/mitm where a capture exists, otherwise from the handler (the current responses are canned / stubs).

Method	Route	Status	Covered by	Source
GET	/streaming/account/{a}/emailaddress	200	get_emailaddress.http	_/mitm capture
GET	/customer/account/{a}	200	get_customer_profile.http	handler (canned profile)
POST	/customer/account/{a}	200	post_customer_profile.http	handler (stub accept)
POST	/customer/account/{a}/password	200	post_customer_profile.http	handler (stub accept)
POST	/streaming/account/login	200	create_account.http	_/mitm capture

Not observed (lower priority / no fixture)

• /bmx/tunein/v1/navigate, /search, /search/next — registered (frozen), but in the corpus the speaker uses /playback/*; the search/navigate layer is driven by the app/UI (/api/tunein/*), not the speaker. No upstream fixture yet, see TUNEIN-MOCK-MISSING.md.
• /core02/svc-bmx-adapter-siriusxm-* — registered, but not present in this corpus (no SiriusXM device). Left as a known blank.

Remaining gaps

• /bmx/tunein/v1/playback/episode(s)/{id} — needs a captured radiotime profile-contents fixture for the mock (see TUNEIN-MOCK-MISSING.md).
• /media/tts/{hash}.mp3 — returns 200 only after a TTS has been generated (otherwise a 404 miss). Needs a prior /setup/tts/speak step to be a deterministic 200.
• PUT-device 401 (rename with a mismatched/blocked payload) — the only remaining status variant on an otherwise-covered route.