test: cover the gate lookup and the validate error path

codecov/patch reported 69.56% of the diff hit against a 80% target. The
gaps were the branches a caller reaches when there is nothing to consult:
gateIsOpen with no enclosing struct, and its skip over fields that carry
the right key with the wrong type or the right type with the wrong key —
either would silently turn a required field optional if it were mistaken
for the gate.

Also adds a unit test for validate rejecting a semantically invalid
config without the strict flag, which until now was only asserted
through the e2e suite.

gateIsOpen goes to 100%, ValidateCommand.Execute from 81.8% to 90.9%.
The two blocks still uncovered there predate this change: the log-level
warning branch and the json.Marshal error path.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

cli/validate_test.go

@@ -67,3 +67,40 @@ func TestValidateExecuteMissingFile(t *testing.T) {
 	err := cmd.Execute(nil)
 	assert.Error(t, err)
 }
+
+// TestValidateExecuteRunsValidatorWithoutStrictFlag pins that running validate
+// is itself the request to have the config checked. The checks used to sit
+// behind enable-strict-validation, which defaults to false, so the one command
+// whose purpose is validation reported success on a config it had not
+// inspected.
+//
+// The config below parses cleanly as INI and is only wrong semantically, so it
+// exercises the validator rather than the loader.
+func TestValidateExecuteRunsValidatorWithoutStrictFlag(t *testing.T) {
+	// Not parallel: modifies global os.Stdout which races with other tests.
+
+	configFile := filepath.Join(t.TempDir(), "config.ini")
+	content := `
+[global]
+web-address = definitely-not-an-address
+
+[job-exec "foo"]
+schedule = @every 10s
+command = echo "foo"
+`
+	require.NoError(t, os.WriteFile(configFile, []byte(content), 0o644))
+
+	r, w, _ := os.Pipe()
+	oldStdout := os.Stdout
+	os.Stdout = w
+	defer func() { os.Stdout = oldStdout }()
+
+	cmd := ValidateCommand{ConfigFile: configFile, Logger: test.NewTestLogger()}
+	err := cmd.Execute(nil)
+
+	w.Close()
+	_, _ = io.ReadAll(r)
+
+	require.Error(t, err, "an invalid web-address was accepted without the strict flag")
+	assert.Contains(t, err.Error(), "web-address")
+}

config/validator_conditional_test.go

@@ -4,6 +4,7 @@
 package config
 
 import (
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -77,3 +78,51 @@ func TestConditionalRequired_UnknownGateStaysRequired(t *testing.T) {
 		t.Error("with no gate to consult the field should stay required, got no error")
 	}
 }
+
+// TestGateIsOpen_InvalidParentKeepsFieldRequired covers the guard for a caller
+// that has no enclosing struct to offer — the internal helpers are called that
+// way in tests. With nothing to consult, the field stays required, which is
+// the same safe direction as an unresolvable gate.
+func TestGateIsOpen_InvalidParentKeepsFieldRequired(t *testing.T) {
+	t.Parallel()
+
+	cv := NewConfigValidator(nil)
+	if !cv.gateIsOpen(reflect.Value{}, "web-secret-key") {
+		t.Error("with no parent to inspect the field should stay required")
+	}
+}
+
+// TestGateIsOpen_IgnoresMismatchedFields covers the skip inside the search: a
+// field is only the gate if it is a bool AND carries the expected key. A
+// string field named like the gate, or a bool with a different key, must not
+// be mistaken for it.
+func TestGateIsOpen_IgnoresMismatchedFields(t *testing.T) {
+	t.Parallel()
+
+	type decoys struct {
+		// Right key, wrong type.
+		WebAuthEnabled string `gcfg:"web-auth-enabled"`
+		// Right type, wrong key.
+		SomethingElse bool `gcfg:"some-other-flag"`
+	}
+
+	cv := NewConfigValidator(nil)
+	parent := reflect.ValueOf(decoys{WebAuthEnabled: "true", SomethingElse: true})
+
+	// Neither decoy qualifies, so the search finds no gate and the field stays
+	// required rather than being switched on by the wrong field.
+	if !cv.gateIsOpen(parent, "web-secret-key") {
+		t.Error("a string field and an unrelated bool were treated as the gate")
+	}
+}
+
+// TestGateIsOpen_UnconditionalFieldsAlwaysRequired pins the common case: a
+// field with no entry in requiredWhen is not gated at all.
+func TestGateIsOpen_UnconditionalFieldsAlwaysRequired(t *testing.T) {
+	t.Parallel()
+
+	cv := NewConfigValidator(nil)
+	if !cv.gateIsOpen(reflect.ValueOf(gatedConfig{}), "web-address") {
+		t.Error("an ungated field reported as not required")
+	}
+}